Edit tour

Windows Analysis Report
new booking 9086432659087.exe

Overview

General Information

Sample name:	new booking 9086432659087.exe
Analysis ID:	1566551
MD5:	58739df6a0b0831b6e8400c4d24dbbd2
SHA1:	e0cf1966f5cc82208f434d61a554e6a17224289b
SHA256:	fcdad5f2e1b2286dca7092c105a515c8b3204af54017e19b27be456925511bf8
Tags:	exeRedLineStealeruser-cocaman
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

new booking 9086432659087.exe (PID: 7592 cmdline: "C:\Users\user\Desktop\new booking 9086432659087.exe" MD5: 58739DF6A0B0831B6E8400C4D24DBBD2)

RegSvcs.exe (PID: 7608 cmdline: "C:\Users\user\Desktop\new booking 9086432659087.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.thelamalab.com", "Username": "billing@thelamalab.com", "Password": "Thel@malab@20!9"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2896148142.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1657136423.0000000001C40000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 ED 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000001.00000002.2896148142.0000000002D97000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.2895206946.0000000000400000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 ED 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f5c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f62d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f69f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f7c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4031d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4038f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40419:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x404ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40515:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40587:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4061d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x406ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.2896148142.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2896148142.0000000002D41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7608	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.new booking 9086432659087.exe.1c40000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 ED 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.RegSvcs.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 ED 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
1.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 ED 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.RegSvcs.exe.2bd0ee8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.2bd0ee8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.2bd0ee8.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.2bd0ee8.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d635:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d731:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d7c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d82d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d89f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d935:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3d9c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.5310000.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.5310000.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.5310000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.5310000.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f5c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f62d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f69f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f7c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.2bd0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.2bd0000.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.2bd0000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.2bd0000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4031d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4038f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40419:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x404ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40515:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40587:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4061d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x406ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.29eef66.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.29eef66.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.29eef66.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.29eef66.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e51d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e58f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e619:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e6ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e715:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e787:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e81d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3e8ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f5c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f62d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f69f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f7c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.29efe4e.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.29efe4e.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.29efe4e.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.29efe4e.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d635:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d731:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d7c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d82d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d89f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d935:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3d9c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.5310000.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.5310000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.5310000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.5310000.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d635:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d731:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d7c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d82d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d89f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d935:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3d9c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3d46458.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.3d46458.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.3d46458.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.3d46458.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d635:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d731:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d7c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d82d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d89f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d935:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3d9c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.2bd0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.2bd0000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.2bd0000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.2bd0000.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e51d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e58f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e619:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e6ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e715:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e787:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e81d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3e8ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3d45570.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.3d45570.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.3d45570.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.29eef66.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.29eef66.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.29eef66.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.29eef66.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4031d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4038f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40419:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x404ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40515:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40587:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4061d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x406ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3d45570.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4031d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8ce55:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4038f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8cec7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40419:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8cf51:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x404ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8cfe3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40515:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8d04d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40587:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8d0bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4061d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8d155:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x406ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8d1e5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3d45570.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.3d45570.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.3d45570.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.3d45570.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3e51d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3e58f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3e619:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3e6ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3e715:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3e787:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3e81d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3e8ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3d92f90.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.3d92f90.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.3d92f90.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.3d92f90.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.3d92f90.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.3d92f90.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.3d92f90.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f5c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f62d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f69f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f7c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3d92f90.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3d635:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3d6a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3d731:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3d7c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3d82d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3d89f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3d935:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3d9c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3d46458.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.3d46458.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.3d46458.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.3d46458.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x8bf6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x8bfdf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x8c069:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f5c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x8c0fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f62d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x8c165:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f69f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x8c1d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x8c26d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f7c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x8c2fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.29efe4e.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.29efe4e.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.29efe4e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.29efe4e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f4a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f5c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f62d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f69f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f7c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 62 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 162.251.80.30, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7608, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T12:36:49.639190+0100	2030171	1	A Network Trojan was detected	192.168.2.4	49730	162.251.80.30	587	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T12:37:01.666668+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49730	162.251.80.30	587	TCP

ETPRO MALWARE Agent Tesla Exfil via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T12:37:01.666668+0100	2855245	1	A Network Trojan was detected	192.168.2.4	49730	162.251.80.30	587	TCP

ETPRO MALWARE Win32/Agent Tesla SMTP Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T12:36:49.639190+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	49730	162.251.80.30	587	TCP

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T12:36:49.639190+0100	2840032	1	A Network Trojan was detected	192.168.2.4	49730	162.251.80.30	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.thelamalab.com", "Username": "billing@thelamalab.com", "Password": "Thel@malab@20!9"}

Multi AV Scanner detection for submitted file

Source: new booking 9086432659087.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: new booking 9086432659087.exe

Joe Sandbox ML: detected

Source: new booking 9086432659087.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: new booking 9086432659087.exe, 00000000.00000003.1653871069.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, new booking 9086432659087.exe, 00000000.00000003.1653766335.00000000038D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: new booking 9086432659087.exe, 00000000.00000003.1653871069.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, new booking 9086432659087.exe, 00000000.00000003.1653766335.00000000038D0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0034445A
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034C6D1 FindFirstFileW,FindClose,	0_2_0034C6D1
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0034C75C
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0034EF95
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0034F0F2
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0034F3F3
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_003437EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_003437EF
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00343B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00343B12
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0034BCBC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.4:49730 -> 162.251.80.30:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49730 -> 162.251.80.30:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:49730 -> 162.251.80.30:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:49730 -> 162.251.80.30:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:49730 -> 162.251.80.30:587

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 162.251.80.30:587

Source: Joe Sandbox View

IP Address: 162.251.80.30 162.251.80.30

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 162.251.80.30:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_003522EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_003522EE

Source: global traffic

DNS traffic detected: DNS query: mail.thelamalab.com

Source: RegSvcs.exe, 00000001.00000002.2896148142.0000000002D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.thelamalab.com
Source: RegSvcs.exe, 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, abAX9N.cs

.Net Code: K8VU1S

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00354164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00354164

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00354164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00354164

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00353F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00353F66

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_0034001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_0034001C

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_0036CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0036CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.new booking 9086432659087.exe.1c40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.RegSvcs.exe.2bd0ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.2bd0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.29eef66.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.29efe4e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.5310000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.3d46458.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.2bd0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.29eef66.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.3d45570.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.3d45570.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.3d92f90.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1657136423.0000000001C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000002.2895206946.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: This is a third-party compiled AutoIt script.	0_2_002E3B3A
Source: new booking 9086432659087.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: new booking 9086432659087.exe, 00000000.00000000.1645497749.0000000000394000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_43c7bcd9-6
Source: new booking 9086432659087.exe, 00000000.00000000.1645497749.0000000000394000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_1fbe4f36-8
Source: new booking 9086432659087.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8b55bc5b-1
Source: new booking 9086432659087.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_2efe343f-2

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_0034A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_0034A1EF

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00338310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00338310

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_003451BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_003451BD

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030D975	0_2_0030D975
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002EFCE0	0_2_002EFCE0
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_003021C5	0_2_003021C5
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_003162D2	0_2_003162D2
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_003603DA	0_2_003603DA
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0031242E	0_2_0031242E
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_003025FA	0_2_003025FA
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0033E616	0_2_0033E616
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002EE6A0	0_2_002EE6A0
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002F66E1	0_2_002F66E1
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0031878F	0_2_0031878F
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002F8808	0_2_002F8808
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00360857	0_2_00360857
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00316844	0_2_00316844
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00348889	0_2_00348889
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030CB21	0_2_0030CB21
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00316DB6	0_2_00316DB6
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002F6F9E	0_2_002F6F9E
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002F3030	0_2_002F3030
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00303187	0_2_00303187
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030F1D9	0_2_0030F1D9
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002F52A5	0_2_002F52A5
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002E1287	0_2_002E1287
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00301484	0_2_00301484
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002F5520	0_2_002F5520
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00307696	0_2_00307696
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002F5760	0_2_002F5760
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00301978	0_2_00301978
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00319AB5	0_2_00319AB5
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030BDA6	0_2_0030BDA6
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00301D90	0_2_00301D90
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00367DDB	0_2_00367DDB
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002EDF00	0_2_002EDF00
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002F3FE0	0_2_002F3FE0
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_01065240	0_2_01065240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00408C60	1_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040DC11	1_2_0040DC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00407C3F	1_2_00407C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00418CCC	1_2_00418CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00406CA0	1_2_00406CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004028B0	1_2_004028B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041A4BE	1_2_0041A4BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00408C60	1_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00418244	1_2_00418244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00401650	1_2_00401650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00402F20	1_2_00402F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004193C4	1_2_004193C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00418788	1_2_00418788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00402F89	1_2_00402F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00402B90	1_2_00402B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004073A0	1_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0297D680	1_2_0297D680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0297CA68	1_2_0297CA68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02970FD0	1_2_02970FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02971030	1_2_02971030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0297CDB0	1_2_0297CDB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_062FADC8	1_2_062FADC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_062F8358	1_2_062F8358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_062F5018	1_2_062F5018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_062FF080	1_2_062FF080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_062FE5F0	1_2_062FE5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_062F0006	1_2_062F0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_062F0040	1_2_062F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_063356E0	1_2_063356E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_063395F8	1_2_063395F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06334348	1_2_06334348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_063378D8	1_2_063378D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06330638	1_2_06330638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06338040	1_2_06338040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06335F58	1_2_06335F58

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0040E1D8 appears 43 times
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: String function: 00300AE3 appears 70 times
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: String function: 002E7DE1 appears 35 times
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: String function: 00308900 appears 42 times

Source: new booking 9086432659087.exe, 00000000.00000002.1657136423.0000000001C40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename9d02a015-5a5b-4340-adbb-c530e02a0bc4.exe4 vs new booking 9086432659087.exe
Source: new booking 9086432659087.exe, 00000000.00000003.1654506206.0000000003B9D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs new booking 9086432659087.exe
Source: new booking 9086432659087.exe, 00000000.00000003.1653228393.00000000039F3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs new booking 9086432659087.exe

Source: new booking 9086432659087.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.new booking 9086432659087.exe.1c40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.RegSvcs.exe.2bd0ee8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.2bd0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.29eef66.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.29efe4e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.5310000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.3d46458.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.2bd0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.29eef66.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.3d45570.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.3d45570.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.3d92f90.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1657136423.0000000001C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000002.2895206946.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, RsYAkkzVoy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, Kqqzixk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, xROdzGigX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, ywes.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, iPVW0zV.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, 1Pi9sgbHwoV.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@1/1

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_0034A06A GetLastError,FormatMessageW,

0_2_0034A06A

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_003381CB AdjustTokenPrivileges,CloseHandle,		0_2_003381CB
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_003387E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_003387E1

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_0034B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0034B333

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_0035EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0035EE0D

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_003583BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_003583BB

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_002E4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_002E4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

File created: C:\Users\user\AppData\Local\Temp\autCBE4.tmp

Jump to behavior

Source: new booking 9086432659087.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: new booking 9086432659087.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\new booking 9086432659087.exe "C:\Users\user\Desktop\new booking 9086432659087.exe"
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\new booking 9086432659087.exe"
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\new booking 9086432659087.exe"	Jump to behavior

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: new booking 9086432659087.exe

Static file information: File size 1184768 > 1048576

Source: new booking 9086432659087.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: new booking 9086432659087.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: new booking 9086432659087.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: new booking 9086432659087.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: new booking 9086432659087.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: new booking 9086432659087.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: new booking 9086432659087.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: new booking 9086432659087.exe, 00000000.00000003.1653871069.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, new booking 9086432659087.exe, 00000000.00000003.1653766335.00000000038D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: new booking 9086432659087.exe, 00000000.00000003.1653871069.0000000003A70000.00000004.00001000.00020000.00000000.sdmp, new booking 9086432659087.exe, 00000000.00000003.1653766335.00000000038D0000.00000004.00001000.00020000.00000000.sdmp

Source: new booking 9086432659087.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: new booking 9086432659087.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: new booking 9086432659087.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: new booking 9086432659087.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: new booking 9086432659087.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_002E4B37 LoadLibraryA,GetProcAddress,

0_2_002E4B37

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034848F push FFFFFF8Bh; iretd	0_2_00348491
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030E70F push edi; ret	0_2_0030E711
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030E828 push esi; ret	0_2_0030E82A
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00308945 push ecx; ret	0_2_00308958
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030EA03 push esi; ret	0_2_0030EA05
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030EAEC push edi; ret	0_2_0030EAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041C40C push cs; iretd	1_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00423149 push eax; ret	1_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041C50E push cs; iretd	1_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004231C8 push eax; ret	1_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040E21D push ecx; ret	1_2_0040E230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041C6BE push ebx; ret	1_2_0041C6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040BB97 push dword ptr [ecx-75h]; iretd	1_2_0040BBA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0633FE10 push es; ret	1_2_0633FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0633FDF0 push es; ret	1_2_0633FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0633F980 push es; ret	1_2_0633FE00

Source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'dGSfvY0DsC3Cp', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'dGSfvY0DsC3Cp', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'dGSfvY0DsC3Cp', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'dGSfvY0DsC3Cp', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'dGSfvY0DsC3Cp', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_002E48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_002E48D7
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00365376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00365376

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00303187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00303187

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

API/Special instruction interceptor: Address: 1064E64

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

1_2_004019F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1785			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7875			Jump to behavior

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-101651

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

API coverage: 4.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0034445A
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034C6D1 FindFirstFileW,FindClose,	0_2_0034C6D1
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0034C75C
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0034EF95
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0034F0F2
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0034F3F3
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_003437EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_003437EF
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00343B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00343B12
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0034BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0034BCBC

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_002E49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_002E49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98026	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97809	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97702	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97584	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97447	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95370	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95039	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94916	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94809	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.2897758008.0000000005622000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	API call chain: ExitProcess graph end node			graph_0-100472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00353F09 BlockInput,

0_2_00353F09

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_002E3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_002E3B3A

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00315A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00315A7C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

1_2_004019F0

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_002E4B37 LoadLibraryA,GetProcAddress,

0_2_002E4B37

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_01065130 mov eax, dword ptr fs:[00000030h]	0_2_01065130
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_010650D0 mov eax, dword ptr fs:[00000030h]	0_2_010650D0
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_01063AC0 mov eax, dword ptr fs:[00000030h]	0_2_01063AC0

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_003380A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_003380A9

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030A124 SetUnhandledExceptionFilter,	0_2_0030A124
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_0030A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0030A155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040CE09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040E61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00416F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004123F1 SetUnhandledExceptionFilter,	1_2_004123F1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: BA5008

Jump to behavior

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_003387B1 LogonUserW,

0_2_003387B1

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_002E3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_002E3B3A

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_002E48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_002E48D7

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00344C27 mouse_event,

0_2_00344C27

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\new booking 9086432659087.exe"

Jump to behavior

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00337CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00337CAF

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_0033874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0033874B

Source: new booking 9086432659087.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: new booking 9086432659087.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_0030862B cpuid

0_2_0030862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: GetLocaleInfoA,

1_2_00417A20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00314E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00314E87

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00321E06 GetUserNameW,

0_2_00321E06

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_00313F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00313F3A

Source: C:\Users\user\Desktop\new booking 9086432659087.exe

Code function: 0_2_002E49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_002E49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2896148142.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896148142.0000000002D97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896148142.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7608, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: new booking 9086432659087.exe	Binary or memory string: WIN_81
Source: new booking 9086432659087.exe	Binary or memory string: WIN_XP
Source: new booking 9086432659087.exe	Binary or memory string: WIN_XPe
Source: new booking 9086432659087.exe	Binary or memory string: WIN_VISTA
Source: new booking 9086432659087.exe	Binary or memory string: WIN_7
Source: new booking 9086432659087.exe	Binary or memory string: WIN_8
Source: new booking 9086432659087.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896148142.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7608, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2896148142.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896148142.0000000002D97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896148142.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7608, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5310000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.2bd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29eef66.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d45570.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d92f90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3d46458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.29efe4e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00356283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00356283
Source: C:\Users\user\Desktop\new booking 9086432659087.exe	Code function: 0_2_00356747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00356747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 Software Packing	NTDS	148 System Information Discovery	Distributed Component Object Model	121 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	3 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
new booking 9086432659087.exe	39%	ReversingLabs	Win32.Trojan.AutoitInject
new booking 9086432659087.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://mail.thelamalab.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.thelamalab.com	162.251.80.30	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.thelamalab.com	RegSvcs.exe, 00000001.00000002.2896148142.0000000002D97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	RegSvcs.exe, 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.251.80.30	mail.thelamalab.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566551
Start date and time:	2024-12-02 12:36:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	new booking 9086432659087.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 54 Number of non-executed functions: 276
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: new booking 9086432659087.exe

Simulations

Behavior and APIs

Time	Type	Description
06:36:56	API Interceptor	48x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.251.80.30	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	shipping doc -GY298035826.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	w6dnPra4mx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	shipping doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	shipping advice.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.thelamalab.com	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	shipping doc -GY298035826.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	w6dnPra4mx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	shipping doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	shipping advice.exe	Get hash	malicious	AgentTesla	Browse	162.251.80.30
	new p o.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	SecuriteInfo.com.Win32.PWSX-gen.27121.31008.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	SecuriteInfo.com.Win32.PWSX-gen.28055.17747.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	SHIPPING ORDER.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	rAttached_updat.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.76.231.42
	LPO-2024-357.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	Quote5000AFC.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	199.79.62.115
	Quote1000AFC.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	199.79.62.115
	shipping doc -GY298035826.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	New Purchase Order Document for PO1136908 000 SE.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	199.79.63.24
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	199.79.63.24
	https://www.google.com.bn/url?snf=vpsBrmjsMjZT0YKBELze&nuu=B4grUxP5T5pV5xJiiFp0&sa=t&ndg=e2p4qPDSQqlwr77oflqr&pdbr=npO0StsDFHvGF7jwYfWY&np=slEjuRPdabbflvaXgHau&cb=IhzFYfcuqq5m2vva4DTH&url=amp%2Fbeutopiantech.com%2Fchd%2FroghgehdjtiE-SURECHDDam9lbC5kZW5vZnJpb0BoYW5lc2NvbXBhbmllcy5jb20=	Get hash	malicious	Unknown	Browse	103.211.216.144

Process:	C:\Users\user\Desktop\new booking 9086432659087.exe
File Type:	data
Category:	dropped
Size (bytes):	266936
Entropy (8bit):	7.977347597586976
Encrypted:	false
SSDEEP:	6144:egn1Jb0nQP710s3Xz3ngzfhFBKdP2kzAB:egn1J1pT3ghCAB
MD5:	A3721111F4ADD231F6A9C7EC97AEB49D
SHA1:	D27356467E69BF29537DBE9DD519137D8CC7F463
SHA-256:	E7F72C1C97005CCBCF3445BA8626E5E912F6A6F08655BAD7D0FCF57AB04C8AAD
SHA-512:	143E420EF6EE68A8371E2DFCC35A450F93D391117773543BE318DA9E8D61F843AF85000BDB9BB0E370655E235AAC83BD15A4E3012BB0B824AB99B861DFB850F2
Malicious:	false
Reputation:	low
Preview:	EA06......y..e..W..'..~.i6.Qt.^.K....p.BaL.M.@.....\|]@.B.\.Vj....#....X<..$.N..\|.m!.V.2.f]d..b.Yl...].p;\b.#.T... ....sy..O{...s2.I.S[.o).OzTi..KH...[9.Ne...m.j4....Y.S,..E3.......^.<@(>9$....c.jE^7M.N(.....#Z....\..g....mZ.T@.+.8.......B...M(.....W..(f.....2.W.N'....mX.T..J.".O..<2....1. .gp......x..T.~....\|?.Y.......}..U^..).=f....}...F....%.....:.....Q....z}P...:f.t.(\|.(.......\|....=(..`.....(X.Uz.h...M..>?.z}G.N@.....#.(7@.......,}........l..S...w.V..94.......^M9.s.3L4n...~3yL>.......O.>.0..:..Uv...P....2...i0\......H}..e.^pS..B..S'~.N...U26.<.a..bT.....Q?7?./O.Gy...GC..f..>..L.I..<w.g...kTN..g......^........9a.S&.y.2.N.j5.;...H..+s.tK.S..Pog..m....3{..P..l@..k..{...Q.A....&.l../.]... ..@(.e .`.l%...:...o.5_.>.4..t..j.....= QC.=.......a..G./.....@(.U..K.M..~.cY...f.j.W...n..M?.=.Ln..l.x.P.Q{D..]..ht...M.l&..-jcU.\.w..3.....S\|w.U..G.5:t...S...."9,....2%i.v..<.2....0...gQ[..`>jP.a..e.\|}..!&..v.9._.2..99....m.u/...d.)........Z..CV.m..

C:\Users\user\AppData\Local\Temp\unjust

Download File

Process:	C:\Users\user\Desktop\new booking 9086432659087.exe
File Type:	data
Category:	dropped
Size (bytes):	267776
Entropy (8bit):	7.874000554868728
Encrypted:	false
SSDEEP:	6144:+Bva9sZgoM61zZNlhbBqyx7dV72Ra0w9DYE2kE:VuZgjsbBqyZ376aKE2kE
MD5:	2A2E0779DA66B457CF5E4C460CA63BC0
SHA1:	E847F82A31448A9E77924BFF180143572719A888
SHA-256:	D73D89ED8F8993EA0FE5A895A219EA287033B75F1B2FE2FA7740509F352A6949
SHA-512:	9692B8BB11EDB08F9EB6FD580289463A391660C754944EFAED554BDECD2B7A06E76101FE1A95B6020B3726E00BC4560CDF5A4AD64513753AF4D10A15974904D0
Malicious:	false
Reputation:	low
Preview:	y..KLCHWSL88.46.DSL4WXK.CHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL.WXKA\.YW.1...5z.e.$]$x;=,/%6!.[Q"ZY.d1).%-%o&w..k.]#PStI^F.WXKOCHW?\...=.Hv5.2.&.5}`7)h=.F;..Hq5.2.&.5.2.)eoVF,=.Hhg:2.&.5}`3)z=.Fb%W^v5.24WXKOCHWWL880L46$.K4WXK..HW.M<8D.4fZDSL4WXK.CkV\M180.56Z>QL4WXK`.HWW\880.56ZD.L4GXKOAHWRL880L46_DSL4WXKO#LWWH88.w66XDS.4WHKOSHWWL(80\46ZDSL$WXKOCHWWL88.Y66.DSL47ZK..IWWL880L46ZDSL4WXKOCHWWL88..56FDSL4WXKOCHWWL880L46ZDSL4WXK.NJW.L880L46ZDSL4.YK.BHWWL880L46ZDSL4WXKOCHWWL88.8QN.DSL,.YKOSHWW.980H46ZDSL4WXKOCHWwL8X.>PW.%SL.:XKO.IWW"880.56ZDSL4WXKOCHW.L8x.(UB;DSL.gXKOcJWWZ880F66ZDSL4WXKOCHW.L8..>GD9DSL..YKO#JWW.980l66ZDSL4WXKOCHW.L8x0L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL4WXKOCHWWL880L46ZDSL

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.165772855297292
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	new booking 9086432659087.exe
File size:	1'184'768 bytes
MD5:	58739df6a0b0831b6e8400c4d24dbbd2
SHA1:	e0cf1966f5cc82208f434d61a554e6a17224289b
SHA256:	fcdad5f2e1b2286dca7092c105a515c8b3204af54017e19b27be456925511bf8
SHA512:	213c5f0c4446e3e1126b32bdb08f9570f1c09afe8117d4116a3915a646ecf576c399b802b5f868b47766ed1d732e0b2a7ed2a5938bbd45168749f79aa31f11ca
SSDEEP:	24576:xu6J33O0c+JY5UZ+XC0kGso6FaYnFdwFV+KALqzCUWO048cWY:ju0c++OCvkGs9FaYFdOnuUW5xY
TLSH:	BD45CF2273DDC361CB669133BF6AB7016EBF7C614630B85B2F880D7DA950162162D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674CFFD6 [Mon Dec 2 00:31:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F9698B0CDBAh
jmp 00007F9698AFFB84h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F9698AFFD0Ah
cmp edi, eax
jc 00007F9698B0006Eh
bt dword ptr [004C31FCh], 01h
jnc 00007F9698AFFD09h
rep movsb
jmp 00007F9698B0001Ch
cmp ecx, 00000080h
jc 00007F9698AFFED4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F9698AFFD10h
bt dword ptr [004BE324h], 01h
jc 00007F9698B001E0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F9698AFFEADh
test edi, 00000003h
jne 00007F9698AFFEBEh
test esi, 00000003h
jne 00007F9698AFFE9Dh
bt edi, 02h
jnc 00007F9698AFFD0Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F9698AFFD13h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F9698AFFD65h
bt esi, 03h
jnc 00007F9698AFFDB8h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x58adc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x120000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x58adc	0x58c00	1d0f77352bf2d976a21cdeba1f533f37	False	0.9257950044014085	data	7.890745356455788	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x120000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x4fda3	data			1.0003240846900558
RT_GROUP_ICON	0x11f55c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11f5d4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11f5e8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11f5fc	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11f610	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11f6ec	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-02T12:36:49.639190+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	49730	162.251.80.30	587	TCP
2024-12-02T12:36:49.639190+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	49730	162.251.80.30	587	TCP
2024-12-02T12:36:49.639190+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	49730	162.251.80.30	587	TCP
2024-12-02T12:37:01.666668+0100	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	192.168.2.4	49730	162.251.80.30	587	TCP
2024-12-02T12:37:01.666668+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49730	162.251.80.30	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 12:36:57.526875973 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:36:57.647890091 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:36:57.647965908 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:36:58.913752079 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:36:58.914889097 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:36:59.035100937 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:36:59.308161020 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:36:59.317790985 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:36:59.438502073 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:36:59.705667973 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:36:59.705898046 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:36:59.826462030 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:00.298847914 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:00.299032927 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:37:00.419171095 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:00.690839052 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:00.691006899 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:37:00.811830044 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:01.267093897 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:01.267267942 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:37:01.387253046 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:01.666080952 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:01.666629076 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:37:01.666667938 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:37:01.666691065 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:37:01.666712999 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:37:01.786811113 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:01.786823988 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:01.786839962 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:01.786849022 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:02.187083006 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:37:02.232805014 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:38:36.905150890 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:38:37.025265932 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:38:37.489840031 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:38:37.489953041 CET	587	49730	162.251.80.30	192.168.2.4
Dec 2, 2024 12:38:37.490017891 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:38:37.490017891 CET	49730	587	192.168.2.4	162.251.80.30
Dec 2, 2024 12:38:37.610023975 CET	587	49730	162.251.80.30	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 12:36:56.892573118 CET	55670	53	192.168.2.4	1.1.1.1
Dec 2, 2024 12:36:57.520761967 CET	53	55670	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 12:36:56.892573118 CET	192.168.2.4	1.1.1.1	0x1baa	Standard query (0)	mail.thelamalab.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 12:36:57.520761967 CET	1.1.1.1	192.168.2.4	0x1baa	No error (0)	mail.thelamalab.com		162.251.80.30	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 2, 2024 12:36:58.913752079 CET	587	49730	162.251.80.30	192.168.2.4	220-md-114.webhostbox.net ESMTP Exim 4.96.2 #2 Mon, 02 Dec 2024 17:06:58 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Dec 2, 2024 12:36:58.914889097 CET	49730	587	192.168.2.4	162.251.80.30	EHLO 609290
Dec 2, 2024 12:36:59.308161020 CET	587	49730	162.251.80.30	192.168.2.4	250-md-114.webhostbox.net Hello 609290 [8.46.123.228] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Dec 2, 2024 12:36:59.317790985 CET	49730	587	192.168.2.4	162.251.80.30	AUTH login YmlsbGluZ0B0aGVsYW1hbGFiLmNvbQ==
Dec 2, 2024 12:36:59.705667973 CET	587	49730	162.251.80.30	192.168.2.4	334 UGFzc3dvcmQ6
Dec 2, 2024 12:37:00.298847914 CET	587	49730	162.251.80.30	192.168.2.4	235 Authentication succeeded
Dec 2, 2024 12:37:00.299032927 CET	49730	587	192.168.2.4	162.251.80.30	MAIL FROM:<billing@thelamalab.com>
Dec 2, 2024 12:37:00.690839052 CET	587	49730	162.251.80.30	192.168.2.4	250 OK
Dec 2, 2024 12:37:00.691006899 CET	49730	587	192.168.2.4	162.251.80.30	RCPT TO:<jinhux31@gmail.com>
Dec 2, 2024 12:37:01.267093897 CET	587	49730	162.251.80.30	192.168.2.4	250 Accepted
Dec 2, 2024 12:37:01.267267942 CET	49730	587	192.168.2.4	162.251.80.30	DATA
Dec 2, 2024 12:37:01.666080952 CET	587	49730	162.251.80.30	192.168.2.4	354 Enter message, ending with "." on a line by itself
Dec 2, 2024 12:37:01.666712999 CET	49730	587	192.168.2.4	162.251.80.30	.
Dec 2, 2024 12:37:02.187083006 CET	587	49730	162.251.80.30	192.168.2.4	250 OK id=1tI4jd-001JRk-1T
Dec 2, 2024 12:38:36.905150890 CET	49730	587	192.168.2.4	162.251.80.30	QUIT
Dec 2, 2024 12:38:37.489840031 CET	587	49730	162.251.80.30	192.168.2.4	221 md-114.webhostbox.net closing connection

Target ID:	0
Start time:	06:36:53
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\new booking 9086432659087.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\new booking 9086432659087.exe"
Imagebase:	0x2e0000
File size:	1'184'768 bytes
MD5 hash:	58739DF6A0B0831B6E8400C4D24DBBD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000000.00000002.1657136423.0000000001C40000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:36:54
Start date:	02/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\new booking 9086432659087.exe"
Imagebase:	0x810000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2896148142.0000000002D8F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2896148142.0000000002D97000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.2895912615.00000000029AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000001.00000002.2895206946.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000001.00000002.2897481850.0000000005310000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000001.00000002.2896068383.0000000002BD0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.2896992954.0000000003D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2896148142.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2896148142.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	8.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	170

Executed Functions

Function 002E3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 002E3B68
IsDebuggerPresent.KERNEL32 ref: 002E3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,003A52F8,003A52E0,?,?), ref: 002E3BEB

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

Part of subcall function 002F092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,002E3C14,003A52F8,?,?,?), ref: 002F096E

SetCurrentDirectoryW.KERNEL32(?), ref: 002E3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00397770,00000010), ref: 0031D281
SetCurrentDirectoryW.KERNEL32(?,003A52F8,?,?,?), ref: 0031D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00394260,003A52F8,?,?,?), ref: 0031D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 0031D346

Part of subcall function 002E3A46: GetSysColorBrush.USER32(0000000F), ref: 002E3A50
Part of subcall function 002E3A46: LoadCursorW.USER32(00000000,00007F00), ref: 002E3A5F
Part of subcall function 002E3A46: LoadIconW.USER32(00000063), ref: 002E3A76
Part of subcall function 002E3A46: LoadIconW.USER32(000000A4), ref: 002E3A88
Part of subcall function 002E3A46: LoadIconW.USER32(000000A2), ref: 002E3A9A
Part of subcall function 002E3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 002E3AC0
Part of subcall function 002E3A46: RegisterClassExW.USER32(?), ref: 002E3B16

Part of subcall function 002E39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 002E3A03
Part of subcall function 002E39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 002E3A24
Part of subcall function 002E39D5: ShowWindow.USER32(00000000,?,?), ref: 002E3A38
Part of subcall function 002E39D5: ShowWindow.USER32(00000000,?,?), ref: 002E3A41

Part of subcall function 002E434A: _memset.LIBCMT ref: 002E4370
Part of subcall function 002E434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 002E4415

Strings

%7, xrefs: 002E3C44
runas, xrefs: 0031D33A
This is a third-party compiled AutoIt script., xrefs: 0031D279

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%7
API String ID: 529118366-284976634
Opcode ID: 463a4e5cc3d4ff2b6233b54831bf2c99007895abb534318a33322402d4243c45
Instruction ID: a7cace470ea8e677cfde31376df3c88aedee7c733393f42a94d803bbd6acd4c4
Opcode Fuzzy Hash: 463a4e5cc3d4ff2b6233b54831bf2c99007895abb534318a33322402d4243c45
Instruction Fuzzy Hash: 6051F931998188AECF03EBB5DC09EFD7B7CAF4A740F904466F411A3192DAB09655CF21

Function 002E49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 002E49CD

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

GetCurrentProcess.KERNEL32(?,0036FAEC,00000000,00000000,?), ref: 002E4A9A
IsWow64Process.KERNEL32(00000000), ref: 002E4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 002E4AE7
FreeLibrary.KERNEL32(00000000), ref: 002E4AF2
GetSystemInfo.KERNEL32(00000000), ref: 002E4B23
GetSystemInfo.KERNEL32(00000000), ref: 002E4B2F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: a372ac283b13d6651fe433646f89d416d7310b5affc732ae727536bc587e87fa
Instruction ID: 20da422b024ba094d153e95432d7b1c1c12db5c0731c4da59e202af08712911f
Opcode Fuzzy Hash: a372ac283b13d6651fe433646f89d416d7310b5affc732ae727536bc587e87fa
Instruction Fuzzy Hash: BD9105319DD7C1DEC732EB7994601AAFFF5AF2A310B8449ADD0CB83B41D260A548C769

Function 002E4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,002E4D8E,?,?,00000000,00000000), ref: 002E4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,002E4D8E,?,?,00000000,00000000), ref: 002E4EB0
LoadResource.KERNEL32(?,00000000,?,?,002E4D8E,?,?,00000000,00000000,?,?,?,?,?,?,002E4E2F), ref: 0031D937
SizeofResource.KERNEL32(?,00000000,?,?,002E4D8E,?,?,00000000,00000000,?,?,?,?,?,?,002E4E2F), ref: 0031D94C
LockResource.KERNEL32(002E4D8E,?,?,002E4D8E,?,?,00000000,00000000,?,?,?,?,?,?,002E4E2F,00000000), ref: 0031D95F

Strings

SCRIPT, xrefs: 002E4EA6

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 9f4f7a650782c9e921269df9e5ceff15f9d3e04ea063fbd2521184eb7e96cfc5
Instruction ID: 54f74be9e45c6e9338d868a8bf56c124ef11915a419f5ffd3ab083b47ad943c0
Opcode Fuzzy Hash: 9f4f7a650782c9e921269df9e5ceff15f9d3e04ea063fbd2521184eb7e96cfc5
Instruction Fuzzy Hash: E6115E75240741BFD7229F66EC48FA77BBEFBC5B11F148668F405C6250DBA1E9108A60

Function 002EFCE0 Relevance: 9.8, APIs: 3, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

%7, xrefs: 002EFCF3
pb:, xrefs: 003249B9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BuffCharUpper
String ID: pb:$%7
API String ID: 3964851224-1712839656
Opcode ID: b91eb14a6e43aed92b0817ff5adb7fb1ed92292915b5e57184d50301c5e4ae50
Instruction ID: 6e799808aa6082b3181f3895dcd20a54b390f6df75e6d5f5c22ad8df07d6ddfa
Opcode Fuzzy Hash: b91eb14a6e43aed92b0817ff5adb7fb1ed92292915b5e57184d50301c5e4ae50
Instruction Fuzzy Hash: 909287706183518FD721DF28C480B2AF7E4BF89344F54886DE99A8B362D7B1EC55CB92

Function 0034445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0031E398), ref: 0034446A
FindFirstFileW.KERNELBASE(?,?), ref: 0034447B
FindClose.KERNEL32(00000000), ref: 0034448B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 21c6b712abf9b497693f64f69fe7ec97bc2ca3c24699e9f3328c527b274f3401
Instruction ID: a2f43c1fc87d372f20bf1a369438b67259cfc966f3b68771662881f3e3aca5d3
Opcode Fuzzy Hash: 21c6b712abf9b497693f64f69fe7ec97bc2ca3c24699e9f3328c527b274f3401
Instruction Fuzzy Hash: EEE0D83A4145006B82116B38FC0D5E97B9C9F05335F204B26F835C12D0E7B4A9009995

Function 002F09D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002F0A5B
timeGetTime.WINMM ref: 002F0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002F0E53
Sleep.KERNEL32(0000000A), ref: 002F0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 002F0EFA
DestroyWindow.USER32 ref: 002F0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002F0F20
Sleep.KERNEL32(0000000A,?,?), ref: 00324E83
TranslateMessage.USER32(?), ref: 00325C60
DispatchMessageW.USER32(?), ref: 00325C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00325C82

Strings

@GUI_WINHANDLE, xrefs: 00324F8F
pb:, xrefs: 003257B4
@TRAY_ID, xrefs: 0032578F
pb:, xrefs: 00324F59
pb:, xrefs: 00325003
@GUI_CTRLID, xrefs: 00324F3A
@GUI_CTRLHANDLE, xrefs: 00324FE4
@COM_EVENTOBJ, xrefs: 003254F0
pb:, xrefs: 00324FAE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pb:$pb:$pb:$pb:
API String ID: 4212290369-383213436
Opcode ID: b87caf09973df1d5d85d0cebe70ff3a6635cc717c0f687229c412475df112dfe
Instruction ID: 681d82153c89cd17bd996aa79a010a8e242564d750381c869fb5d02e2ced0397
Opcode Fuzzy Hash: b87caf09973df1d5d85d0cebe70ff3a6635cc717c0f687229c412475df112dfe
Instruction Fuzzy Hash: 0FB20430618751DFD726DF24D884BAAF7E4FF85304F14492DE58A9B2A2CB70E954CB82

Function 00349155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00348F5F: __time64.LIBCMT ref: 00348F69

Part of subcall function 002E4EE5: _fseek.LIBCMT ref: 002E4EFD

__wsplitpath.LIBCMT ref: 00349234

Part of subcall function 003040FB: __wsplitpath_helper.LIBCMT ref: 0030413B

_wcscpy.LIBCMT ref: 00349247
_wcscat.LIBCMT ref: 0034925A
__wsplitpath.LIBCMT ref: 0034927F
_wcscat.LIBCMT ref: 00349295
_wcscat.LIBCMT ref: 003492A8

Part of subcall function 00348FA5: _memmove.LIBCMT ref: 00348FDE
Part of subcall function 00348FA5: _memmove.LIBCMT ref: 00348FED

_wcscmp.LIBCMT ref: 003491EF

Part of subcall function 00349734: _wcscmp.LIBCMT ref: 00349824
Part of subcall function 00349734: _wcscmp.LIBCMT ref: 00349837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00349452
_wcsncpy.LIBCMT ref: 003494C5
DeleteFileW.KERNEL32(?,?), ref: 003494FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00349511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00349522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00349534

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 6f97b452bb064299aa520579543d928cdb51e07febf975b4af3d2a5d64474f09
Instruction ID: c18cfe6efb9db5382b1384c74ab62cec07a894ac8fbe9fcc3e0dd42b865957e8
Opcode Fuzzy Hash: 6f97b452bb064299aa520579543d928cdb51e07febf975b4af3d2a5d64474f09
Instruction Fuzzy Hash: FDC13BB1D00219ABDF22DF95CC95ADFBBBDEF55310F0040AAF609EA151DB70AA448F61

Function 002E301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 002E3074
RegisterClassExW.USER32(00000030), ref: 002E309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002E30AF
InitCommonControlsEx.COMCTL32(?), ref: 002E30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002E30DC
LoadIconW.USER32(000000A9), ref: 002E30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002E3101

Strings

TaskbarCreated, xrefs: 002E30A4
0, xrefs: 002E3056
AutoIt v3 GUI, xrefs: 002E3090
+, xrefs: 002E305D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 7969189069926184d833ee23bb30575b9b2ba00913d2e5a951199665bfb7723a
Instruction ID: 808fbc9886961782a3e667f9abc531e4e35879134c8d7e80a3bf1208007227f2
Opcode Fuzzy Hash: 7969189069926184d833ee23bb30575b9b2ba00913d2e5a951199665bfb7723a
Instruction Fuzzy Hash: 74312AB1941349EFDB42CFA4EC45ADDBBF8FB0A310F14852AE590E62A0D3B94585CF91

Function 002E3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 002E3074
RegisterClassExW.USER32(00000030), ref: 002E309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002E30AF
InitCommonControlsEx.COMCTL32(?), ref: 002E30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002E30DC
LoadIconW.USER32(000000A9), ref: 002E30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002E3101

Strings

TaskbarCreated, xrefs: 002E30A4
0, xrefs: 002E3056
AutoIt v3 GUI, xrefs: 002E3090
+, xrefs: 002E305D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: cd7025f79d561670b80c12f5091cd867788f323b06b664e764f33119d65e0bd4
Instruction ID: 9c21f960619db176f788730360f0179ea88463143487186993c043de4e68aae6
Opcode Fuzzy Hash: cd7025f79d561670b80c12f5091cd867788f323b06b664e764f33119d65e0bd4
Instruction Fuzzy Hash: F521C4B1A51318AFDB02DFA4EC89BDDBBFCFB09700F00812AF910A62A0D7B545448F95

Function 002E708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002E4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,003A52F8,?,002E37AE,?), ref: 002E4724

Part of subcall function 0030050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,002E7165), ref: 0030052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 002E71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0031E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0031E909
RegCloseKey.ADVAPI32(?), ref: 0031E947
_wcscat.LIBCMT ref: 0031E9A0

Strings

\Include\, xrefs: 002E7165
Include, xrefs: 0031E8BF, 0031E900
\, xrefs: 0031E9C3
Software\AutoIt v3\AutoIt, xrefs: 002E719E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 3fa445588034b21f89b32af6156c879b0c0e820adea4da73217bb535108e6de9
Instruction ID: ba585060b859fcfdd408f70fd0937f893f1c0dd33ae4e6126b93036995494aa2
Opcode Fuzzy Hash: 3fa445588034b21f89b32af6156c879b0c0e820adea4da73217bb535108e6de9
Instruction Fuzzy Hash: E971A2715193019EC306EF66EC42AAFBBECFF89310F84492EF455871A1DB719948CB52

Function 002E3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 002E36D2
KillTimer.USER32(?,00000001), ref: 002E36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002E371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002E372A
CreatePopupMenu.USER32 ref: 002E373E
PostQuitMessage.USER32(00000000), ref: 002E374D

Strings

TaskbarCreated, xrefs: 002E3725
%7, xrefs: 0031D081, 0031D0CF

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%7
API String ID: 129472671-4035024953
Opcode ID: 30c4cb2fe58b24e1527cd923db944b4699c54aeef7f065bb3578954cb3aa44e9
Instruction ID: 6ee1e29b82883afbae57fe5dc180ffe96597b60bf1dfcc56f87331be31483886
Opcode Fuzzy Hash: 30c4cb2fe58b24e1527cd923db944b4699c54aeef7f065bb3578954cb3aa44e9
Instruction Fuzzy Hash: 244158B12B0585FBDB16EF75EC0DBB9379CEB06302F900124F502972A1CBA09E609675

Function 002E3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 002E3A50
LoadCursorW.USER32(00000000,00007F00), ref: 002E3A5F
LoadIconW.USER32(00000063), ref: 002E3A76
LoadIconW.USER32(000000A4), ref: 002E3A88
LoadIconW.USER32(000000A2), ref: 002E3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 002E3AC0
RegisterClassExW.USER32(?), ref: 002E3B16

Part of subcall function 002E3041: GetSysColorBrush.USER32(0000000F), ref: 002E3074
Part of subcall function 002E3041: RegisterClassExW.USER32(00000030), ref: 002E309E
Part of subcall function 002E3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002E30AF
Part of subcall function 002E3041: InitCommonControlsEx.COMCTL32(?), ref: 002E30CC
Part of subcall function 002E3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002E30DC
Part of subcall function 002E3041: LoadIconW.USER32(000000A9), ref: 002E30F2
Part of subcall function 002E3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002E3101

Strings

#, xrefs: 002E3AFB
0, xrefs: 002E3AF4
AutoIt v3, xrefs: 002E3B05

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 11b6c016805a444e337910f76efe04a09f9f28e0d2325977b1221d0027184a0e
Instruction ID: a76659cf8d5f44656e0cdafc595a938daf276eeabd47f10d238992310e712189
Opcode Fuzzy Hash: 11b6c016805a444e337910f76efe04a09f9f28e0d2325977b1221d0027184a0e
Instruction Fuzzy Hash: A3216971D50308AFEB12DFA5EC09B9D7BB8FB0A711F10492AF500AB2A1D3B65650DF94

Function 002E3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteLine, xrefs: 002E38A7
/AutoIt3ExecuteScript, xrefs: 002E38BC
CMDLINERAW, xrefs: 002E37FB
/ErrorStdOut, xrefs: 002E387D
R:, xrefs: 0031D213
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 002E37AE
/AutoIt3OutputDebug, xrefs: 002E3892
CMDLINE, xrefs: 002E3822

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$R:
API String ID: 1825951767-1406199358
Opcode ID: 2c28d98a46ed6738f82dbd0ede0b1cb90ca0957f9c16b0ace4877273ec0b6cbc
Instruction ID: 25a8d0ccbb969dbd6c1ccde46155be42fc401897fda3c3effc89801154ef54d2
Opcode Fuzzy Hash: 2c28d98a46ed6738f82dbd0ede0b1cb90ca0957f9c16b0ace4877273ec0b6cbc
Instruction Fuzzy Hash: D8A15E719A029DAACF06EBA1DC55AEEB778FF15300F84042AF416B7191DF745A18CFA0

Function 002EF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00300162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00300193
Part of subcall function 00300162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0030019B
Part of subcall function 00300162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 003001A6
Part of subcall function 00300162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 003001B1
Part of subcall function 00300162: MapVirtualKeyW.USER32(00000011,00000000), ref: 003001B9
Part of subcall function 00300162: MapVirtualKeyW.USER32(00000012,00000000), ref: 003001C1

Part of subcall function 002F60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,002EF930), ref: 002F6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 002EF9CD
OleInitialize.OLE32(00000000), ref: 002EFA4A
CloseHandle.KERNEL32(00000000), ref: 003245C8

Strings

%7, xrefs: 002EF796, 002EF7A8, 002EF96E, 002EFA51
\T:, xrefs: 002EF7F7
S:, xrefs: 002EF7EB
<W:, xrefs: 002EF930

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <W:$\T:$%7$S:
API String ID: 1986988660-653277061
Opcode ID: ce23c4855eab2eb629a861689da1adf61246942b68976ed21c428072667c4bc1
Instruction ID: 2a22b893085de9d5bcc2458ca13f2be1485c32e28dab5b100624cdc042429346
Opcode Fuzzy Hash: ce23c4855eab2eb629a861689da1adf61246942b68976ed21c428072667c4bc1
Instruction Fuzzy Hash: 1381DEB5915A40DFC786DF3AA9456287BEDFB9F306F90812AD019CB2B2EB750484CF10

Function 01064220 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 010642F1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01064517

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction ID: 4a6acf022c379aeb2f05098b257c6c57b03ea6333316db5ce3b816d311633492
Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction Fuzzy Hash: 7CA12A70E00219EBDB14CFA4C895BEEBBB9FF48304F208199E641BB281DB759A45CF55

Function 002E39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 002E3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 002E3A24
ShowWindow.USER32(00000000,?,?), ref: 002E3A38
ShowWindow.USER32(00000000,?,?), ref: 002E3A41

Strings

edit, xrefs: 002E3A1E
AutoIt v3, xrefs: 002E39FB, 002E3A00, 002E3A01

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8499282fde0564d628502956f85a066a6752ca553b2d90937bb2c94c9caa54f1
Instruction ID: 78d5a7b0f38889234fed32b9ec44b917e82bd3cd020a8d7e01c6bb28242463a6
Opcode Fuzzy Hash: 8499282fde0564d628502956f85a066a6752ca553b2d90937bb2c94c9caa54f1
Instruction Fuzzy Hash: 5DF0DA715416907EEA325727BC49F6B2E7DD7C7F50F00452ABA04A2171C6611851DAB0

Function 01064000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01063EF0: Sleep.KERNELBASE(000001F4), ref: 01063F01

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01064116

Strings

4WXKOCHWWL880L46ZDSL, xrefs: 01064179, 0106417C

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID: CreateFileSleep
String ID: 4WXKOCHWWL880L46ZDSL
API String ID: 2694422964-1233217941
Opcode ID: 43dacbaa3c366f9e5a536e1c7000cc7c2ef22179b1dde355a6690c694f7b92f3
Instruction ID: cec08587a5552e103d5b5ebf3717f2c8d58d3a375ea6878f76e8ffcd831db022
Opcode Fuzzy Hash: 43dacbaa3c366f9e5a536e1c7000cc7c2ef22179b1dde355a6690c694f7b92f3
Instruction Fuzzy Hash: 21519A70D04289EBEF11DBE4C814BEEBB79AF15304F004199E658BB2C0D7791B49CBA5

Function 002E407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0031D3D7

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

_memset.LIBCMT ref: 002E40FC
_wcscpy.LIBCMT ref: 002E4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002E4160

Strings

Line: , xrefs: 0031D400

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: cbf5394999981fe48429db9ae7cf9f0042be9dc46a4139ad95afdfc9a95054a3
Instruction ID: 3f8f4d1d4896dcbb64bbd8786032dd74c1fa58d858f02c99bed623949ee49652
Opcode Fuzzy Hash: cbf5394999981fe48429db9ae7cf9f0042be9dc46a4139ad95afdfc9a95054a3
Instruction Fuzzy Hash: D0312331068381AFD722EF61DC49FDB73DCAF55304F50491EF18982091DB709668CB82

Function 0030541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0030547B
_memcpy_s.LIBCMT ref: 003054ED
__read_nolock.LIBCMT ref: 0030554B
__filbuf.LIBCMT ref: 0030556E
_memset.LIBCMT ref: 003055B2

Part of subcall function 00308B28: __getptd_noexit.LIBCMT ref: 00308B28

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 9123a0b228224b772982086bb25b1407879f7ac4a1d9c408408ff66af6a6986a
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: C551E630A02B05DBCF268F69DCA06AF77A6AF41321F258729F836966D1D7709D908F40

Function 002E686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 002E4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,003A52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 002E4E0F

_free.LIBCMT ref: 0031E263
_free.LIBCMT ref: 0031E2AA

Part of subcall function 002E6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 002E6BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0031E039
Bad directive syntax error, xrefs: 0031E292

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: cbd453f522a0c37e3b82b7977c6e1d3054e23ed391ceb7da02950b4514cced2a
Instruction ID: a499e82ed13e06a2e21b7dd35fb8262dc4dfdcb90cc1f6eb2ca7e438a1dadf46
Opcode Fuzzy Hash: cbd453f522a0c37e3b82b7977c6e1d3054e23ed391ceb7da02950b4514cced2a
Instruction Fuzzy Hash: 0091BC31910269AFCF0AEFA5CC919EDB7B8FF09310F50442AF815AB2A1DB71A955CF50

Function 002E35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,002E35A1,SwapMouseButtons,00000004,?), ref: 002E35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,002E35A1,SwapMouseButtons,00000004,?,?,?,?,002E2754), ref: 002E35F5
RegCloseKey.KERNELBASE(00000000,?,?,002E35A1,SwapMouseButtons,00000004,?,?,?,?,002E2754), ref: 002E3617

Strings

Control Panel\Mouse, xrefs: 002E35D2

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: f3d03c668c6a57b262869c273298baa5a1cbefb5d64ec53b8a35d99f1de18958
Instruction ID: f1ac015d77a0d626fa387fecab29e77df58b107e44cc7b1285e22ad58187d304
Opcode Fuzzy Hash: f3d03c668c6a57b262869c273298baa5a1cbefb5d64ec53b8a35d99f1de18958
Instruction Fuzzy Hash: 5D115A71960248BFDB21CFA5EC48EAEBBBCEF05741F418469F809D7210D2719F609764

Function 01062EF0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0106371D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01063741
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01063763

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: af4d922b19fad84f12b0f28b1f7631580de8d8f7c11ce035627980cb2cea5462
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: 5A62F930A142589BEB24CFA4C850BDEB776FF58300F1091A9D24DEB394E7799E81CB59

Function 0034955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 002E4EE5: _fseek.LIBCMT ref: 002E4EFD

Part of subcall function 00349734: _wcscmp.LIBCMT ref: 00349824
Part of subcall function 00349734: _wcscmp.LIBCMT ref: 00349837

_free.LIBCMT ref: 003496A2
_free.LIBCMT ref: 003496A9
_free.LIBCMT ref: 00349714

Part of subcall function 00302D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00309A24), ref: 00302D69
Part of subcall function 00302D55: GetLastError.KERNEL32(00000000,?,00309A24), ref: 00302D7B

_free.LIBCMT ref: 0034971C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: 69140558f776939a09b6b83b5e8f7118f17816ee5f5550f6b4b84dfa35d162aa
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: 41516FB1D14258AFDF259F65DC85A9EBBB9EF48300F10049EF209A7241DB716E90CF58

Function 0030470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003047A0
__flush.LIBCMT ref: 003047C0
__write.LIBCMT ref: 003047F3
__flsbuf.LIBCMT ref: 00304821

Part of subcall function 00308B28: __getptd_noexit.LIBCMT ref: 00308B28

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 8fb515bb3d4177737446936c69c1c2d3529f130e4ad92846746a9609a7145261
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 1341F8F4A027459BDB1ACF69C8A096E77A5EF81760B10C53DEA25C76C0E771DF408B40

Function 002E4C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002E4CBA

Strings

AU3!P/7, xrefs: 002E4CB4
EA06, xrefs: 0031D8CC

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/7$EA06
API String ID: 4104443479-1127680957
Opcode ID: cf4c098df99bf1586c3c09cf64fef372c32dd9dddb14045578cfcf242f3f512f
Instruction ID: d546c8b2f125b6928961d8b805fe2d78ea84178bb3cebc1c1598031e975d429d
Opcode Fuzzy Hash: cf4c098df99bf1586c3c09cf64fef372c32dd9dddb14045578cfcf242f3f512f
Instruction Fuzzy Hash: AF41AF21AA01D857CF22BF56CC617FE7FA1DB46300FE84075EC869B282D6609D64C7A1

Function 002E7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0031EA39
GetOpenFileNameW.COMDLG32(?), ref: 0031EA83

Part of subcall function 002E4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002E4743,?,?,002E37AE,?), ref: 002E4770

Part of subcall function 00300791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003007B0

Strings

X, xrefs: 0031EA51

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 1bb846c8089873c0af79d39548b391374ae5fc2ef75b031777c76e3c4c8b11a4
Instruction ID: ccdd4e2c32998d32dbca72609f8bcdc759bfb48487ae581c9c1eb8e1b4163910
Opcode Fuzzy Hash: 1bb846c8089873c0af79d39548b391374ae5fc2ef75b031777c76e3c4c8b11a4
Instruction Fuzzy Hash: B521D530A102889BCF02DF94C845BEE7BFCAF49714F00401AE948AB241DBF55999CFA1

Function 00348D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00348DAC
__fread_nolock.LIBCMT ref: 00348DC1

Strings

EA06, xrefs: 00348DF3

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 59c7e9186c6111a8483d275fe1371abc7e7ee9b4007ca04de12837c87cbe6114
Instruction ID: 8a7a2f54e8d16ef1d32eaa6b7f5abda0ce1ec58fc0047b100c1ba835fc8a070e
Opcode Fuzzy Hash: 59c7e9186c6111a8483d275fe1371abc7e7ee9b4007ca04de12837c87cbe6114
Instruction Fuzzy Hash: DF01F971C042187EDB19CBA8CC16EEEBBFCDB11301F00419AF552D61C1E975A6048B60

Function 003498E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 003498F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0034990F

Strings

aut, xrefs: 00349909

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: ad6a87871e26e5fbb2cebe556227ab794e158dd7e8e12cda4c7a3f1ef5d25fb4
Instruction ID: b8bedd4c563b631d6ff59874f287f9b3216378bd26ac27a2eb74f872da4f36bc
Opcode Fuzzy Hash: ad6a87871e26e5fbb2cebe556227ab794e158dd7e8e12cda4c7a3f1ef5d25fb4
Instruction Fuzzy Hash: 0CD05E7954030DAFDB519BA4EC0EFEA773CE704704F0046B1FA54910A1EAB095988FA1

Function 0035CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beda038de75942fa816f2b78b80cdfb8c56bb8cc9ce505af4259c9801a476b7b
Instruction ID: 01e8c3f244d6c8f19405c05b4acac70f87f80eb513401f102ebc1e5e165a79ec
Opcode Fuzzy Hash: beda038de75942fa816f2b78b80cdfb8c56bb8cc9ce505af4259c9801a476b7b
Instruction Fuzzy Hash: D2F14A716083409FCB15DF29C480A6ABBE5FF88318F55892EF8999B361D730E945CF82

Function 002E434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002E4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 002E4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 002E4432

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: a9a1f8d8ba2bbcd0e731a344a8fc95079bd24a665f0a2b50f7d2d16aade6339d
Instruction ID: 955f90c2ecaa479390a5665e95cb9891f7a0265b53d3a0eb5905d1d26d4b1dc7
Opcode Fuzzy Hash: a9a1f8d8ba2bbcd0e731a344a8fc95079bd24a665f0a2b50f7d2d16aade6339d
Instruction Fuzzy Hash: 263191B05147419FC722EF25D88479BBBF8FB49308F400D2EF69A86291E7B1A954CB52

Function 0030571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00305733

Part of subcall function 0030A16B: __NMSG_WRITE.LIBCMT ref: 0030A192
Part of subcall function 0030A16B: __NMSG_WRITE.LIBCMT ref: 0030A19C

__NMSG_WRITE.LIBCMT ref: 0030573A

Part of subcall function 0030A1C8: GetModuleFileNameW.KERNEL32(00000000,003A33BA,00000104,?,00000001,00000000), ref: 0030A25A
Part of subcall function 0030A1C8: ___crtMessageBoxW.LIBCMT ref: 0030A308

Part of subcall function 0030309F: ___crtCorExitProcess.LIBCMT ref: 003030A5
Part of subcall function 0030309F: ExitProcess.KERNEL32 ref: 003030AE

Part of subcall function 00308B28: __getptd_noexit.LIBCMT ref: 00308B28

RtlAllocateHeap.NTDLL(00FC0000,00000000,00000001,00000000,?,?,?,00300DD3,?), ref: 0030575F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 715ff2675c27dce31152c009275980b30d97f8137bb749ce853b185c8c1b2a32
Instruction ID: ab5a7e75cbb9eb25b910b87124f95de0454e546a3a010c67d1924dd658e700f0
Opcode Fuzzy Hash: 715ff2675c27dce31152c009275980b30d97f8137bb749ce853b185c8c1b2a32
Instruction Fuzzy Hash: 17019E35243B02DAD6172B38ECB2B6B738C9B82B61F11053AF4059E1C1DFB09C006A61

Function 003498A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00349548,?,?,?,?,?,00000004), ref: 003498BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00349548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 003498D1
CloseHandle.KERNEL32(00000000,?,00349548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 003498D8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 0307eed8036f8b34e76bd3bea43facb02c9d7176935f35e84203d50b5f75da0e
Instruction ID: f4cbf34c2908b379f90e161b367b8ced4b969022a8d05674a13c2c4cd6e1b640
Opcode Fuzzy Hash: 0307eed8036f8b34e76bd3bea43facb02c9d7176935f35e84203d50b5f75da0e
Instruction Fuzzy Hash: 43E08632141214BBD7231B54FC09FDA7B5DAB067A0F108220FB14690E087F125119798

Function 00348D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00348D1B

Part of subcall function 00302D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00309A24), ref: 00302D69
Part of subcall function 00302D55: GetLastError.KERNEL32(00000000,?,00309A24), ref: 00302D7B

_free.LIBCMT ref: 00348D2C
_free.LIBCMT ref: 00348D3E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 5785850df7415c404ae2c7197d4b80dee8fe5b4873e733bbbbd02d6898e8b723
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: EEE012A1A036114ACB26A6B8B944A9753DC4F5D752755091DB41DDF1C6CE64FC428224

Function 002EA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0031FC01

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 010e170caf0b71710dc8441da756a411220947d4c0bbcc54fb77522baad0071d
Instruction ID: 51ffb06f935e46eef5d5bf1d461daa630879f20149eb04f0e0df25b1d287da6d
Opcode Fuzzy Hash: 010e170caf0b71710dc8441da756a411220947d4c0bbcc54fb77522baad0071d
Instruction Fuzzy Hash: A3228B70568381CFCB29DF15C490B6AB7E1BF49304F55896DE88A8B362D771EC94CB82

Function 002E7A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002E7AAB
_memmove.LIBCMT ref: 002E7B16

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 40fbce4a1fea4cfe3bf1a015a5a2827c9472d34ae18aa590b79f6fb0e3b65f37
Instruction ID: bff567c32967c3cceb77f6fc7890e65bdb8aded086d9a341bc2d637bcee1c243
Opcode Fuzzy Hash: 40fbce4a1fea4cfe3bf1a015a5a2827c9472d34ae18aa590b79f6fb0e3b65f37
Instruction Fuzzy Hash: E131D4B1614606AFC704DF69C8D1E69F3A9FF48320B55862DE919CB391EB70E960CB90

Function 002E47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 002E4834

Part of subcall function 0030336C: __lock.LIBCMT ref: 00303372
Part of subcall function 0030336C: DecodePointer.KERNEL32(00000001,?,002E4849,00337C74), ref: 0030337E
Part of subcall function 0030336C: EncodePointer.KERNEL32(?,?,002E4849,00337C74), ref: 00303389

Part of subcall function 002E48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 002E4915
Part of subcall function 002E48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 002E492A

Part of subcall function 002E3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 002E3B68
Part of subcall function 002E3B3A: IsDebuggerPresent.KERNEL32 ref: 002E3B7A
Part of subcall function 002E3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,003A52F8,003A52E0,?,?), ref: 002E3BEB
Part of subcall function 002E3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 002E3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 002E4874

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 2d0302ec47ff6a5dcfbb373d51779d5163b67258b93c0c15564b5e6eb62eecbc
Instruction ID: 6eb12c6621ee858dd3ae422de8fcf94c6accafc3180cf60c58bd6568ee54f356
Opcode Fuzzy Hash: 2d0302ec47ff6a5dcfbb373d51779d5163b67258b93c0c15564b5e6eb62eecbc
Instruction Fuzzy Hash: EA119D719183819FC701EF2AEC4594ABBECEF8A750F50891EF085872B1DBB09554CB92

Function 00300DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0030571C: __FF_MSGBANNER.LIBCMT ref: 00305733
Part of subcall function 0030571C: __NMSG_WRITE.LIBCMT ref: 0030573A
Part of subcall function 0030571C: RtlAllocateHeap.NTDLL(00FC0000,00000000,00000001,00000000,?,?,?,00300DD3,?), ref: 0030575F

std::exception::exception.LIBCMT ref: 00300DEC
__CxxThrowException@8.LIBCMT ref: 00300E01

Part of subcall function 0030859B: RaiseException.KERNEL32(?,?,?,00399E78,00000000,?,?,?,?,00300E06,?,00399E78,?,00000001), ref: 003085F0

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: f5dc73a6294fa3eae0f5dd5c3f1cc40ec680ea5dffb2aefbf044557a3285056a
Instruction ID: a48db0eb0d45616fea4b9db6fe60b7108cd5e156b8a4a29b6491d97ae9f2ea45
Opcode Fuzzy Hash: f5dc73a6294fa3eae0f5dd5c3f1cc40ec680ea5dffb2aefbf044557a3285056a
Instruction Fuzzy Hash: F5F0283540231EA6CB27BB99EC21ADF77ACDF01310F10442AFC58AA2C1DF709A40C2E1

Function 003055FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0030562C
__lock_file.LIBCMT ref: 0030564D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 6a5d2400d3d1044d1ebbbccb1f02e3e71a87849ce1ea19975128a419b59ec16c
Instruction ID: ea954f5a254598b4e9f95e80b1106107b176de1956e6eee7a038c8f1fb07b004
Opcode Fuzzy Hash: 6a5d2400d3d1044d1ebbbccb1f02e3e71a87849ce1ea19975128a419b59ec16c
Instruction Fuzzy Hash: 3101F271803A0CEBCF13AF69CC1299F7B61AF91322F454215F8241E1D1DB328A21DF91

Function 003053A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00308B28: __getptd_noexit.LIBCMT ref: 00308B28

__lock_file.LIBCMT ref: 003053EB

Part of subcall function 00306C11: __lock.LIBCMT ref: 00306C34

__fclose_nolock.LIBCMT ref: 003053F6

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: be670b515d6c73c5f4e9c781c152c25d766cb265a0d7b871bdd96eb3528911ea
Instruction ID: 29933b2de4a21d8dd74c7149406ecf3cf97d91061d2b19b34f52a6576f5d8964
Opcode Fuzzy Hash: be670b515d6c73c5f4e9c781c152c25d766cb265a0d7b871bdd96eb3528911ea
Instruction Fuzzy Hash: D5F09631803A049ADB13BB6998127AF76A06F41374F258244E464AF1C1CBBC89415F65

Function 01062EED Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0106371D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01063741
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01063763

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: 3c828099d5445806fe2ce7bd58ed10a1e0b3deaeaed3d97ca729a91fccff6c8e
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: BE12CC24E24658C6EB24DF64D8507DEB272FF68300F1090E9910DEB7A5E77A4E81CB5A

Function 00300C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00300CB7

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 3e72268ed63c62295dab78dbdca05645a559bf731261e0c5b4262bb0a9663557
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: FA31E370A011059BE71ADF48C4A4A69F7A6FB49300F2986A5E80ACF791D731EDC1DB80

Function 0031FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0031FCB7

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: be0be9bfd83a77cae9890a61eb2dc0419a95016181c1e0a98fecba6459c98812
Instruction ID: e3f98ad93dc45027588a989c2001a8cabb2f4a0b4c7a20e19658a29cd06be4c6
Opcode Fuzzy Hash: be0be9bfd83a77cae9890a61eb2dc0419a95016181c1e0a98fecba6459c98812
Instruction Fuzzy Hash: 9C414774514341CFDB25CF25C444B2ABBE0BF49318F5988ACE8998B762C771E895CF42

Function 002E7B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002E7BB3

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 5c570c16219e0ae90e520841937d500482c4c5f8ea4e506b96bd58a91d9502e1
Instruction ID: 944ac1e219838427199a3ad0de288a3f92c6572dafa1b2eb9a23ba6b325e90f8
Opcode Fuzzy Hash: 5c570c16219e0ae90e520841937d500482c4c5f8ea4e506b96bd58a91d9502e1
Instruction Fuzzy Hash: 72216D72A14A09EBDB1A4F16EC417AE7BB8FF18350F20842EE845C9090EB32C0E0D781

Function 002E4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 002E4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 002E4BEF

Part of subcall function 0030525B: __wfsopen.LIBCMT ref: 00305266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,003A52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 002E4E0F

Part of subcall function 002E4B6A: FreeLibrary.KERNEL32(00000000), ref: 002E4BA4

Part of subcall function 002E4C70: _memmove.LIBCMT ref: 002E4CBA

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 8e4d7fe032e09cefb3a3d60d57fa908e53c1a01e5cbdb89bb8ddd9da06ff700c
Instruction ID: 62cf6973e7a7d59b4e5bda716871e744738d6dafb4220001e62d131098fcb582
Opcode Fuzzy Hash: 8e4d7fe032e09cefb3a3d60d57fa908e53c1a01e5cbdb89bb8ddd9da06ff700c
Instruction Fuzzy Hash: 5F113A316A0205ABCF15FF71CC16FAE77A8AF48700F90882DF541AB181DBB09E209F50

Function 0031FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0031FD91

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2daea1beb9466e68570fd6aa5110aeca3c046db09fdba245e7bc2459bc6cdd4b
Instruction ID: 8140ef3a03942fbe8717639f0deefbe32245a1871f3c74bf543fec17ed21134c
Opcode Fuzzy Hash: 2daea1beb9466e68570fd6aa5110aeca3c046db09fdba245e7bc2459bc6cdd4b
Instruction Fuzzy Hash: 352135B4558341DFCB15DF24C444B1ABBE0BF88304F058868F88A5B762D731F814CB92

Function 002E7DE1 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002E7E22

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 4554ee81d3dd3747b9af97faaf17e526e5f919d31d86d93cd4b72008e65ce0e0
Instruction ID: 129f4f9b388442d54417f0acc9260676b0954dd949351f0ea769778d46300214
Opcode Fuzzy Hash: 4554ee81d3dd3747b9af97faaf17e526e5f919d31d86d93cd4b72008e65ce0e0
Instruction Fuzzy Hash: 7A014972250701AEC3259F79CC06FA7BBA4DB04360F14853EFA1ACE1D0EA71E85087A0

Function 0030072A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003007B0

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 82bdaa466706581dd819e16efb433da7eec6e91abc1c50eb7760a1e060995e26
Instruction ID: e886c24b3d53400a45f206d56f07110d6af300a8fff5d6660aa79cfd87945e7b
Opcode Fuzzy Hash: 82bdaa466706581dd819e16efb433da7eec6e91abc1c50eb7760a1e060995e26
Instruction Fuzzy Hash: 0B01F476051244AFC312CF34E881EE67BB8EF86320B0444EAEC44CBC62C6309D48DB91

Function 00304863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 003048A6

Part of subcall function 00308B28: __getptd_noexit.LIBCMT ref: 00308B28

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: b9cec0bb5c1b5f3a82440ca8776ecb601e4e1e1a966920d4503467a6c4f62f86
Instruction ID: 0173b102de8e1f1befefa9e39cd52883906af133eb5ba0aef99ce9ee0da0909c
Opcode Fuzzy Hash: b9cec0bb5c1b5f3a82440ca8776ecb601e4e1e1a966920d4503467a6c4f62f86
Instruction Fuzzy Hash: 89F0A471902605EBDF13AF648C1679E36A0AF01325F158914F5249E1D1CB79CA51DB51

Function 002E4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,003A52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 002E4E7E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: fbc6234f54d2308ac892d9da83a3a37641b4b2479b4da7057bb5c4d53abfcea0
Instruction ID: 210c6f6e30405ee2946b1521d2feeabccf1d9cc8a5b7a26a064249b7623b3fc7
Opcode Fuzzy Hash: fbc6234f54d2308ac892d9da83a3a37641b4b2479b4da7057bb5c4d53abfcea0
Instruction Fuzzy Hash: 98F0A970161742CFCB34AF26E494822BBE0BF003293688A7EE2D782620C3729850DF00

Function 00300791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003007B0

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: c7010af6fb926282153ef37fc57eeb8c03af0a9f13535076b7653bef43352c82
Instruction ID: 7d62ecbc77ccb61885f412817cfa9b99d8972735fb63ba958b64ede38edf64d8
Opcode Fuzzy Hash: c7010af6fb926282153ef37fc57eeb8c03af0a9f13535076b7653bef43352c82
Instruction Fuzzy Hash: 68E0CD369441285BC721D6599C05FEA77DDDF8C7A0F0441B5FD0CD7204D9609C908AD0

Function 00348E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00348EC1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 350e43b8e1f33b736e25b64994b5e97335e8db7c625d60f8a25d83de484590c6
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 87E092B0104B005BD7398B24D810BA373E1AB06304F00081DF2AA87241EB6278818B59

Function 0030525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00305266

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: d3cfa01bd1b499da3d89854987e3e70abc8269082db0b26b14c3fbb8f7453500
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 5AB0927644020C77CE022A82EC02A4A3B2D9B41764F408020FB0C1C1A2A673A6649A89

Function 01063EEC Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01063F01

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: a4a129d05c83c11247a430e429a61a74ef0eb1c6a4a95b8059d2fec0d0f2be30
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 05E0BF7494410DEFDB00EFA4D5496DE7BB4FF04301F1005A1FD05D7681DB309E548A62

Function 01063EF0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01063F01

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: b9777c023fb5b9e690d59d601d4598173c2de2c340d5c89e750679c517843287
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: C3E0BF7494410DDFDB00EFA4D54969E7BB4EF04301F100161FD0592281D63099508A62

Non-executed Functions

Function 0036CABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0036CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0036CB95
GetWindowLongW.USER32(?,000000F0), ref: 0036CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0036CC00
SendMessageW.USER32 ref: 0036CC29
_wcsncpy.LIBCMT ref: 0036CC95
GetKeyState.USER32(00000011), ref: 0036CCB6
GetKeyState.USER32(00000009), ref: 0036CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0036CCD9
GetKeyState.USER32(00000010), ref: 0036CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0036CD0C
SendMessageW.USER32 ref: 0036CD33
SendMessageW.USER32(?,00001030,?,0036B348), ref: 0036CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0036CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0036CE60
SetCapture.USER32(?), ref: 0036CE69
ClientToScreen.USER32(?,?), ref: 0036CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0036CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0036CEF5
ReleaseCapture.USER32 ref: 0036CF00
GetCursorPos.USER32(?), ref: 0036CF3A
ScreenToClient.USER32(?,?), ref: 0036CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0036CFA3
SendMessageW.USER32 ref: 0036CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0036D00E
SendMessageW.USER32 ref: 0036D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0036D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0036D06D
GetCursorPos.USER32(?), ref: 0036D08D
ScreenToClient.USER32(?,?), ref: 0036D09A
GetParent.USER32(?), ref: 0036D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0036D123
SendMessageW.USER32 ref: 0036D154
ClientToScreen.USER32(?,?), ref: 0036D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0036D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0036D20C
SendMessageW.USER32 ref: 0036D22F
ClientToScreen.USER32(?,?), ref: 0036D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0036D2B5

Part of subcall function 002E25DB: GetWindowLongW.USER32(?,000000EB), ref: 002E25EC

GetWindowLongW.USER32(?,000000F0), ref: 0036D351

Strings

@GUI_DRAGID, xrefs: 0036CE9C
pb:, xrefs: 0036CEAF
F, xrefs: 0036D235

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pb:
API String ID: 3977979337-3295093371
Opcode ID: 488b2312bb6a22ed293a3f36ad4f87413844b20f5020a4fc38a1a2a02155ecdd
Instruction ID: 261a07dfe3b3000d31e43fe7257da14da5557fed1402a58bd4b0a399748f7653
Opcode Fuzzy Hash: 488b2312bb6a22ed293a3f36ad4f87413844b20f5020a4fc38a1a2a02155ecdd
Instruction Fuzzy Hash: D142DD34614280AFD726CF24D844EBABBE9FF49310F158919F6A6C72B4C771D850DB92

Function 002F6F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002F71C3
_memset.LIBCMT ref: 002F7539
_memmove.LIBCMT ref: 002F76AC

Strings

Q\E, xrefs: 002F7FCB
DEFINE, xrefs: 00332103
]9, xrefs: 00331A22
\b(?<=\w), xrefs: 00333773
[:>:]], xrefs: 002F7492
_/, xrefs: 003323CB
3c/, xrefs: 003323A0
\b(?=\w), xrefs: 00333769
[:<:]], xrefs: 002F7479
P\9, xrefs: 00331AB8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]9$3c/$DEFINE$P\9$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_/
API String ID: 1357608183-3884508948
Opcode ID: 9839cecd19b3936e2eede6082c619e756fee0f432d48da6963cb6e438175e06c
Instruction ID: f32ee171e3a2df9e8f22941f89a295bc4e1967162f8ae6cfef829646e9a03760
Opcode Fuzzy Hash: 9839cecd19b3936e2eede6082c619e756fee0f432d48da6963cb6e438175e06c
Instruction Fuzzy Hash: A293AE75E1421ADBDB25CF98C881BBDB7B1FF48350F25816AE945EB281E7709E81CB40

Function 002E48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 002E48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0031D665
IsIconic.USER32(?), ref: 0031D66E
ShowWindow.USER32(?,00000009), ref: 0031D67B
SetForegroundWindow.USER32(?), ref: 0031D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0031D69B
GetCurrentThreadId.KERNEL32 ref: 0031D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 0031D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0031D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 0031D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 0031D6CF
SetForegroundWindow.USER32(?), ref: 0031D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0031D6E7
keybd_event.USER32(00000012,00000000), ref: 0031D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0031D6FC
keybd_event.USER32(00000012,00000000), ref: 0031D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 0031D70A
keybd_event.USER32(00000012,00000000), ref: 0031D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 0031D719
keybd_event.USER32(00000012,00000000), ref: 0031D71E
SetForegroundWindow.USER32(?), ref: 0031D721
AttachThreadInput.USER32(?,?,00000000), ref: 0031D748

Strings

Shell_TrayWnd, xrefs: 0031D660

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 1bbae3a930958791888d0f686c3a7a66a24534e1e3be6047a6c88df9ada837e8
Instruction ID: d88da08fc6d1b6a5aea403e89f8a3086c04b5324805d4ca833e696b1cbea6227
Opcode Fuzzy Hash: 1bbae3a930958791888d0f686c3a7a66a24534e1e3be6047a6c88df9ada837e8
Instruction Fuzzy Hash: EB318571A40318BFEB226F619C49FBF7F6CEB49B50F118025FA05EA1D1C6F05D50AAA1

Function 00338310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 003387E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0033882B
Part of subcall function 003387E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00338858
Part of subcall function 003387E1: GetLastError.KERNEL32 ref: 00338865

_memset.LIBCMT ref: 00338353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 003383A5
CloseHandle.KERNEL32(?), ref: 003383B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 003383CD
GetProcessWindowStation.USER32 ref: 003383E6
SetProcessWindowStation.USER32(00000000), ref: 003383F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0033840A

Part of subcall function 003381CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00338309), ref: 003381E0
Part of subcall function 003381CB: CloseHandle.KERNEL32(?,?,00338309), ref: 003381F2

Strings

, xrefs: 00338362
default, xrefs: 00338405
winsta0, xrefs: 003383C8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: c9f86b4308ebae871616cee2c4b638471f13ad5e92661f2193430307fc34c578
Instruction ID: 375b172b58066060ca0718581c60cc44fcdb2fabc359348064f97143d53b0916
Opcode Fuzzy Hash: c9f86b4308ebae871616cee2c4b638471f13ad5e92661f2193430307fc34c578
Instruction Fuzzy Hash: 16817B71900309AFEF12DFA5DC85AEEBBB9FF05304F148169F910A62A1DB718E54DB20

Function 0034C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0034C78D
FindClose.KERNEL32(00000000), ref: 0034C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0034C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0034C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 0034C844
__swprintf.LIBCMT ref: 0034C890
__swprintf.LIBCMT ref: 0034C8D3

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

__swprintf.LIBCMT ref: 0034C927

Part of subcall function 00303698: __woutput_l.LIBCMT ref: 003036F1

__swprintf.LIBCMT ref: 0034C975

Part of subcall function 00303698: __flsbuf.LIBCMT ref: 00303713
Part of subcall function 00303698: __flsbuf.LIBCMT ref: 0030372B

__swprintf.LIBCMT ref: 0034C9C4
__swprintf.LIBCMT ref: 0034CA13
__swprintf.LIBCMT ref: 0034CA62

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0034C88A
%02d, xrefs: 0034C91B, 0034C925, 0034C973, 0034C9C2, 0034CA11, 0034CA60
%4d, xrefs: 0034C8CD

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 1196a5d4d01eb353eb284f58a8ffbcb03107ca612c0cadea32f9abad6a3a0c97
Instruction ID: 4b98eeb5735258e3afe4821b8f0246fd66ad22cc9514c9e9df7761d55f0a0d1a
Opcode Fuzzy Hash: 1196a5d4d01eb353eb284f58a8ffbcb03107ca612c0cadea32f9abad6a3a0c97
Instruction Fuzzy Hash: 6CA15EB1419344ABC711EFA5C885DAFB7ECFF85704F80092AF58587191EB31EA58CB62

Function 0034EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0034EFB6
_wcscmp.LIBCMT ref: 0034EFCB
_wcscmp.LIBCMT ref: 0034EFE2
GetFileAttributesW.KERNEL32(?), ref: 0034EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 0034F00E
FindNextFileW.KERNEL32(00000000,?), ref: 0034F026
FindClose.KERNEL32(00000000), ref: 0034F031
FindFirstFileW.KERNEL32(*.*,?), ref: 0034F04D
_wcscmp.LIBCMT ref: 0034F074
_wcscmp.LIBCMT ref: 0034F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 0034F09D
SetCurrentDirectoryW.KERNEL32(00398920), ref: 0034F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 0034F0C5
FindClose.KERNEL32(00000000), ref: 0034F0D2
FindClose.KERNEL32(00000000), ref: 0034F0E4

Strings

*.*, xrefs: 0034F048

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 6e40356f2e444e08af23bd94b7a83c8d2499f4689263dab7c3e5be3168c11b22
Instruction ID: 9b033a099262db43caa39e6ea10addf79895bb5bf773bc24060312306f2ecc84
Opcode Fuzzy Hash: 6e40356f2e444e08af23bd94b7a83c8d2499f4689263dab7c3e5be3168c11b22
Instruction Fuzzy Hash: 3131E2365012086FCB16EBA4EC58AEE77ECAF89364F144176E804E70A1DB70EA44CE61

Function 00360857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00360953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0036F910,00000000,?,00000000,?,?), ref: 003609C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00360A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00360A92
RegCloseKey.ADVAPI32(?), ref: 00360DB2
RegCloseKey.ADVAPI32(00000000), ref: 00360DBF

Strings

REG_DWORD, xrefs: 00360C83
REG_SZ, xrefs: 00360AD0
REG_QWORD, xrefs: 00360D00
REG_EXPAND_SZ, xrefs: 00360A2F
REG_BINARY, xrefs: 00360D4D
REG_MULTI_SZ, xrefs: 00360B7A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 14116bc65565d4479d44c5349a29973d1e5670c094969286e62875ac797dcd05
Instruction ID: eee8868fc9538169500ce4cef2850028d46fe389e574b1f190d9a30d8562d6e4
Opcode Fuzzy Hash: 14116bc65565d4479d44c5349a29973d1e5670c094969286e62875ac797dcd05
Instruction Fuzzy Hash: 280258756106419FCB15EF29C891E2AB7E9FF89314F05855DF88A9B3A2CB30EC51CB81

Function 002F66E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON

Download Yara Rule

Strings

UTF16), xrefs: 003310CF
CR), xrefs: 00331287
ANYCRLF), xrefs: 003312FB
BSR_UNICODE), xrefs: 00331338
_/, xrefs: 00331465, 0033150C, 003315B4
3c/, xrefs: 002F68FF
BSR_ANYCRLF), xrefs: 0033131E
ANY), xrefs: 003312DE
0E8, xrefs: 002F673D
0D8, xrefs: 002F6733
LF), xrefs: 003312A4
pG8, xrefs: 002F6751
NO_START_OPT), xrefs: 0033114F
CRLF), xrefs: 003312C1
LIMIT_RECURSION=, xrefs: 003311FC
UTF), xrefs: 003310FA
UCP), xrefs: 0033110D
0F8, xrefs: 002F6747
LIMIT_MATCH=, xrefs: 00331170
NO_AUTO_POSSESS), xrefs: 0033112E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID: 0D8$0E8$0F8$3c/$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pG8$_/
API String ID: 0-3321068045
Opcode ID: 5c247287e2931d714b2fc9d38746e108c0ade3251f61cf7ce876c8bb7d722c7b
Instruction ID: cdac1c5d995eca9a7ebb450fc82a3b2ea2b5128ea8987079b9002555b4fdaa4e
Opcode Fuzzy Hash: 5c247287e2931d714b2fc9d38746e108c0ade3251f61cf7ce876c8bb7d722c7b
Instruction Fuzzy Hash: 46728C75E10219DBDB25CF59C8847BEB7B5FF48350F14816AE949EB280EB709E81CB90

Function 0034F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0034F113
_wcscmp.LIBCMT ref: 0034F128
_wcscmp.LIBCMT ref: 0034F13F

Part of subcall function 00344385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 003443A0

FindNextFileW.KERNEL32(00000000,?), ref: 0034F16E
FindClose.KERNEL32(00000000), ref: 0034F179
FindFirstFileW.KERNEL32(*.*,?), ref: 0034F195
_wcscmp.LIBCMT ref: 0034F1BC
_wcscmp.LIBCMT ref: 0034F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 0034F1E5
SetCurrentDirectoryW.KERNEL32(00398920), ref: 0034F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 0034F20D
FindClose.KERNEL32(00000000), ref: 0034F21A
FindClose.KERNEL32(00000000), ref: 0034F22C

Strings

*.*, xrefs: 0034F190

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 089a83f4488c1d929c718890227ae84c57b9d681cb45c1427807e607fe133674
Instruction ID: 488b9e42ce12d36931e5c541465c4acd627ae2bc905179d930c1665f2eee578b
Opcode Fuzzy Hash: 089a83f4488c1d929c718890227ae84c57b9d681cb45c1427807e607fe133674
Instruction Fuzzy Hash: F931053A5012196FDF12AFA0EC58AEE77EC9F46324F194571E800EA0A0DBB0EE45CA54

Function 0034A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0034A20F
__swprintf.LIBCMT ref: 0034A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 0034A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0034A293
_memset.LIBCMT ref: 0034A2B2
_wcsncpy.LIBCMT ref: 0034A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0034A323
CloseHandle.KERNEL32(00000000), ref: 0034A32E
RemoveDirectoryW.KERNEL32(?), ref: 0034A337
CloseHandle.KERNEL32(00000000), ref: 0034A341

Strings

\??\%s, xrefs: 0034A22B
\, xrefs: 0034A247
:, xrefs: 0034A252

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: e33e9bece5d4794ecdc77de20f81e8d06eb9f4d4a0ed4aab32e2551beb2a7933
Instruction ID: 51e2f603a0d062d24474b51473e754582569b114eafae6645d6f0be38fe5e551
Opcode Fuzzy Hash: e33e9bece5d4794ecdc77de20f81e8d06eb9f4d4a0ed4aab32e2551beb2a7933
Instruction Fuzzy Hash: 2831C6B5544109ABDB22DFA0DC49FEB77BCEF89740F1041B6F508D6160E7B0A6448B65

Function 0034001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00340097
SetKeyboardState.USER32(?), ref: 00340102
GetAsyncKeyState.USER32(000000A0), ref: 00340122
GetKeyState.USER32(000000A0), ref: 00340139
GetAsyncKeyState.USER32(000000A1), ref: 00340168
GetKeyState.USER32(000000A1), ref: 00340179
GetAsyncKeyState.USER32(00000011), ref: 003401A5
GetKeyState.USER32(00000011), ref: 003401B3
GetAsyncKeyState.USER32(00000012), ref: 003401DC
GetKeyState.USER32(00000012), ref: 003401EA
GetAsyncKeyState.USER32(0000005B), ref: 00340213
GetKeyState.USER32(0000005B), ref: 00340221

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ea49e6f531e9ce0f4063e43af1ab30b813a60e292c1c0e572cea6c83f5f9c336
Instruction ID: 6de07d1d1b295b1c1603062ec7fcd73342c84ce0c39437adf245778d3894957a
Opcode Fuzzy Hash: ea49e6f531e9ce0f4063e43af1ab30b813a60e292c1c0e572cea6c83f5f9c336
Instruction Fuzzy Hash: 3051BC24B0478819FB3ADBA088547AABFF49F01380F094599D6C25F5C3D6B4BA8CC751

Function 003603DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00360E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0035FDAD,?,?), ref: 00360E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003604AC

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0036054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 003605E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00360822
RegCloseKey.ADVAPI32(00000000), ref: 0036082F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 1f9540f2c196d5dacad3d9cb728e1bd0e68e750ea91dcb82314b8e57f797aa62
Instruction ID: ff522d93b06ce17bf6d2db004ec267ee5d544d6fcac0d5a9467ec47758208f92
Opcode Fuzzy Hash: 1f9540f2c196d5dacad3d9cb728e1bd0e68e750ea91dcb82314b8e57f797aa62
Instruction Fuzzy Hash: C3E15B30204204AFCB15DF29C891E6BBBE8EF89314F04C96DF84ADB265DA30E911CF91

Function 003583BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

CoInitialize.OLE32 ref: 00358403
CoUninitialize.OLE32 ref: 0035840E
CoCreateInstance.OLE32(?,00000000,00000017,00372BEC,?), ref: 0035846E
IIDFromString.OLE32(?,?), ref: 003584E1
VariantInit.OLEAUT32(?), ref: 0035857B
VariantClear.OLEAUT32(?), ref: 003585DC

Strings

NULL Pointer assignment, xrefs: 003584B3
Invalid parameter, xrefs: 003584FA
Failed to create object, xrefs: 00358479, 0035852F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: c6558d4044a193dcf90fa8e25128c99539fbefdb338c5aae2cb827f778ee8de1
Instruction ID: 4e03fd01de34c866c19d23b794bb2cea5635738b17e136f145f53625e134e8de
Opcode Fuzzy Hash: c6558d4044a193dcf90fa8e25128c99539fbefdb338c5aae2cb827f778ee8de1
Instruction Fuzzy Hash: 5C61E0706083129FC712DF15D848F6EB7E8AF4A755F004859FD82AB2A1DB70ED48CB92

Function 00354164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0035418B
EmptyClipboard.USER32 ref: 00354191
GlobalAlloc.KERNEL32(00000002,?), ref: 003541A6
CloseClipboard.USER32 ref: 00354245

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: b164adc4a6c379a1804baace7d3de634dbd94c67397f86bc087826e2b47276df
Instruction ID: f49229c88d04d89723499203ea5148af2c2f829ab9647f4fc16d5fdae7d9694d
Opcode Fuzzy Hash: b164adc4a6c379a1804baace7d3de634dbd94c67397f86bc087826e2b47276df
Instruction Fuzzy Hash: 4221AB35201610AFDB06AF20EC09F6A7BACFF05715F00C42AF9469B2B1CBB0AD80CB55

Function 003437EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002E4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002E4743,?,?,002E37AE,?), ref: 002E4770

Part of subcall function 00344A31: GetFileAttributesW.KERNEL32(?,0034370B), ref: 00344A32

FindFirstFileW.KERNEL32(?,?), ref: 003438A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0034394B
MoveFileW.KERNEL32(?,?), ref: 0034395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0034397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0034399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 003439B9

Strings

\*.*, xrefs: 0034384E, 00343857, 0034386C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 46a80e9dba31ed5de28c71391d0361f475d0da09ce12b036707c86cee081af13
Instruction ID: e1ea82b3dd6399995465153eb5d95be2126792fe18cd93e1fdc2fff579992c99
Opcode Fuzzy Hash: 46a80e9dba31ed5de28c71391d0361f475d0da09ce12b036707c86cee081af13
Instruction Fuzzy Hash: 6A51913185518CAACF06FBA1D9929EDB7B8AF15304FA04069E4067B192EF716F0DCF61

Function 0034F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0034F440
Sleep.KERNEL32(0000000A), ref: 0034F470
_wcscmp.LIBCMT ref: 0034F484
_wcscmp.LIBCMT ref: 0034F49F
FindNextFileW.KERNEL32(?,?), ref: 0034F53D
FindClose.KERNEL32(00000000), ref: 0034F553

Strings

*.*, xrefs: 0034F425

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 7930513508aba47843d2044f2e0a6cf3847e3bcc06ef1ec6aacc6979d094ed26
Instruction ID: 7e5dbb97390d0613c680b3fd3e0781c720e56a7d06d7f47afb8b677b437dbc8f
Opcode Fuzzy Hash: 7930513508aba47843d2044f2e0a6cf3847e3bcc06ef1ec6aacc6979d094ed26
Instruction Fuzzy Hash: DF418C7184021AAFCF12DF65DC45AEEBBB8FF06310F1444A6E815AA291DB30AA54CF90

Function 002F3030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

_/, xrefs: 002F3322
3c/, xrefs: 002F3225

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3c/$_/
API String ID: 674341424-3203948279
Opcode ID: 343e641daa4fb5228d66477f6fc83644f856063789d5c26fd7f08365db12c7ea
Instruction ID: f4e5156771fc9ebb711c8371fff423ee929daea6c4e15f745a78df7e441e2a61
Opcode Fuzzy Hash: 343e641daa4fb5228d66477f6fc83644f856063789d5c26fd7f08365db12c7ea
Instruction Fuzzy Hash: E122CB716283149FC725DF24D881BAEF7E4BF84350F40492DFA8A9B291DB70E954CB92

Function 002F5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002F58A5
_memmove.LIBCMT ref: 002F58F5
_memmove.LIBCMT ref: 002F595B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 039026fe996e67d45f77dbe1de2b55b93fee1b211898197419c20958b9c8df56
Instruction ID: af94fbc7b1752e79d7196d5ffc1dcbd0e349c7bdabe9d5d2fb6b7dc80961bb3b
Opcode Fuzzy Hash: 039026fe996e67d45f77dbe1de2b55b93fee1b211898197419c20958b9c8df56
Instruction Fuzzy Hash: 55129B70A10619DFDF09DFA5D991AAEF7F5FF48300F104529E946A7290EB36AD20CB60

Function 00343B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002E4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002E4743,?,?,002E37AE,?), ref: 002E4770

Part of subcall function 00344A31: GetFileAttributesW.KERNEL32(?,0034370B), ref: 00344A32

FindFirstFileW.KERNEL32(?,?), ref: 00343B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00343BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00343BEA
FindClose.KERNEL32(00000000), ref: 00343C01
FindClose.KERNEL32(00000000), ref: 00343C0A

Strings

\*.*, xrefs: 00343B5B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 4cf9b5382160ae6cac935cbed506d7bf888639f9265db3a9831dda0399db6ae5
Instruction ID: fcfa50e6406911892de27fa52a8f02b282c72b3038289beaa514f0ee8fdf3f86
Opcode Fuzzy Hash: 4cf9b5382160ae6cac935cbed506d7bf888639f9265db3a9831dda0399db6ae5
Instruction Fuzzy Hash: 5C316D350583859FC702EF64D8919AFBBECAE91304F804D2DF4D597191EB21EA18CBA3

Function 003451BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 003387E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0033882B
Part of subcall function 003387E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00338858
Part of subcall function 003387E1: GetLastError.KERNEL32 ref: 00338865

ExitWindowsEx.USER32(?,00000000), ref: 003451F9

Strings

, xrefs: 003451E7
@, xrefs: 003451EC
SeShutdownPrivilege, xrefs: 003451C9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 0c6451405c738c262badab8efa748d1e3f0b817f78de2d6ec1f8490f18057cc1
Instruction ID: cc40fa034ee7df4756ceacb7bd82897b32607f7114e8bfd1fe156ca47892ee33
Opcode Fuzzy Hash: 0c6451405c738c262badab8efa748d1e3f0b817f78de2d6ec1f8490f18057cc1
Instruction Fuzzy Hash: 1301D431E916156BEB2A6678AC9AFBA72DC9B05740F210C22F913EE0D3DAD17C008590

Function 00356283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 003562DC
WSAGetLastError.WSOCK32(00000000), ref: 003562EB
bind.WSOCK32(00000000,?,00000010), ref: 00356307
listen.WSOCK32(00000000,00000005), ref: 00356316
WSAGetLastError.WSOCK32(00000000), ref: 00356330
closesocket.WSOCK32(00000000), ref: 00356344

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 82e3c915759cee071cb3427cbefaae4ae607aff34d152ef287d0fac5a2f78846
Instruction ID: fe0c1acac8913124e7a42928655c7be33b856a3fb71ab1e1e2197cc2d4ea5e51
Opcode Fuzzy Hash: 82e3c915759cee071cb3427cbefaae4ae607aff34d152ef287d0fac5a2f78846
Instruction Fuzzy Hash: 4721DD35600200AFCB01EF64D88AE6EB7A9EF49321F558169EC56A73B1CBB0AC45CB51

Function 002F5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00300DB6: std::exception::exception.LIBCMT ref: 00300DEC
Part of subcall function 00300DB6: __CxxThrowException@8.LIBCMT ref: 00300E01

_memmove.LIBCMT ref: 00330258
_memmove.LIBCMT ref: 0033036D
_memmove.LIBCMT ref: 00330414

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: aaa01b632c4eb90b07b9bda6a763c862eec944cc3bc840353b5797dc3e7b2fbc
Instruction ID: 6fc6e0e062484cad12047f9d9ade05b4677d900047299213a536bec278f06323
Opcode Fuzzy Hash: aaa01b632c4eb90b07b9bda6a763c862eec944cc3bc840353b5797dc3e7b2fbc
Instruction Fuzzy Hash: 3202D170A10209DFCF09DF65D991ABEBBB9EF44300F548069E90ADB295EB31D960CB91

Function 002E1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 002E19FA
GetSysColor.USER32(0000000F), ref: 002E1A4E
SetBkColor.GDI32(?,00000000), ref: 002E1A61

Part of subcall function 002E1290: DefDlgProcW.USER32(?,00000020,?), ref: 002E12D8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 5433b43615d74524ac3b6b8ccca800a266fb235bd865cf4f667a43734fc8585d
Instruction ID: 6a11acae84bfb1f993f6267ed121e6b4663f02e79abd79e46c3912de6471accc
Opcode Fuzzy Hash: 5433b43615d74524ac3b6b8ccca800a266fb235bd865cf4f667a43734fc8585d
Instruction Fuzzy Hash: E9A188701B25C5BAE72AAF2B8C44DBF255CDF4A381F91413AF502D6292CB708D71C2B1

Function 00356747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00357D8B: inet_addr.WSOCK32(00000000), ref: 00357DB6

socket.WSOCK32(00000002,00000002,00000011), ref: 0035679E
WSAGetLastError.WSOCK32(00000000), ref: 003567C7
bind.WSOCK32(00000000,?,00000010), ref: 00356800
WSAGetLastError.WSOCK32(00000000), ref: 0035680D
closesocket.WSOCK32(00000000), ref: 00356821

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 17d3427111023c59e0571b366e673952ac75fe54e59d848355f45af3f7c95533
Instruction ID: c30aea4f992d3e8b54088009047aa08c1897d52b824cc3b8fc1478d27ae81e46
Opcode Fuzzy Hash: 17d3427111023c59e0571b366e673952ac75fe54e59d848355f45af3f7c95533
Instruction Fuzzy Hash: F3410471A402006FDB11EF258C83F6E77A8DF09710F84806DF95AAB3E2CA709D508B91

Function 00365376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 003653C5
IsWindowEnabled.USER32 ref: 003653D3
GetForegroundWindow.USER32(?,?,00000001), ref: 003653E0
IsIconic.USER32 ref: 003653EE
IsZoomed.USER32 ref: 003653FC

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 5c731a03763d31793d7a6453f2bacb7ea8fdc721c4521d3a8f369dac393f18d3
Instruction ID: 3ca3dcdd4b1a71e7148faa412c3b989606e516c237de70bb313d0916d1ed6f2e
Opcode Fuzzy Hash: 5c731a03763d31793d7a6453f2bacb7ea8fdc721c4521d3a8f369dac393f18d3
Instruction Fuzzy Hash: 5E1190323409116FEB235F26DC44B6ABB9CEF45BA1F51C039E846D7251CBB09C018AA4

Function 003380A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003380C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003380CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003380D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003380E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003380F6

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ca453d76cc7117082b40d282ae16f3d96e8ab7dd761fc3eff34c42a32a057e71
Instruction ID: a00e2213ca1ef2b0059669511b167373f6c95c3fe679b47dc056bc459f74d70e
Opcode Fuzzy Hash: ca453d76cc7117082b40d282ae16f3d96e8ab7dd761fc3eff34c42a32a057e71
Instruction Fuzzy Hash: 6FF06D75244304AFEB120FA6ECCDE6B3BACFF8A795F104029F949C6150CBA5DC42DA60

Function 002EE6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Dd:, xrefs: 00323AF5
Dd:, xrefs: 00323B2E
Dd:, xrefs: 002EEAC1
Variable must be of type 'Object'., xrefs: 00323E62
Dd:, xrefs: 002EEABA

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID: Dd:$Dd:$Dd:$Dd:$Variable must be of type 'Object'.
API String ID: 0-4140787449
Opcode ID: 70437a395a0f2a12fa533bfeaf24dd6c3070e05d5dff81a402d83f808760a5d2
Instruction ID: e0d733482ff9f046adbc48f2539ba487233ac5028fb540e75e04e846e7424e6e
Opcode Fuzzy Hash: 70437a395a0f2a12fa533bfeaf24dd6c3070e05d5dff81a402d83f808760a5d2
Instruction Fuzzy Hash: 24A2E074A60256CFCF24CF56C480AAEB7B5FF59310FAA8469E805AB351D374ED52CB80

Function 002E4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,002E4AD0), ref: 002E4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 002E4B57

Strings

kernel32.dll, xrefs: 002E4B40
GetNativeSystemInfo, xrefs: 002E4B51

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 804aaa55a2fc00f1cd33cff9e1af25a9d093986bb5a7d89f8ee6bab010c6ea24
Instruction ID: fa027522062ed6613b46172a01ea87ff09f7b8bac24f2fd31610fad920884542
Opcode Fuzzy Hash: 804aaa55a2fc00f1cd33cff9e1af25a9d093986bb5a7d89f8ee6bab010c6ea24
Instruction Fuzzy Hash: 84D01734E60713CFD721AF32F828B4676E8AF06395F11C87ED486D6150E6B0E880CA54

Function 0035EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0035EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0035EE4B

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Process32NextW.KERNEL32(00000000,?), ref: 0035EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0035EF1A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: b0d11c3b2a6954e6f12561ede38fc494de6dae8e90b93d7e936bf7deb5fb3bbd
Instruction ID: 260bfce1e2539f4feb411b2a33926441dcdf438743ebe9c725a89183831bfcf2
Opcode Fuzzy Hash: b0d11c3b2a6954e6f12561ede38fc494de6dae8e90b93d7e936bf7deb5fb3bbd
Instruction Fuzzy Hash: 1351A071514350AFD311EF25DC82EABB7E8EF94740F40482DF995972A2EB70AD18CB92

Function 0033E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0033E628

Strings

|, xrefs: 0033E658
(, xrefs: 0033E66E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 3da3f5c5215a757e77eaca0ed0f3df38eb1d6649e0b5538d66f7440d2b5f2de4
Instruction ID: b65b58746b8be7bad50406d2f2ea57b57a9240b9948091200069dbfe2e1fe302
Opcode Fuzzy Hash: 3da3f5c5215a757e77eaca0ed0f3df38eb1d6649e0b5538d66f7440d2b5f2de4
Instruction Fuzzy Hash: C6321575A006059FDB29CF19C481AAAB7F0FF48310F15C56EE89ADB7A1D770E941CB40

Function 003522EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0035180A,00000000), ref: 003523E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00352418

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 399b5b14e7c1d6a2d9a62ece716694b245d00a221594ba910a1b8048cee62d20
Instruction ID: 883a10395bab436157fbd19967e5f800bd6be0a854df80efebab7ca85246b4f6
Opcode Fuzzy Hash: 399b5b14e7c1d6a2d9a62ece716694b245d00a221594ba910a1b8048cee62d20
Instruction Fuzzy Hash: 8C4129B5904309BFEB12DE95DC81FBF77BCEB41316F10402AFE00A6160DB759E499660

Function 0034B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0034B343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0034B39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0034B3EA

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 0dbf64eb6ca2cf99ac92c6d2e17760e4c851163f679101cdc74a42f8ffb85a12
Instruction ID: 023ffef0ed3dc98e004478b918ea5581d9ba1472a275ef5b57a96cd6e0110f91
Opcode Fuzzy Hash: 0dbf64eb6ca2cf99ac92c6d2e17760e4c851163f679101cdc74a42f8ffb85a12
Instruction Fuzzy Hash: 16216075A10118EFCB01EFA5D881AEDFBB8FF49314F1480AAE905AB361CB31A955CF51

Function 003387E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00300DB6: std::exception::exception.LIBCMT ref: 00300DEC
Part of subcall function 00300DB6: __CxxThrowException@8.LIBCMT ref: 00300E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0033882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00338858
GetLastError.KERNEL32 ref: 00338865

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: efd12a40341bfc61583cebaba28a29df83133e5a78ab489a20832b633b348cc0
Instruction ID: a91e4be2182ee9d95c7efb3692a96799de2aff3cacf1f15d970527d6928fabe8
Opcode Fuzzy Hash: efd12a40341bfc61583cebaba28a29df83133e5a78ab489a20832b633b348cc0
Instruction Fuzzy Hash: B4116AB2814305AFE719DFA4EC85D6BB7ACFB44710F20852EF4569B241EA70AC408B60

Function 0033874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00338774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0033878B
FreeSid.ADVAPI32(?), ref: 0033879B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 8253976e40bf899c1bc17b5ed27390318c39d0a75dc86156b507c9d0e8f391ed
Instruction ID: 789413d572468ddae9bccf0d75e4fed8d7bc32f57c9ecb24c7375b43c6f0eefe
Opcode Fuzzy Hash: 8253976e40bf899c1bc17b5ed27390318c39d0a75dc86156b507c9d0e8f391ed
Instruction Fuzzy Hash: FAF03775A11308BFDB00DFE49D89ABEBBBCEF08301F1084A9E901E2281E6756A048B50

Function 00348889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0034889B

Part of subcall function 0030520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00348F6E,00000000,?,?,?,?,0034911F,00000000,?), ref: 00305213
Part of subcall function 0030520A: __aulldiv.LIBCMT ref: 00305233

Strings

0e:, xrefs: 00348892

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0e:
API String ID: 2893107130-95189714
Opcode ID: 55107d57457674948b9496c34d56d0092c0611e4e2fc6cc5a2e2e45473c80355
Instruction ID: 5114338a8950ba141d54d03b24f7dd093aeb77fdc748cde9e2f65c062fd76123
Opcode Fuzzy Hash: 55107d57457674948b9496c34d56d0092c0611e4e2fc6cc5a2e2e45473c80355
Instruction Fuzzy Hash: 5B21B7326355108BC72ACF25D451A52B3E5EFA5311F698E6CD1F5CF2C0CA34B905CB54

Function 0034C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0034C6FB
FindClose.KERNEL32(00000000), ref: 0034C72B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ed853c64d9292c000f272ec57aaa6eb04251376477d62b6a3d84fc64d9aa1009
Instruction ID: addb50f7216c1115a7d614334246cd1e05cb9f8d079c87343bc22ecb01c5d216
Opcode Fuzzy Hash: ed853c64d9292c000f272ec57aaa6eb04251376477d62b6a3d84fc64d9aa1009
Instruction Fuzzy Hash: 81118E766102009FDB10DF29D885A6AF7E8FF85324F00851EF8A98B2A1DB70A801CF81

Function 0034A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00359468,?,0036FB84,?), ref: 0034A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00359468,?,0036FB84,?), ref: 0034A0A9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0b2be4c12f33a2161c41a7fbb8cc4a5251a607e2527ccf98237e10af0f1fd672
Instruction ID: 3393179b0b7597925768a1e7b4e80d032f66b2a455fd72663d1799e41b4d60bc
Opcode Fuzzy Hash: 0b2be4c12f33a2161c41a7fbb8cc4a5251a607e2527ccf98237e10af0f1fd672
Instruction Fuzzy Hash: 1BF0E23514422DABDB229FA4DC48FEA736CFF08361F008265F918D6180C770A944CBA1

Function 003381CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00338309), ref: 003381E0
CloseHandle.KERNEL32(?,?,00338309), ref: 003381F2

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: aec5fe791227f64cc102b74befd8ec2453ba454d5fa93909d8f1238ccb9bf5ac
Instruction ID: de65f19523d88684664bf7193c1a75b995e7569e10287ff9c6857db6586d11c8
Opcode Fuzzy Hash: aec5fe791227f64cc102b74befd8ec2453ba454d5fa93909d8f1238ccb9bf5ac
Instruction Fuzzy Hash: 3AE0B672015A11AFE7272B60FC09E777BAEEF04350B248829F8A684470DB62AC91DB10

Function 0030A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00308D57,?,?,?,00000001), ref: 0030A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0030A163

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e8f98f31f86346b92568aa5350d0e50536d741debe1dcde5980556b5e487b7d0
Instruction ID: 76629f6fd3e5f9fe6b5d96771c7da352104d908250b2612f474e8a085388fec8
Opcode Fuzzy Hash: e8f98f31f86346b92568aa5350d0e50536d741debe1dcde5980556b5e487b7d0
Instruction Fuzzy Hash: E2B09235058208AFCA022B91FC09B883F6CEB44BA2F508020F60D84260EBA254508A91

Function 0030F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d0792e4d06f9668083bd8ef77161ee73b74edd229dd9fed7ccffa6da1aba9e
Instruction ID: 06f63f2925336ad3d750846c6bc78e686571a0639c2070993a76420c7e8d9f1e
Opcode Fuzzy Hash: 46d0792e4d06f9668083bd8ef77161ee73b74edd229dd9fed7ccffa6da1aba9e
Instruction Fuzzy Hash: C932BD26D2AF414DD7339634D872326A28DAFA73D4F15D737E81AB5EA6EB2984C34100

Function 0031242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24f1e6a1fbbb23d71692ff5a4d10c5cdb66a7d12c06ebebfbb0d1f887ad85ef
Instruction ID: 8ef31a494d707b0bae70fa70234dc542de54bd6a486e7bf55dc49ff4a351de1a
Opcode Fuzzy Hash: d24f1e6a1fbbb23d71692ff5a4d10c5cdb66a7d12c06ebebfbb0d1f887ad85ef
Instruction Fuzzy Hash: CEB1D020D2AF414DD2239A39887533AB65CAFFB2D5F51D71BFC1A74E62EB2285C34141

Function 00344C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00344C4A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 5617e8fe1675914b80df461e83ba4b88649f3f68261b52fd5deda20dc9d906cc
Instruction ID: 7e0278c760044430d26aaa2296de92790592690afdaf9906ef9bdac8cd704eb3
Opcode Fuzzy Hash: 5617e8fe1675914b80df461e83ba4b88649f3f68261b52fd5deda20dc9d906cc
Instruction Fuzzy Hash: A8D05E9116560938FC1E0720AE8FF7A01CCE300782FD9816972038E0C2ECC07C405031

Function 003387B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00338389), ref: 003387D1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 38664293e4248dfa8253474764f331152a995c72f5f43795ce1106e793275322
Instruction ID: 85275c239a691096e6fe21a347365083a5a68e819f5d32c23e2e66ed63fa0c7d
Opcode Fuzzy Hash: 38664293e4248dfa8253474764f331152a995c72f5f43795ce1106e793275322
Instruction Fuzzy Hash: 72D05E3226050EBFEF018EA4ED01EBE3B69EB04B01F408111FE15C50A1C7B5D835AB60

Function 0030A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0030A12A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c485193a5a0a5fed423a69617f421bfd326c326dc4db7392cf4ecda4a452f31c
Instruction ID: 4d57779290adc2c6a19d7387aa64eb0994b0149b8e6057617f2ebef425a14454
Opcode Fuzzy Hash: c485193a5a0a5fed423a69617f421bfd326c326dc4db7392cf4ecda4a452f31c
Instruction Fuzzy Hash: 7AA0113000020CAB8A022B82FC08888BFACEA002A0B008020F80C80222ABB2A8208A80

Function 002F52A5 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

>@ABCRRRRRDEFGHIJKLMNO, xrefs: 002F5478

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID: >@ABCRRRRRDEFGHIJKLMNO
API String ID: 0-3782972239
Opcode ID: 213c8ac9baeb80f4b8fd42e67053d899899d5361a4a4d80469e5d887398294e5
Instruction ID: 39711b69de7c7b061c7c10a4694b3b2e904cc0f124fa5e49c396301266785915
Opcode Fuzzy Hash: 213c8ac9baeb80f4b8fd42e67053d899899d5361a4a4d80469e5d887398294e5
Instruction Fuzzy Hash: B971A92615CBE69FCB038B3488AA6E2BFF09E17314B1D59EEC5C18F0A3C2559487D702

Function 002F8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceecca4c4e7a3aa74bf7e771c9af062a0e8c8459e977bf1ae67420a88709c44c
Instruction ID: b397675845e657e871bcd0eaf7f822929a39b6774497dae36667142f48d8f4fc
Opcode Fuzzy Hash: ceecca4c4e7a3aa74bf7e771c9af062a0e8c8459e977bf1ae67420a88709c44c
Instruction Fuzzy Hash: D2222530A2454BCBDF2A8F24C4E477DF7A1FB01384F29847ADA528B592DBB09DA1C741

Function 003021C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 62a7d78456fe7ece280180f008e162d4d5f8c327a4b726c611c7549bd220f38b
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 28C184362061930ADF6F463A843813FFAA55EA27B135B076DD8B3CB5D4EE20C965D720

Function 003025FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 0f24b1bb9b326d90b2088452c94cc213cb6082416b24f78893581d9c5267a702
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 59C172362061930ADF2F463AC47813FBAA15EA27B135B076DD4B2DB5D5EE20C925E720

Function 00301978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 26cdfec391cbe90658e54b6dfeb2e5ac8919d8ae2d4c9304ca9a69a8addc93e8
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 66C17F3220B1930ADF2F863AC47413EBAA15EA27B135B076DD4B3DB1D4EF20C965D620

Function 01065240 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: de05503248eb6c307cc4c3105d8a4be962828b59037bf9e9740c3608f31f1d95
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 2D41D271D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80

Function 01065130 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 4341388e31a47dc7bea37f3ea21a07494c0c6e1bf3b61876541c14cd757d5a93
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: B1019278A00109EFCB44DF98C9909AEF7F9FB48350F208699D849AB301E730AE41DB80

Function 010650D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 0a7063c68c79d165c79c8a3dd92e9c1832dfc59921eeb7dfe315b79249bb6143
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 7B019278A00209EFCB44DF98C9909AEF7F9FB48350F2085D9E949A7701D730AE41DB80

Function 01063AC0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656749165.0000000001061000.00000040.00000020.00020000.00000000.sdmp, Offset: 01061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1061000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00357806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0035785B
DeleteObject.GDI32(00000000), ref: 0035786D
DestroyWindow.USER32 ref: 0035787B
GetDesktopWindow.USER32 ref: 00357895
GetWindowRect.USER32(00000000), ref: 0035789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 003579DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 003579ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357A35
GetClientRect.USER32(00000000,?), ref: 00357A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00357A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357ABB
GlobalLock.KERNEL32(00000000), ref: 00357AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357AD3
GlobalUnlock.KERNEL32(00000000), ref: 00357ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357AE3
GlobalFree.KERNEL32(00000000), ref: 00357AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00372CAC,00000000), ref: 00357B16
GlobalFree.KERNEL32(00000000), ref: 00357B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00357B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00357B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00357D7A

Strings

static, xrefs: 00357A75, 00357BCC
, xrefs: 00357D00
AutoIt v3, xrefs: 00357A2D
DISPLAY, xrefs: 00357BDD

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 13e47fcb3d46e06542946fdf04df5ee0d4244be82aab07174626807126de1935
Instruction ID: 19b88eca41f324c0073875e30843900f6539bfb0cca4664aa694169b62b6b5fe
Opcode Fuzzy Hash: 13e47fcb3d46e06542946fdf04df5ee0d4244be82aab07174626807126de1935
Instruction Fuzzy Hash: F7027971910115EFDB16DFA4EC89EAE7BB9FF49310F108169F915AB2A1CB70AD01CB60

Function 0036356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0036F910), ref: 00363627
IsWindowVisible.USER32(?), ref: 0036364B

Strings

GETLINECOUNT, xrefs: 003638C6
ISCHECKED, xrefs: 00363839
SELECTSTRING, xrefs: 00363806
TABRIGHT, xrefs: 0036369D
UNCHECK, xrefs: 00363883
CURRENTTAB, xrefs: 003636BD
GETSELECTED, xrefs: 003638A3
SENDCOMMANDID, xrefs: 003639DA
TABLEFT, xrefs: 00363687
SETCURRENTSELECTION, xrefs: 003637B6
ADDSTRING, xrefs: 00363716
FINDSTRING, xrefs: 00363776
CHECK, xrefs: 0036386D
GETCURRENTCOL, xrefs: 00363928
GETLINE, xrefs: 0036399B
SHOWDROPDOWN, xrefs: 003636E0
GETCURRENTSELECTION, xrefs: 003637E3
EDITPASTE, xrefs: 0036395F
ISVISIBLE, xrefs: 00363637
GETCURRENTLINE, xrefs: 003638ED
HIDEDROPDOWN, xrefs: 00363700
DELSTRING, xrefs: 00363749
ISENABLED, xrefs: 0036366B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: dc3df2818c8f59d068df020d4b9a6ee111d51e97820afdbe11b0958a63692cef
Instruction ID: ec22d0305e19edb643b527149de2ce742b01cf20811d4f5cfd6d87f958099945
Opcode Fuzzy Hash: dc3df2818c8f59d068df020d4b9a6ee111d51e97820afdbe11b0958a63692cef
Instruction Fuzzy Hash: BCD19E302183419BCF06EF14C891BAE7BA5AF95354F15846DF8825B3E6CB31EE4ACB41

Function 0036A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0036A630
GetSysColorBrush.USER32(0000000F), ref: 0036A661
GetSysColor.USER32(0000000F), ref: 0036A66D
SetBkColor.GDI32(?,000000FF), ref: 0036A687
SelectObject.GDI32(?,00000000), ref: 0036A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0036A6C1
GetSysColor.USER32(00000010), ref: 0036A6C9
CreateSolidBrush.GDI32(00000000), ref: 0036A6D0
FrameRect.USER32(?,?,00000000), ref: 0036A6DF
DeleteObject.GDI32(00000000), ref: 0036A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0036A731
FillRect.USER32(?,?,00000000), ref: 0036A763
GetWindowLongW.USER32(?,000000F0), ref: 0036A78E

Part of subcall function 0036A8CA: GetSysColor.USER32(00000012), ref: 0036A903
Part of subcall function 0036A8CA: SetTextColor.GDI32(?,?), ref: 0036A907
Part of subcall function 0036A8CA: GetSysColorBrush.USER32(0000000F), ref: 0036A91D
Part of subcall function 0036A8CA: GetSysColor.USER32(0000000F), ref: 0036A928
Part of subcall function 0036A8CA: GetSysColor.USER32(00000011), ref: 0036A945
Part of subcall function 0036A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0036A953
Part of subcall function 0036A8CA: SelectObject.GDI32(?,00000000), ref: 0036A964
Part of subcall function 0036A8CA: SetBkColor.GDI32(?,00000000), ref: 0036A96D
Part of subcall function 0036A8CA: SelectObject.GDI32(?,?), ref: 0036A97A
Part of subcall function 0036A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0036A999
Part of subcall function 0036A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0036A9B0
Part of subcall function 0036A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0036A9C5
Part of subcall function 0036A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0036A9ED

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 0997149852c19d73468f6f712776861ca855a9bc4d902cff4b0a324d5f0508eb
Instruction ID: edaa9e91dbcbf94935ad1f52bd36850dd1d783dddc63b4a0c7cabab838a6d3b2
Opcode Fuzzy Hash: 0997149852c19d73468f6f712776861ca855a9bc4d902cff4b0a324d5f0508eb
Instruction Fuzzy Hash: 5B916E72008701EFC7129F64EC08A5B7BADFF89321F149A29F562A61A1D7B1D944CF52

Function 002E2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 002E2CA2
DeleteObject.GDI32(00000000), ref: 002E2CE8
DeleteObject.GDI32(00000000), ref: 002E2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 002E2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 002E2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0031C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0031C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0031C89D

Part of subcall function 002E1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002E2036,?,00000000,?,?,?,?,002E16CB,00000000,?), ref: 002E1B9A

SendMessageW.USER32(?,00001053), ref: 0031C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0031C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0031C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0031C912

Strings

0, xrefs: 0031C731

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 96803f45077550a2b6a4a8813683acab5672facea1a5160d8399e267ab1a6bc6
Instruction ID: a59f8c7cfe48816973d3be269d5fea164cace3eccfeb0b0d6a2e1c3905121b70
Opcode Fuzzy Hash: 96803f45077550a2b6a4a8813683acab5672facea1a5160d8399e267ab1a6bc6
Instruction Fuzzy Hash: 1712CE30264241DFCB1ACF25C884BA9B7E9BF09300F55A56AF496CB262C771EC95CF91

Function 003574AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 003574DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0035759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 003575DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 003575ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00357633
GetClientRect.USER32(00000000,?), ref: 0035763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00357683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00357692
GetStockObject.GDI32(00000011), ref: 003576A2
SelectObject.GDI32(00000000,00000000), ref: 003576A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 003576B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003576BF
DeleteDC.GDI32(00000000), ref: 003576C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 003576F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0035770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00357746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0035775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0035776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0035779B
GetStockObject.GDI32(00000011), ref: 003577A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 003577B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 003577BB

Strings

static, xrefs: 0035767D, 00357795
msctls_progress32, xrefs: 0035773C
AutoIt v3, xrefs: 0035762B
DISPLAY, xrefs: 00357688

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 1d204c0cd3e1df2f3807eb53374003952fff3314bed1ea9b266054ff61be1ec7
Instruction ID: d83b07212667e55d45cc43147299da73c86724d96ae0d1f30b76c034df15b43a
Opcode Fuzzy Hash: 1d204c0cd3e1df2f3807eb53374003952fff3314bed1ea9b266054ff61be1ec7
Instruction Fuzzy Hash: 36A17F71A50615BFEB15DBA4EC4AFAE7BBDEB09710F008514FA15A72E0D7B0AD00CB60

Function 0034AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0034AD1E
GetDriveTypeW.KERNEL32(?,0036FAC0,?,\\.\,0036F910), ref: 0034ADFB
SetErrorMode.KERNEL32(00000000,0036FAC0,?,\\.\,0036F910), ref: 0034AF59

Strings

CDROM, xrefs: 0034AE2F
SSA, xrefs: 0034AEE2
Unknown, xrefs: 0034AE1B, 0034AEBF
SSD, xrefs: 0034AE86
Virtual, xrefs: 0034AF21
Removable, xrefs: 0034AE4D
MMC, xrefs: 0034AF1A
SATA, xrefs: 0034AF0C
Fibre, xrefs: 0034AEE9
SAS, xrefs: 0034AF05
1394, xrefs: 0034AEDB
FileBackedVirtual, xrefs: 0034AF28
SCSI, xrefs: 0034AEC6
RAID, xrefs: 0034AEF7
RAMDisk, xrefs: 0034AE25
Network, xrefs: 0034AE39
ATA, xrefs: 0034AED4
iSCSI, xrefs: 0034AEFE
USB, xrefs: 0034AEF0
\\.\, xrefs: 0034AD70
PhysicalDrive, xrefs: 0034ADA7
Fixed, xrefs: 0034AE43
ATAPI, xrefs: 0034AECD

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ac1025d24fe33a179b92c74ba3f566c3210b7fc13847726d9eca99d0edb08f1d
Instruction ID: 8a7bd790073961084642e5d56468258f32155b87afb0deb080f89ea15a5f5d51
Opcode Fuzzy Hash: ac1025d24fe33a179b92c74ba3f566c3210b7fc13847726d9eca99d0edb08f1d
Instruction Fuzzy Hash: 3C51A3B16D8A05AB8F03EB10CD52CFD73E5EB4A700B644056E407AF6D1CA72BD45DB42

Function 002E68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 002E6931
__wcsnicmp.LIBCMT ref: 002E6949
__wcsnicmp.LIBCMT ref: 002E6961
__wcsnicmp.LIBCMT ref: 002E6979
__wcsnicmp.LIBCMT ref: 002E6991
__wcsnicmp.LIBCMT ref: 002E69A9
__wcsnicmp.LIBCMT ref: 002E69C1
__wcsnicmp.LIBCMT ref: 002E69D5
__wcsnicmp.LIBCMT ref: 002E6A16
__wcsnicmp.LIBCMT ref: 002E6A2A
__wcsnicmp.LIBCMT ref: 002E6A3E
__wcsnicmp.LIBCMT ref: 002E6A52

Strings

#comments-start, xrefs: 002E69BB, 002E6A10
Cannot parse #include, xrefs: 0031E3F0
#notrayicon, xrefs: 002E6943
#requireadmin, xrefs: 002E695B
#include, xrefs: 002E69A3
#ce, xrefs: 002E6A4C
Bad directive syntax error, xrefs: 0031E31A
#include-once, xrefs: 002E698B
#cs, xrefs: 002E69CF, 002E6A24
#pragma compile, xrefs: 002E692B
Unterminated group of comments, xrefs: 0031E403
#comments-end, xrefs: 002E6A38
#OnAutoItStartRegister, xrefs: 002E6973

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 1caa0ed37f8b5c7c50aac7cd3fe217923397c57c31f943e541653a17fb3046d6
Instruction ID: fd254713a5681fce3c2d3f8ba5da7f987c5befc4de78d381cccb4500618c2598
Opcode Fuzzy Hash: 1caa0ed37f8b5c7c50aac7cd3fe217923397c57c31f943e541653a17fb3046d6
Instruction Fuzzy Hash: BF8158B06902466ACB26AF62DC57FFF3768AF25740F404025FC056B1C2EBB1DE61C6A1

Function 0036A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0036A903
SetTextColor.GDI32(?,?), ref: 0036A907
GetSysColorBrush.USER32(0000000F), ref: 0036A91D
GetSysColor.USER32(0000000F), ref: 0036A928
CreateSolidBrush.GDI32(?), ref: 0036A92D
GetSysColor.USER32(00000011), ref: 0036A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0036A953
SelectObject.GDI32(?,00000000), ref: 0036A964
SetBkColor.GDI32(?,00000000), ref: 0036A96D
SelectObject.GDI32(?,?), ref: 0036A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0036A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0036A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0036A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0036A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0036AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0036AA32
DrawFocusRect.USER32(?,?), ref: 0036AA3D
GetSysColor.USER32(00000011), ref: 0036AA4B
SetTextColor.GDI32(?,00000000), ref: 0036AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0036AA67
SelectObject.GDI32(?,0036A5FA), ref: 0036AA7E
DeleteObject.GDI32(?), ref: 0036AA89
SelectObject.GDI32(?,?), ref: 0036AA8F
DeleteObject.GDI32(?), ref: 0036AA94
SetTextColor.GDI32(?,?), ref: 0036AA9A
SetBkColor.GDI32(?,?), ref: 0036AAA4

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 30ec18eff847c82a4928c86c9301c5415e4ffbd0861ae7fbe367a0ab45a610b0
Instruction ID: 69b81b9118d24e242d197ea36b9097191c9c77b6250581f98a3c6bce34044075
Opcode Fuzzy Hash: 30ec18eff847c82a4928c86c9301c5415e4ffbd0861ae7fbe367a0ab45a610b0
Instruction Fuzzy Hash: A6512071900608FFDB129FA4EC48EAE7BB9FF09320F218525F911AB2A1D7B19940DF50

Function 003689D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00368AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00368AD2
CharNextW.USER32(0000014E), ref: 00368B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00368B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00368B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00368B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00368B86
SetWindowTextW.USER32(?,0000014E), ref: 00368BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00368BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00368C1F
_memset.LIBCMT ref: 00368C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00368C8D
_memset.LIBCMT ref: 00368CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00368D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00368D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00368E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00368E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00368E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00368EB4
DrawMenuBar.USER32(?), ref: 00368EC3
SetWindowTextW.USER32(?,0000014E), ref: 00368EEB

Strings

0, xrefs: 00368E55

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: ad9c8da77b441785622d80f1bbb820de1726a27122a1e01318ffd35579cb6076
Instruction ID: 14e360b922a219abf7f5f08be8512c501a3f7b2a4da019d46b152d1009f62e1b
Opcode Fuzzy Hash: ad9c8da77b441785622d80f1bbb820de1726a27122a1e01318ffd35579cb6076
Instruction Fuzzy Hash: 5CE16070905218AFDF229F94DC84EEE7BBDEF09710F11C256F915AA294DB708981DF60

Function 0036488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 003649CA
GetDesktopWindow.USER32 ref: 003649DF
GetWindowRect.USER32(00000000), ref: 003649E6
GetWindowLongW.USER32(?,000000F0), ref: 00364A48
DestroyWindow.USER32(?), ref: 00364A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00364A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00364ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00364AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00364AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00364B09
IsWindowVisible.USER32(?), ref: 00364B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00364B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00364B58
GetWindowRect.USER32(?,?), ref: 00364B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00364B96
GetMonitorInfoW.USER32(00000000,?), ref: 00364BB0
CopyRect.USER32(?,?), ref: 00364BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00364C32

Strings

tooltips_class32, xrefs: 00364A96
(, xrefs: 00364BA3
0, xrefs: 00364975

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: e2a201dc0d211e2cf3e9de70b9883414b032b0fc260772a4f542b8cfc4d6d22e
Instruction ID: e7bee0085455279b1d3202ab6622b1c64a481e784007fbe8feeb99842df2aaaf
Opcode Fuzzy Hash: e2a201dc0d211e2cf3e9de70b9883414b032b0fc260772a4f542b8cfc4d6d22e
Instruction Fuzzy Hash: 1DB19A71A08340AFDB05DF65D848B6ABBE8FF88304F00891DF9999B2A1D771EC45CB95

Function 002E27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002E28BC
GetSystemMetrics.USER32(00000007), ref: 002E28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002E28EF
GetSystemMetrics.USER32(00000008), ref: 002E28F7
GetSystemMetrics.USER32(00000004), ref: 002E291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 002E2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 002E2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 002E297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 002E2990
GetClientRect.USER32(00000000,000000FF), ref: 002E29AE
GetStockObject.GDI32(00000011), ref: 002E29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 002E29D5

Part of subcall function 002E2344: GetCursorPos.USER32(?), ref: 002E2357
Part of subcall function 002E2344: ScreenToClient.USER32(003A57B0,?), ref: 002E2374
Part of subcall function 002E2344: GetAsyncKeyState.USER32(00000001), ref: 002E2399
Part of subcall function 002E2344: GetAsyncKeyState.USER32(00000002), ref: 002E23A7

SetTimer.USER32(00000000,00000000,00000028,002E1256), ref: 002E29FC

Strings

AutoIt v3 GUI, xrefs: 002E2974

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: baea8d424dcebd9ec8cc459ace24496de82838ecf3535a4a6ce8e4baabca1fcb
Instruction ID: 2da470e02e237c712659e3d2d0d9ae46034edcad2c5db1cf339c30db3986c577
Opcode Fuzzy Hash: baea8d424dcebd9ec8cc459ace24496de82838ecf3535a4a6ce8e4baabca1fcb
Instruction Fuzzy Hash: 51B15E71A9024AEFDB16DFA9DC45BED7BB8FB08310F508129FA16A7290DB74D850CB50

Function 0031A8CB Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 0031A92B
___wtomb_environ.LIBCMT ref: 0031A94D

Part of subcall function 00308B28: __getptd_noexit.LIBCMT ref: 00308B28

__malloc_crt.LIBCMT ref: 0031A975
__malloc_crt.LIBCMT ref: 0031A992
_free.LIBCMT ref: 0031A9C9
__recalloc_crt.LIBCMT ref: 0031AA02
__recalloc_crt.LIBCMT ref: 0031AA47
_strlen.LIBCMT ref: 0031AA73
__calloc_crt.LIBCMT ref: 0031AA7D
_strlen.LIBCMT ref: 0031AA8C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0031AABA
_free.LIBCMT ref: 0031AAD4
_free.LIBCMT ref: 0031AAE1
_free.LIBCMT ref: 0031AAF3
__invoke_watson.LIBCMT ref: 0031AB0D

Strings

{n0, xrefs: 0031AAAD
{n0, xrefs: 0031A932

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID: {n0${n0
API String ID: 884005220-1250903134
Opcode ID: c5307d21b356084e9641aecf666437726e99f89ffce47d373a884c357294b043
Instruction ID: c7ce040f4eaf5b3a8a0b45d0d8fa6a1a522024ca733594d195e272863d499320
Opcode Fuzzy Hash: c5307d21b356084e9641aecf666437726e99f89ffce47d373a884c357294b043
Instruction Fuzzy Hash: FE612672506B05AFDB1B6F24DC017A977A8EF09322F224115F8059B1D1DB34CDC1C792

Function 0033A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0033A47A
__swprintf.LIBCMT ref: 0033A51B
_wcscmp.LIBCMT ref: 0033A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0033A583
_wcscmp.LIBCMT ref: 0033A5BF
GetClassNameW.USER32(?,?,00000400), ref: 0033A5F6
GetDlgCtrlID.USER32(?), ref: 0033A648
GetWindowRect.USER32(?,?), ref: 0033A67E
GetParent.USER32(?), ref: 0033A69C
ScreenToClient.USER32(00000000), ref: 0033A6A3
GetClassNameW.USER32(?,?,00000100), ref: 0033A71D
_wcscmp.LIBCMT ref: 0033A731
GetWindowTextW.USER32(?,?,00000400), ref: 0033A757
_wcscmp.LIBCMT ref: 0033A76B

Part of subcall function 0030362C: _iswctype.LIBCMT ref: 00303634

Strings

%s%u, xrefs: 0033A515

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 5a001c00e4d44b3eb3a94dcaa45e25e3af8670645d44fb0f982780b350a19975
Instruction ID: 687297344b871b58109196fda0270d09858fc8ef52fcf391683a4c46524387fd
Opcode Fuzzy Hash: 5a001c00e4d44b3eb3a94dcaa45e25e3af8670645d44fb0f982780b350a19975
Instruction Fuzzy Hash: 1EA1AF71204A06AFDB16DF64C8C8FAAB7E8FF44354F008629F9D9D6190DB30E955CB92

Function 0033AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0033AF18
_wcscmp.LIBCMT ref: 0033AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 0033AF51
CharUpperBuffW.USER32(?,00000000), ref: 0033AF6E
_wcscmp.LIBCMT ref: 0033AF8C
_wcsstr.LIBCMT ref: 0033AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 0033AFD5
_wcscmp.LIBCMT ref: 0033AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 0033B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 0033B055
_wcscmp.LIBCMT ref: 0033B065
GetClassNameW.USER32(00000010,?,00000400), ref: 0033B08D
GetWindowRect.USER32(00000004,?), ref: 0033B0F6

Strings

ThumbnailClass, xrefs: 0033AFE0, 0033B060
@, xrefs: 0033AEF9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: db3f87d00541311739b4ed3fe7440e810e674d6b9357ae7f16f63ba09d50d992
Instruction ID: ca815623d4b444a8e228e73cd1135c5c2bcdbc0a18c5ef282ab405dc75c1494f
Opcode Fuzzy Hash: db3f87d00541311739b4ed3fe7440e810e674d6b9357ae7f16f63ba09d50d992
Instruction Fuzzy Hash: BB81A1711082059FDB06DF15C8C5FAABBECEF44354F04856AFE858A0A6DB34DD45CBA2

Function 0036C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

DragQueryPoint.SHELL32(?,?), ref: 0036C627

Part of subcall function 0036AB37: ClientToScreen.USER32(?,?), ref: 0036AB60
Part of subcall function 0036AB37: GetWindowRect.USER32(?,?), ref: 0036ABD6
Part of subcall function 0036AB37: PtInRect.USER32(?,?,0036C014), ref: 0036ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0036C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0036C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0036C6BE
_wcscat.LIBCMT ref: 0036C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0036C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0036C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0036C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0036C757
DragFinish.SHELL32(?), ref: 0036C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0036C851

Strings

@GUI_DRAGID, xrefs: 0036C7C9
@GUI_DRAGFILE, xrefs: 0036C800
@GUI_DROPID, xrefs: 0036C77E
pb:, xrefs: 0036C79B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pb:
API String ID: 169749273-1596427179
Opcode ID: 2300672c0650e3301226e40c1b4004c018ade3765522ab40701ea5ad60d224be
Instruction ID: 2612692c0a60d4b948030cdb945dbd0a8cddd460dd48b65688a265218fa815b1
Opcode Fuzzy Hash: 2300672c0650e3301226e40c1b4004c018ade3765522ab40701ea5ad60d224be
Instruction Fuzzy Hash: 27619971108340AFC702EF65DC85DAFBBE8EF89310F40492EF5A5961B1DB709A48CB62

Function 0033ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0033AC33

Strings

[LAST, xrefs: 0033ACE0
LAST, xrefs: 0033ABF8
[REGEXPTITLE:, xrefs: 0033AC5B
REGEXP=, xrefs: 0033AC48
[HANDLE:, xrefs: 0033AC3F
[ACTIVE, xrefs: 0033AC20
[ALL, xrefs: 0033ACD9
HANDLE=, xrefs: 0033AC2C
ACTIVE, xrefs: 0033AC0E
[CLASS:, xrefs: 0033AC83
ALL, xrefs: 0033ACC7
CLASSNAME=, xrefs: 0033AC70

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 10b6fee56b82d98ad55aa6e6ba4feda66cfdba78610d7bef26fc21ad08d4cc2b
Instruction ID: 67a949928b41e8bc9f1025d11fe40ce4befbbf1fb5b134687b1757e45186303a
Opcode Fuzzy Hash: 10b6fee56b82d98ad55aa6e6ba4feda66cfdba78610d7bef26fc21ad08d4cc2b
Instruction Fuzzy Hash: 993139319A8609A7CF03FB50DD93EEE7368AF10750F600028F482B51E1EF116F14CA92

Function 00354FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00355013
LoadCursorW.USER32(00000000,00007F00), ref: 0035501E
LoadCursorW.USER32(00000000,00007F03), ref: 00355029
LoadCursorW.USER32(00000000,00007F8B), ref: 00355034
LoadCursorW.USER32(00000000,00007F01), ref: 0035503F
LoadCursorW.USER32(00000000,00007F81), ref: 0035504A
LoadCursorW.USER32(00000000,00007F88), ref: 00355055
LoadCursorW.USER32(00000000,00007F80), ref: 00355060
LoadCursorW.USER32(00000000,00007F86), ref: 0035506B
LoadCursorW.USER32(00000000,00007F83), ref: 00355076
LoadCursorW.USER32(00000000,00007F85), ref: 00355081
LoadCursorW.USER32(00000000,00007F82), ref: 0035508C
LoadCursorW.USER32(00000000,00007F84), ref: 00355097
LoadCursorW.USER32(00000000,00007F04), ref: 003550A2
LoadCursorW.USER32(00000000,00007F02), ref: 003550AD
LoadCursorW.USER32(00000000,00007F89), ref: 003550B8
GetCursorInfo.USER32(?), ref: 003550C8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 28abb134aa7496650848e71257934bb91737672b0a67c6c5b93801805fdacfbd
Instruction ID: 6291e049f47a9adb231709ec77c1c079780aa31e61e083fdd6c71395f1b97cb4
Opcode Fuzzy Hash: 28abb134aa7496650848e71257934bb91737672b0a67c6c5b93801805fdacfbd
Instruction Fuzzy Hash: D03112B1D483196ADF119FB68C89DAEBFE8FF04750F50452AE50CE7280DA78A504CF91

Function 0036A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036A259
DestroyWindow.USER32(?,?), ref: 0036A2D3

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0036A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0036A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0036A382
DestroyWindow.USER32(00000000), ref: 0036A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,002E0000,00000000), ref: 0036A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0036A3F4
GetDesktopWindow.USER32 ref: 0036A40D
GetWindowRect.USER32(00000000), ref: 0036A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0036A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0036A444

Part of subcall function 002E25DB: GetWindowLongW.USER32(?,000000EB), ref: 002E25EC

Strings

tooltips_class32, xrefs: 0036A346, 0036A3D4
0, xrefs: 0036A26F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 235f904e360dbcb98491849961487fd4d4a27020e5fdcbd7a3a3fb1be50083dd
Instruction ID: cb1f470008fd94a43fcd93c9120b08806f87ac7ff7603423d39c03b7b0763575
Opcode Fuzzy Hash: 235f904e360dbcb98491849961487fd4d4a27020e5fdcbd7a3a3fb1be50083dd
Instruction Fuzzy Hash: 3E71AB71140604AFD726CF28CC48F6A7BE9FB89700F05852DF985972A1DBB5E902CF62

Function 00364392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00364424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0036446F

Strings

ISCHECKED, xrefs: 003645F2
COLLAPSE, xrefs: 003644B5
UNCHECK, xrefs: 0036464B
EXISTS, xrefs: 003644D8
GETITEMCOUNT, xrefs: 00364551
GETSELECTED, xrefs: 0036457F
GETTEXT, xrefs: 003645C2
CHECK, xrefs: 0036448F
SELECT, xrefs: 00364620
EXPAND, xrefs: 00364521
GETTOTALCOUNT, xrefs: 00364456

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 8077626e244cbf1237f6e3e332bf53530e9618425261352311e2675f471e36d1
Instruction ID: 92318e4c7e32c6b36f1baab76da77fab116c0d3ee45be7d9124d16f0db919fa2
Opcode Fuzzy Hash: 8077626e244cbf1237f6e3e332bf53530e9618425261352311e2675f471e36d1
Instruction Fuzzy Hash: B491CE306143419FCB06EF21C492B6EB7E1AF86350F45886DF8965B7A2CB30ED59CB81

Function 0036B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0036B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00366B11,?), ref: 0036B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0036B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0036B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0036B9C3
FreeLibrary.KERNEL32(?), ref: 0036B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0036B9DF
DestroyIcon.USER32(?), ref: 0036B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0036BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0036BA17

Part of subcall function 00302EFD: __wcsicmp_l.LIBCMT ref: 00302F86

Strings

.dll, xrefs: 0036B86D
.exe, xrefs: 0036B84A
.icl, xrefs: 0036B82A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: fb3fae39e30451c01d66fad4e64b05700f531b2532066a6d2f3dcc7af2c80d24
Instruction ID: 8e8779cf5dece158a66b60e1c11993d1b97d31d5a4f4863bb1b495888efb703e
Opcode Fuzzy Hash: fb3fae39e30451c01d66fad4e64b05700f531b2532066a6d2f3dcc7af2c80d24
Instruction Fuzzy Hash: 7561CE71940219BEEB16DF64DC45FBEBBACFB08710F10811AFA15DA1D0DBB49990DBA0

Function 0034A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

CharLowerBuffW.USER32(?,?), ref: 0034A3CB
GetDriveTypeW.KERNEL32 ref: 0034A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0034A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0034A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0034A4C5

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

Strings

close cd wait, xrefs: 0034A4B0
wait, xrefs: 0034A482
close, xrefs: 0034A3D1
set cd door , xrefs: 0034A466
type cdaudio alias cd wait, xrefs: 0034A443
closed, xrefs: 0034A3DF, 0034A3E8
open , xrefs: 0034A427
open, xrefs: 0034A3F2

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 9fe4e0f1e2872b2afb5e698e71750ea555d5416e4569f06ecc3c51d340d8890f
Instruction ID: 5bc4c86f8c0c742c90b162392dbef959c4c79965a54c05bc18375881003ec502
Opcode Fuzzy Hash: 9fe4e0f1e2872b2afb5e698e71750ea555d5416e4569f06ecc3c51d340d8890f
Instruction Fuzzy Hash: C4517D711543459FC701EF11C8919AEB3E8EF95718F40886DF88A97261DB31ED0ACF42

Function 0033F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0031E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0033F8DF
LoadStringW.USER32(00000000,?,0031E029,00000001), ref: 0033F8E8

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0031E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0033F90A
LoadStringW.USER32(00000000,?,0031E029,00000001), ref: 0033F90D
__swprintf.LIBCMT ref: 0033F95D
__swprintf.LIBCMT ref: 0033F96E
_wprintf.LIBCMT ref: 0033FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0033FA2E

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0033FA12
^ ERROR, xrefs: 0033F9C3
Error: , xrefs: 0033F9E5
Line %d:, xrefs: 0033F968
Line %d (File "%s"):, xrefs: 0033F957

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 5ed67210809b15a5183725b6565fed9ecf0d0f242a02e5dcbce3e773c44810f6
Instruction ID: 2ca517cdde8618a78993e603b658a85890ca3632395782b13f3ae16c6482cc22
Opcode Fuzzy Hash: 5ed67210809b15a5183725b6565fed9ecf0d0f242a02e5dcbce3e773c44810f6
Instruction Fuzzy Hash: 69412A72854159AACF06EBE1DD86EEEB77CAF14300F900465F506A60A2EB316F19CF61

Function 0036BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 0036BA56
GetFileSize.KERNEL32(00000000,00000000), ref: 0036BA6D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 0036BA78
CloseHandle.KERNEL32(00000000), ref: 0036BA85
GlobalLock.KERNEL32(00000000), ref: 0036BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0036BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0036BAA6
CloseHandle.KERNEL32(00000000), ref: 0036BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0036BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00372CAC,?), ref: 0036BAD7
GlobalFree.KERNEL32(00000000), ref: 0036BAE7
GetObjectW.GDI32(?,00000018,000000FF), ref: 0036BB0B
CopyImage.USER32(?,00000000,?,?,00002000), ref: 0036BB36
DeleteObject.GDI32(00000000), ref: 0036BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0036BB74

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: c25eb8e95514b898bd23c733403899e5cd4d72f8c9c2e3e0f76b4f32110a64d6
Instruction ID: 9b2c52a4d07d0b8a9b148fbb009e8c07cb81b34b80002276fd0ca52d947eacb9
Opcode Fuzzy Hash: c25eb8e95514b898bd23c733403899e5cd4d72f8c9c2e3e0f76b4f32110a64d6
Instruction Fuzzy Hash: 31410775600208EFDB229FA5EC88EAABBBDFF89711F118068F945D7264D7709941CF60

Function 0034D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0034DA10
_wcscat.LIBCMT ref: 0034DA28
_wcscat.LIBCMT ref: 0034DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0034DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 0034DA63
GetFileAttributesW.KERNEL32(?), ref: 0034DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 0034DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 0034DAA7

Strings

*.*, xrefs: 0034DAE6

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: c8090778febcbd803c53efc1a512e73a704b3f4b7ae6113442c0765b3a222ba8
Instruction ID: 5d9c159fdc3a84e01ad3647fc6fdc09d3591c0ea69e8e08b807e82ce5febf6b5
Opcode Fuzzy Hash: c8090778febcbd803c53efc1a512e73a704b3f4b7ae6113442c0765b3a222ba8
Instruction Fuzzy Hash: AC817F725143419FCB65EF65C844AAAB7E8BF89310F19882EF889CF251E730ED45CB52

Function 0036C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0036C1FC
GetFocus.USER32 ref: 0036C20C
GetDlgCtrlID.USER32(00000000), ref: 0036C217
_memset.LIBCMT ref: 0036C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0036C36D
GetMenuItemCount.USER32(?), ref: 0036C38D
GetMenuItemID.USER32(?,00000000), ref: 0036C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0036C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0036C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0036C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0036C489

Strings

0, xrefs: 0036C33A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: d240a68bee77322bdb58aefe4014413e20b9be628bfab0c2fe7a32875d3d61a1
Instruction ID: 7432c63c8baff6df78e9ece49ead665e9d3bdf49553021d46e373dd5596671eb
Opcode Fuzzy Hash: d240a68bee77322bdb58aefe4014413e20b9be628bfab0c2fe7a32875d3d61a1
Instruction Fuzzy Hash: 49819B702193019FDB13CF15D894A7BBBE8FB89714F11992EF99597291CB70D804CBA2

Function 0035731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0035738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0035739B
CreateCompatibleDC.GDI32(?), ref: 003573A7
SelectObject.GDI32(00000000,?), ref: 003573B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00357408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00357444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00357468
SelectObject.GDI32(00000006,?), ref: 00357470
DeleteObject.GDI32(?), ref: 00357479
DeleteDC.GDI32(00000006), ref: 00357480
ReleaseDC.USER32(00000000,?), ref: 0035748B

Strings

(, xrefs: 00357410

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: de000269143e38e3b8c117151b023207890f31e85abe0254a65448a75a6aecbe
Instruction ID: ae26f4a7fc0c501e28beb59bc56f405c77283922df7f479ca23055079b24586f
Opcode Fuzzy Hash: de000269143e38e3b8c117151b023207890f31e85abe0254a65448a75a6aecbe
Instruction Fuzzy Hash: 39515A75904309EFCB16CFA9DC85EAEBBB9EF48310F14842DF95997220C771A944CB90

Function 002E6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00300957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,002E6B0C,?,00008000), ref: 00300973

Part of subcall function 002E4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002E4743,?,?,002E37AE,?), ref: 002E4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 002E6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 002E6CFA

Part of subcall function 002E586D: _wcscpy.LIBCMT ref: 002E58A5

Part of subcall function 0030363D: _iswctype.LIBCMT ref: 00303645

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0031E496
Unterminated string, xrefs: 0031E7E4
AU3!, xrefs: 002E6B61
Error opening the file, xrefs: 0031E43D, 0031E4B8
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0031E421
Bad directive syntax error, xrefs: 0031E79D
EA06, xrefs: 0031E452

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 2c2e8b1aacab7150aeb5f929d9eea9574893e26296bfff09fc222064b7aa8018
Instruction ID: 3496a4ddbd01491434e8a049e74a5af3b513566112d63767ef68931cf203ee4f
Opcode Fuzzy Hash: 2c2e8b1aacab7150aeb5f929d9eea9574893e26296bfff09fc222064b7aa8018
Instruction Fuzzy Hash: F002DD301183819FC715EF21C891AAFBBE5EF99344F90481DF886972A1DB31D999CF52

Function 00342D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00342D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00342DDD
GetMenuItemCount.USER32(003A5890), ref: 00342E66
DeleteMenu.USER32(003A5890,00000005,00000000,000000F5,?,?), ref: 00342EF6
DeleteMenu.USER32(003A5890,00000004,00000000), ref: 00342EFE
DeleteMenu.USER32(003A5890,00000006,00000000), ref: 00342F06
DeleteMenu.USER32(003A5890,00000003,00000000), ref: 00342F0E
GetMenuItemCount.USER32(003A5890), ref: 00342F16
SetMenuItemInfoW.USER32(003A5890,00000004,00000000,00000030), ref: 00342F4C
GetCursorPos.USER32(?), ref: 00342F56
SetForegroundWindow.USER32(00000000), ref: 00342F5F
TrackPopupMenuEx.USER32(003A5890,00000000,?,00000000,00000000,00000000), ref: 00342F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00342F7E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 31ee881a761ab5d8ea0245c8fd5852d0c04b9c00fff4d46f0d93e94a82c8ea2d
Instruction ID: 0132cd53fa7d5a79197ac69c07a56355783ea973bb243974c96193e1706fce57
Opcode Fuzzy Hash: 31ee881a761ab5d8ea0245c8fd5852d0c04b9c00fff4d46f0d93e94a82c8ea2d
Instruction Fuzzy Hash: 94719F70600205BEEB229F54DC45FABBFA8FB05364F944216F625BE1E1C7B16C60DBA4

Function 003588AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003588D7
CoInitialize.OLE32(00000000), ref: 00358904
CoUninitialize.OLE32 ref: 0035890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00358A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00358B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00372C0C), ref: 00358B6F
CoGetObject.OLE32(?,00000000,00372C0C,?), ref: 00358B92
SetErrorMode.KERNEL32(00000000), ref: 00358BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00358C25
VariantClear.OLEAUT32(?), ref: 00358C35

Strings

,,7, xrefs: 003588C1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,7
API String ID: 2395222682-1335535671
Opcode ID: b847f499822257a9d06776f559699269950a6c015385f4b7884f6d961966956a
Instruction ID: 26cd5741e3316e09b1f60328439c260743a7567091dde5a96a2454f94478b1f7
Opcode Fuzzy Hash: b847f499822257a9d06776f559699269950a6c015385f4b7884f6d961966956a
Instruction Fuzzy Hash: 12C124B1608345AFD701DF24C884D2AB7E9BF89349F00496DF98A9B261DB71ED09CB52

Function 003377DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

_memset.LIBCMT ref: 0033786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003378A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003378BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003378D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00337902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0033792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00337935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0033793A

Strings

SOFTWARE\Classes\, xrefs: 0033780C
\IPC$, xrefs: 00337882
\CLSID, xrefs: 00337822

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 0f6b5af687ff68451a93375da5e4ed5b44a969a909e7853da173ace0aff6a7d3
Instruction ID: d36bb11b5202d68870d4144998178d4a0d7fe71d3a23dcaf029c28a5d99229c8
Opcode Fuzzy Hash: 0f6b5af687ff68451a93375da5e4ed5b44a969a909e7853da173ace0aff6a7d3
Instruction Fuzzy Hash: AB411872C6422DABDF22EBA5DC85DEDB778BF04350F404129E905A71A1DB709D14CF90

Function 00360E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0035FDAD,?,?), ref: 00360E31

Strings

HKEY_CURRENT_CONFIG, xrefs: 00360EEE
HKCR, xrefs: 00360ED9
HKEY_LOCAL_MACHINE, xrefs: 00360E9A
HKEY_CLASSES_ROOT, xrefs: 00360EC4
HKCU, xrefs: 00360F21
HKLM, xrefs: 00360EAF
HKEY_CURRENT_USER, xrefs: 00360F10
HKEY_USERS, xrefs: 00360F32
HKCC, xrefs: 00360EFF
HKU, xrefs: 00360F43

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: fe75e94accd3a2c66de2281710cd35f042545798bb9db8806f67aee29e140032
Instruction ID: 42a170699a13a5c19adb328c0003e307f49baa183c3724c02311532e99d02194
Opcode Fuzzy Hash: fe75e94accd3a2c66de2281710cd35f042545798bb9db8806f67aee29e140032
Instruction Fuzzy Hash: D9418E3561028A8BCF1BEF15D8A6BEF3764AF11304F558419FC551F296DB309E2ACBA0

Function 0033F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0031E2A0,00000010,?,Bad directive syntax error,0036F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0033F7C2
LoadStringW.USER32(00000000,?,0031E2A0,00000010), ref: 0033F7C9

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

_wprintf.LIBCMT ref: 0033F7FC
__swprintf.LIBCMT ref: 0033F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0033F88D

Strings

., xrefs: 0033F873
%s (%d) : ==> %s.: %s %s, xrefs: 0033F7F7
Line %d:, xrefs: 0033F818
Error: , xrefs: 0033F85B
Line %d (File "%s"):, xrefs: 0033F833

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 63be70ed3dac5fffaabc16b2bc246363330bf2a2df6c3bfbce04f5c778639590
Instruction ID: 5ee90116596b7864524c659e3ce64ac46aafe9f7c6b12693437ac26f5636e004
Opcode Fuzzy Hash: 63be70ed3dac5fffaabc16b2bc246363330bf2a2df6c3bfbce04f5c778639590
Instruction Fuzzy Hash: AD216D3295021EAFCF16EF90CC5AEEE7739BF18300F444866F515660A2EB719628DB51

Function 003452C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

Part of subcall function 002E7924: _memmove.LIBCMT ref: 002E79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00345330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00345346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00345357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00345369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0034537A

Strings

close PlayMe, xrefs: 00345341, 0034536E
play PlayMe, xrefs: 00345375
play PlayMe wait, xrefs: 00345364
alias PlayMe, xrefs: 00345309
open , xrefs: 003452DF
status PlayMe mode, xrefs: 0034532B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: e4127ccf12711b00818482a2ade58517c2923d09dd0de54ab108fee74532e043
Instruction ID: 735c1e6e917e7b8460a577fd3eed6e02f77895fd67347cd625a551d8cc169870
Opcode Fuzzy Hash: e4127ccf12711b00818482a2ade58517c2923d09dd0de54ab108fee74532e043
Instruction Fuzzy Hash: 0A118621DA01697ADB21BBA2DC49DFF7BBCEFD2B44F500419B505A60D2DEA01D15C9A0

Function 003446B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 003446D2
gethostname.WSOCK32(?,00000100), ref: 003446EC
gethostbyname.WSOCK32(?), ref: 003446F9
_wcscpy.LIBCMT ref: 00344721
_memmove.LIBCMT ref: 00344734
inet_ntoa.WSOCK32(?), ref: 0034473F
_strcat.LIBCMT ref: 0034474D
_wcscpy.LIBCMT ref: 00344764
WSACleanup.WSOCK32 ref: 00344772
_wcscpy.LIBCMT ref: 00344780

Strings

0.0.0.0, xrefs: 0034471B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 31b8a7c31e8e1171da27fa3bbc6b5d03e162b5ae33d08fa79161bbc8e09c28b8
Instruction ID: 8f41af106a54ea5daa733973f67a11bb302cd23cd90e1a8ec7558c53bff4b06f
Opcode Fuzzy Hash: 31b8a7c31e8e1171da27fa3bbc6b5d03e162b5ae33d08fa79161bbc8e09c28b8
Instruction Fuzzy Hash: 5711D531504114AFDB17AB30AC4AFDA7BFCEB42711F0441B6F5559A091EFB0AE828B50

Function 00344F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00344F7A

Part of subcall function 0030049F: timeGetTime.WINMM(?,75C0B400,002F0E7B), ref: 003004A3

Sleep.KERNEL32(0000000A), ref: 00344FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00344FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00344FEC
SetActiveWindow.USER32 ref: 0034500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00345019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00345038
Sleep.KERNEL32(000000FA), ref: 00345043
IsWindow.USER32 ref: 0034504F
EndDialog.USER32(00000000), ref: 00345060

Strings

BUTTON, xrefs: 00344FDE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: fa2def745c7023737ae2da2716cac0c620f2be8500190971ede1356843a7584c
Instruction ID: 8b451dfcd856ca9d51605a3d49307a283007a2ec4a338f736bf4c277354d8c0e
Opcode Fuzzy Hash: fa2def745c7023737ae2da2716cac0c620f2be8500190971ede1356843a7584c
Instruction Fuzzy Hash: 0D218E74A05605BFE7136F60FC8AB263BADEB47785F095034F1028A1F1CBB1AD54CA62

Function 0034D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

CoInitialize.OLE32(00000000), ref: 0034D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0034D67D
SHGetDesktopFolder.SHELL32(?), ref: 0034D691
CoCreateInstance.OLE32(00372D7C,00000000,00000001,00398C1C,?), ref: 0034D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0034D74C
CoTaskMemFree.OLE32(?,?), ref: 0034D7A4
_memset.LIBCMT ref: 0034D7E1
SHBrowseForFolderW.SHELL32(?), ref: 0034D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0034D840
CoTaskMemFree.OLE32(00000000), ref: 0034D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0034D87E
CoUninitialize.OLE32(00000001,00000000), ref: 0034D880

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: dbcf2790d2951ca5fdc5fd0dca9366b952092be3412b6b4aa0635789eea9490b
Instruction ID: 31a9aa653b53cac2b15d31db7a162fa4a87a3e548243ee5f9d2cd805e4157fe2
Opcode Fuzzy Hash: dbcf2790d2951ca5fdc5fd0dca9366b952092be3412b6b4aa0635789eea9490b
Instruction Fuzzy Hash: 54B1F875A00109AFDB05DFA5C889DAEBBF9FF48314F1484A9E909EB261DB70ED41CB50

Function 0033C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0033C283
GetWindowRect.USER32(00000000,?), ref: 0033C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0033C2F3
GetDlgItem.USER32(?,00000002), ref: 0033C2FE
GetWindowRect.USER32(00000000,?), ref: 0033C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0033C364
GetDlgItem.USER32(?,000003E9), ref: 0033C372
GetWindowRect.USER32(00000000,?), ref: 0033C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0033C3C6
GetDlgItem.USER32(?,000003EA), ref: 0033C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0033C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 0033C3FE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: aa580c0778663310fdfa08ca36ffd251d0a34724b0b1ac38c4abbf0a10cb6b3b
Instruction ID: 1f79dd1ffe976dad0b90b25a24c432a3f43ea8d7d8944200863df1c78ddda94f
Opcode Fuzzy Hash: aa580c0778663310fdfa08ca36ffd251d0a34724b0b1ac38c4abbf0a10cb6b3b
Instruction Fuzzy Hash: EB514175B10205AFDB19CFA9DD89AAEBBBAFB88710F14C52DF515E7290D7B09D008B10

Function 002E201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 002E1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002E2036,?,00000000,?,?,?,?,002E16CB,00000000,?), ref: 002E1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 002E20D3
KillTimer.USER32(-00000001,?,?,?,?,002E16CB,00000000,?,?,002E1AE2,?,?), ref: 002E216E
DestroyAcceleratorTable.USER32(00000000), ref: 0031BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002E16CB,00000000,?,?,002E1AE2,?,?), ref: 0031BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002E16CB,00000000,?,?,002E1AE2,?,?), ref: 0031BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002E16CB,00000000,?,?,002E1AE2,?,?), ref: 0031BD0A
DeleteObject.GDI32(00000000), ref: 0031BD1C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 127915296f7e090fcf19673cfbd5d3f9cc77a5ad119b6fe5935e77accacdaa4c
Instruction ID: ef5e3b5a778dcba4396dbfef0c683042a97e9627955754a66270ac8629d2e092
Opcode Fuzzy Hash: 127915296f7e090fcf19673cfbd5d3f9cc77a5ad119b6fe5935e77accacdaa4c
Instruction Fuzzy Hash: 1461C031160A50DFCB3B9F16D948B29B7F9FF55312F908528E0435A5B0C7B5A8A4CF90

Function 002E21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 002E25DB: GetWindowLongW.USER32(?,000000EB), ref: 002E25EC

GetSysColor.USER32(0000000F), ref: 002E21D3

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 40a69e843c3e3bc1c9f2c6e4edd3d89d3ec9ed0545f45b418cac26213a46328f
Instruction ID: cd98aee9f0021ac23806797024faf43f99e4acb966cd4aaa8711413230d199a3
Opcode Fuzzy Hash: 40a69e843c3e3bc1c9f2c6e4edd3d89d3ec9ed0545f45b418cac26213a46328f
Instruction Fuzzy Hash: D041B231150180DFDB265F29EC88BB93B6EFB06331F548265FE668A1E1C7718C96DB21

Function 0034A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0036F910), ref: 0034A90B
GetDriveTypeW.KERNEL32(00000061,003989A0,00000061), ref: 0034A9D5
_wcscpy.LIBCMT ref: 0034A9FF

Strings

cdrom, xrefs: 0034A927
all, xrefs: 0034A911
ramdisk, xrefs: 0034A97F
network, xrefs: 0034A969
removable, xrefs: 0034A93D
unknown, xrefs: 0034A996
fixed, xrefs: 0034A953

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: ce0334e0c1ed722741379a4e33cef8a1c732a1850398babec17be6bd2c0c9db0
Instruction ID: 2bdeda7fbf3c6d6b47388b57a44466c6f0ed9bd673e11b3034580e4f2f8c61de
Opcode Fuzzy Hash: ce0334e0c1ed722741379a4e33cef8a1c732a1850398babec17be6bd2c0c9db0
Instruction Fuzzy Hash: E151CF315983419FC706EF14C892AAFB7E9EF85304F55482DF4969B2A2DB31AD09CB43

Function 002E9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 002E9862
__swprintf.LIBCMT ref: 002E98AC
__i64tow.LIBCMT ref: 0031F5E6

Strings

False, xrefs: 0031F5AE
%.15g, xrefs: 002E98A6
0x%p, xrefs: 0031F5C8
True, xrefs: 0031F5A7

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 65dae7d5d4d181f3464190cb1a6ef29c800ab71202dec7f04356d10d3e27bf04
Instruction ID: 609331c8f7a550cc92c5de1577015df8e2da6f80461d8a1bb27159434dd181ba
Opcode Fuzzy Hash: 65dae7d5d4d181f3464190cb1a6ef29c800ab71202dec7f04356d10d3e27bf04
Instruction Fuzzy Hash: 1741E771524205AFDB2ADF35DC42EBA73E9FF4A300F60447FE549DB292EA7199818B10

Function 00367152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036716A
CreateMenu.USER32 ref: 00367185
SetMenu.USER32(?,00000000), ref: 00367194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00367221
IsMenu.USER32(?), ref: 00367237
CreatePopupMenu.USER32 ref: 00367241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0036726E
DrawMenuBar.USER32 ref: 00367276

Strings

0, xrefs: 00367160
F, xrefs: 00367262

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 44fb003b057b49ef84096fadd7b52ea3e80b87097ff71f086e1c51e51c32653f
Instruction ID: a531cad0e98d257b56ba6b1f47a7aa06baae260cd8c614d8ead9cc5a04bc6386
Opcode Fuzzy Hash: 44fb003b057b49ef84096fadd7b52ea3e80b87097ff71f086e1c51e51c32653f
Instruction Fuzzy Hash: CF417B74A01205EFDB12DF64E898E9A7BB9FF09314F158429F906A7360D771AD14CF90

Function 003674BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0036755E
CreateCompatibleDC.GDI32(00000000), ref: 00367565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00367578
SelectObject.GDI32(00000000,00000000), ref: 00367580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0036758B
DeleteDC.GDI32(00000000), ref: 00367594
GetWindowLongW.USER32(?,000000EC), ref: 0036759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 003675B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 003675BE

Strings

static, xrefs: 003674F6

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 144ece3eb6fe88b9e5ffd17deb733e89c3274b0d0fa3f4d5cee4d9e8f9b7e4f5
Instruction ID: 2c251b9a616fdf3372e81c9176858c73938143b9b442c4a8e641e0b9e8b8c3a1
Opcode Fuzzy Hash: 144ece3eb6fe88b9e5ffd17deb733e89c3274b0d0fa3f4d5cee4d9e8f9b7e4f5
Instruction Fuzzy Hash: 95315872104215AFDF129F64EC08FEA3B6DEF0A764F118224FA16A60A0D771D821DBA4

Function 00306E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00306E3E

Part of subcall function 00308B28: __getptd_noexit.LIBCMT ref: 00308B28

__gmtime64_s.LIBCMT ref: 00306ED7
__gmtime64_s.LIBCMT ref: 00306F0D
__gmtime64_s.LIBCMT ref: 00306F2A
__allrem.LIBCMT ref: 00306F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00306F9C
__allrem.LIBCMT ref: 00306FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00306FD1
__allrem.LIBCMT ref: 00306FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00307006
__invoke_watson.LIBCMT ref: 00307077

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 41834bac1f9612f2a59831362475ae5397a9bd0d0c78566c2e802b85d92ceaca
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 137107B6E01717ABD716AF68DC62B9AB3B8AF04360F144229F514EB2C1E770ED5087D0

Function 00342527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00342542
GetMenuItemInfoW.USER32(003A5890,000000FF,00000000,00000030), ref: 003425A3
SetMenuItemInfoW.USER32(003A5890,00000004,00000000,00000030), ref: 003425D9
Sleep.KERNEL32(000001F4), ref: 003425EB
GetMenuItemCount.USER32(?), ref: 0034262F
GetMenuItemID.USER32(?,00000000), ref: 0034264B
GetMenuItemID.USER32(?,-00000001), ref: 00342675
GetMenuItemID.USER32(?,?), ref: 003426BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00342700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00342714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00342735

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: becb113584bf572a9bd5d5442350a9238337f962ecce57c39b77c2bea73fde9d
Instruction ID: 21beb85e93109f12de847e7be2c65cae32426b0b4332edc24463eac2dc47dba4
Opcode Fuzzy Hash: becb113584bf572a9bd5d5442350a9238337f962ecce57c39b77c2bea73fde9d
Instruction Fuzzy Hash: 4B618C70900249AFDB13CF64D888EAFBBF8EB42304F954469F842AB251D775BD05DB21

Function 00366F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00366FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00366FA8
GetWindowLongW.USER32(?,000000F0), ref: 00366FCC
_memset.LIBCMT ref: 00366FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00366FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00367067

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 21f60d5ddc5185e6c4ded19758c33e823cb2bf6a3019e631f0a6889fe20f9672
Instruction ID: 388735276c9b83ba632baa84509ee51273abc11075c57c028b8da19665c60f72
Opcode Fuzzy Hash: 21f60d5ddc5185e6c4ded19758c33e823cb2bf6a3019e631f0a6889fe20f9672
Instruction Fuzzy Hash: 22617B75A00208AFDB12DFA4CC81EEE77F8EB09714F10415AFA15EB2A1C775AD45DBA0

Function 00336B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00336BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00336C18
VariantInit.OLEAUT32(?), ref: 00336C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00336C4A
VariantCopy.OLEAUT32(?,?), ref: 00336C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00336CB1
VariantClear.OLEAUT32(?), ref: 00336CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00336CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00336CDC
VariantClear.OLEAUT32(?), ref: 00336CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00336CF9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: ebf2861e1e4c8b4db086208e35a840141f03eaab7a32eaca194a5787d58da552
Instruction ID: 954ba9c8d86cc52129fbaf91fc4223a9809582e1b91b751479b2eab14dbab42e
Opcode Fuzzy Hash: ebf2861e1e4c8b4db086208e35a840141f03eaab7a32eaca194a5787d58da552
Instruction Fuzzy Hash: 97413075A00119AFCF02DFA9D8859AEBBB9EF08354F00C069E955EB261CB70E945CF90

Function 00355732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00355793
inet_addr.WSOCK32(?), ref: 003557D8
gethostbyname.WSOCK32(?), ref: 003557E4
IcmpCreateFile.IPHLPAPI ref: 003557F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00355862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00355878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 003558ED
WSACleanup.WSOCK32 ref: 003558F3

Strings

Ping, xrefs: 00355816

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 6c28a0671f46913c1051ba78da911a9f5eb713f6f098f3dadfd0fcd7ac8a7c69
Instruction ID: 2bcb60271b6ecc3d673b813d70da1f600c6f9267523351e2ca55c087896b60b0
Opcode Fuzzy Hash: 6c28a0671f46913c1051ba78da911a9f5eb713f6f098f3dadfd0fcd7ac8a7c69
Instruction Fuzzy Hash: CF518D716446009FDB12EF25DC95F2AB7E8EF49721F04892AF956DB2A1DB70E804CF42

Function 0034B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0034B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0034B546
GetLastError.KERNEL32 ref: 0034B550
SetErrorMode.KERNEL32(00000000,READY), ref: 0034B5BD

Strings

READONLY, xrefs: 0034B588
NOTREADY, xrefs: 0034B57C
READY, xrefs: 0034B596
UNKNOWN, xrefs: 0034B575
INVALID, xrefs: 0034B58F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: b3fcef36202f4747b9c3b35f298413d6a8a2310a34d84ba3adde391caddf8a18
Instruction ID: 15c35b8047283f3f7ed99dd1d7c25467bbd4caa7d6f58309595d3ea205d0a84c
Opcode Fuzzy Hash: b3fcef36202f4747b9c3b35f298413d6a8a2310a34d84ba3adde391caddf8a18
Instruction Fuzzy Hash: 37318335A40209DFCB02EB68D845AADF7F8FF46310F1441A5E505DB291DB71EA52CB51

Function 00338F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 0033AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0033AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00339014
GetDlgCtrlID.USER32 ref: 0033901F
GetParent.USER32 ref: 0033903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 0033903E
GetDlgCtrlID.USER32(?), ref: 00339047
GetParent.USER32(?), ref: 00339063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00339066

Strings

ComboBox, xrefs: 00338F9C
ListBox, xrefs: 00338FD1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 384199b36eb9cba558514e6ba2720be191e399fbb8fa080dd9bec5b5b8033cb4
Instruction ID: 6d514194c37426359f2f704cb2d666c0fab8a6af0cefacff5520155d45aad822
Opcode Fuzzy Hash: 384199b36eb9cba558514e6ba2720be191e399fbb8fa080dd9bec5b5b8033cb4
Instruction Fuzzy Hash: 4921C170A04108BFDF06ABA0CC85EFEBB78EF49310F10415AF961972A1DBB59819DA20

Function 0033907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 0033AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0033AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 003390FD
GetDlgCtrlID.USER32 ref: 00339108
GetParent.USER32 ref: 00339124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00339127
GetDlgCtrlID.USER32(?), ref: 00339130
GetParent.USER32(?), ref: 0033914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 0033914F

Strings

ComboBox, xrefs: 00339087
ListBox, xrefs: 003390BC

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 452e4ca03c4a661c05fda65e71de2503eb65839155457cf5dd208db226a7e388
Instruction ID: 36e902b9916b5de5d05521dfd9140d491d60a5055c0f794ec778c7785b2b224f
Opcode Fuzzy Hash: 452e4ca03c4a661c05fda65e71de2503eb65839155457cf5dd208db226a7e388
Instruction Fuzzy Hash: F621D374E40108BFDF02ABA1CC85EFEBB78EF44300F004016F961972A2DBB58815DA20

Function 00339163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0033916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00339184
_wcscmp.LIBCMT ref: 00339196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00339211

Strings

SHELLDLL_DefView, xrefs: 00339190
smallicons, xrefs: 003391D9
list, xrefs: 003391F3
details, xrefs: 003391BF
largeicons, xrefs: 003391A5

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 5f180415de343ca0ae77d2f2af0c59c9763532e7136b0804dbb76b80803954f1
Instruction ID: 163504216de0558fdfe0a57684a77e7114743826939843031e356b5d2057dd2f
Opcode Fuzzy Hash: 5f180415de343ca0ae77d2f2af0c59c9763532e7136b0804dbb76b80803954f1
Instruction Fuzzy Hash: 4211063628C70BFAFE132624EC5AEE7379CDB15760F200427F910E44E2EFE1A8515A94

Function 00347990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00347A6C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 4e2e4deb8546b527d8e2a180de2b0eda8ac4403e4edad8157a67151e0988b948
Instruction ID: 92ea874e67bbc6677dd88013e7110a7edb8af24d616c3a4930745d9d24427239
Opcode Fuzzy Hash: 4e2e4deb8546b527d8e2a180de2b0eda8ac4403e4edad8157a67151e0988b948
Instruction Fuzzy Hash: 17B17D719082099FDB12DFA4D884BBEB7F9EF09321F214469E501AF291D774ED41CBA0

Function 003411CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003411F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00340268,?,00000001), ref: 00341204
GetWindowThreadProcessId.USER32(00000000), ref: 0034120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00340268,?,00000001), ref: 0034121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0034122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00340268,?,00000001), ref: 00341245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00340268,?,00000001), ref: 00341257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00340268,?,00000001), ref: 0034129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00340268,?,00000001), ref: 003412B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00340268,?,00000001), ref: 003412BC

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: ac418f24041e23487822adf5be1cccd2194097acb14c78a11d0e6d32ef9747d5
Instruction ID: bbd6952d4d72c1c486c871a144b0eec1697ac832c3e82fc4ba5a6327f7389a96
Opcode Fuzzy Hash: ac418f24041e23487822adf5be1cccd2194097acb14c78a11d0e6d32ef9747d5
Instruction Fuzzy Hash: 5E31CC75600A04BFDB239F54EC89F6A37EDEB56311F168525F900CA2A0E7F4AD808B61

Function 002EFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 002EFAA6
OleUninitialize.OLE32(?,00000000), ref: 002EFB45
UnregisterHotKey.USER32(?), ref: 002EFC9C
DestroyWindow.USER32(?), ref: 003245D6
FreeLibrary.KERNEL32(?), ref: 0032463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00324668

Strings

close all, xrefs: 002EFAA1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 11e0cec7bc92f7e1749630e3cbbe14d7b801087f1ee2cd89ea91e4f9bc0bf824
Instruction ID: 6b40ee4d60716be2df40a8cf1b3c5399e93e22c5b96acd108d3c0bb5695075c3
Opcode Fuzzy Hash: 11e0cec7bc92f7e1749630e3cbbe14d7b801087f1ee2cd89ea91e4f9bc0bf824
Instruction Fuzzy Hash: E7A18030711222CFCB6AEF15D595B69F364BF05704F6142ADE80AAB261DB30ED26CF90

Function 00359113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00359167
VariantInit.OLEAUT32(?), ref: 00359238
VariantInit.OLEAUT32(?), ref: 00359339
VariantClear.OLEAUT32(?), ref: 00359343
VariantClear.OLEAUT32(?), ref: 003593A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0035931C
,,7, xrefs: 003591E5
Null Object assignment in FOR..IN loop, xrefs: 003591C8, 003592F6, 003593AE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,7$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-4117717696
Opcode ID: b9362d6efb03de79369bb971e160eee273f436d8b8aaec9bc6bf68ae9d19929b
Instruction ID: 1ba16bcc337376cd831bade4b8a6cae2e1840c94cd1bc48a03c7ecb6180aeaac
Opcode Fuzzy Hash: b9362d6efb03de79369bb971e160eee273f436d8b8aaec9bc6bf68ae9d19929b
Instruction Fuzzy Hash: 7591A571900219EBDF26CF95C848FAF77B8EF45711F10855AF915AB2A0D7709944CFA0

Function 0033A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0033A439), ref: 0033A377

Strings

INSTANCE, xrefs: 0033A285
NAME, xrefs: 0033A1A9
CLASS, xrefs: 0033A0F6
TEXT, xrefs: 0033A2AE
CLASSNN, xrefs: 0033A119
REGEXPCLASS, xrefs: 0033A13C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: a463f287dcce4c57b9df970f9d96dd16053055d395ba32f6b8eed48b4f21ea54
Instruction ID: fbcca68f72847d7cd96bb714f0d56b94d9f0da180b6d02bd5a8e063d354a47c4
Opcode Fuzzy Hash: a463f287dcce4c57b9df970f9d96dd16053055d395ba32f6b8eed48b4f21ea54
Instruction Fuzzy Hash: 0891E930A04A05ABCF0ADFA0C4D5BEEFB78FF04310F548519E499A7191DF316A99CB91

Function 002E2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 002E2EAE

Part of subcall function 002E1DB3: GetClientRect.USER32(?,?), ref: 002E1DDC
Part of subcall function 002E1DB3: GetWindowRect.USER32(?,?), ref: 002E1E1D
Part of subcall function 002E1DB3: ScreenToClient.USER32(?,?), ref: 002E1E45

GetDC.USER32 ref: 0031CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0031CD45
SelectObject.GDI32(00000000,00000000), ref: 0031CD53
SelectObject.GDI32(00000000,00000000), ref: 0031CD68
ReleaseDC.USER32(?,00000000), ref: 0031CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0031CDFB

Strings

U, xrefs: 0031CCD0

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 6b1594820c8fd11877b782b261d58cb0af117bb18fa69bbba4e105c81b86f1ea
Instruction ID: a18c230fe6f20ecbc36e5a72eb4e4ea2821c86ad0703180f24edfa5afd1a8561
Opcode Fuzzy Hash: 6b1594820c8fd11877b782b261d58cb0af117bb18fa69bbba4e105c81b86f1ea
Instruction Fuzzy Hash: 81710330550205DFCF2A8F64DC80AEA7BB9FF4D310F18527AED565A2A6C7319C91DB60

Function 00351A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00351A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00351A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00351ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00351AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00351AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00351B10
InternetCloseHandle.WININET(00000000), ref: 00351B57

Part of subcall function 00352483: GetLastError.KERNEL32(?,?,00351817,00000000,00000000,00000001), ref: 00352498
Part of subcall function 00352483: SetEvent.KERNEL32(?,?,00351817,00000000,00000000,00000001), ref: 003524AD

Strings

, xrefs: 00351B01

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 155645c334c2f03a5e06ee7ab72a54edf299f00734a9fb9398da59e253815f39
Instruction ID: 6d065d4aad608b8effabf3082810cd76355ed96dcc875faa8315f20c08d2044c
Opcode Fuzzy Hash: 155645c334c2f03a5e06ee7ab72a54edf299f00734a9fb9398da59e253815f39
Instruction Fuzzy Hash: 3D4160B1501218BFEB139F50DC85FBB7BADEF09355F008126FD059A161E7B49E489BA0

Function 00358C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0036F910), ref: 00358D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0036F910), ref: 00358D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00358ED6
SysFreeString.OLEAUT32(?), ref: 00358F00

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 396df7977f9b431649d5c44e09c4d80ad59b10faa5bbef3b1227d9c70e43bb75
Instruction ID: 8374c846ce772b12f0a85a23cb38d35a5ce1439bcc27030ec8401b73fd40a996
Opcode Fuzzy Hash: 396df7977f9b431649d5c44e09c4d80ad59b10faa5bbef3b1227d9c70e43bb75
Instruction Fuzzy Hash: 8EF14A71A00209EFDF05DF94C884EAEB7B9FF49315F118499F905AB261DB31AE4ACB50

Function 0035F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0035F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0035F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0035F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0035F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0035F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0035FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0035FA7C
CloseHandle.KERNEL32(?), ref: 0035FAAB
CloseHandle.KERNEL32(?), ref: 0035FB22

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 4bcd192293095f1524c9de8f9258c5648103a1fa087163f42860b6d89963688e
Instruction ID: dca5e55b7398e524066d67a33b2ffd641d6c183963215bcb22a5a1e9818548c3
Opcode Fuzzy Hash: 4bcd192293095f1524c9de8f9258c5648103a1fa087163f42860b6d89963688e
Instruction Fuzzy Hash: A2E19F316042409FC716EF24C891F6ABBE5AF85354F14896DF8999F2A2CB31EC45CF52

Function 00344CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0034466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00343697,?), ref: 0034468B

Part of subcall function 0034466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00343697,?), ref: 003446A4

Part of subcall function 00344A31: GetFileAttributesW.KERNEL32(?,0034370B), ref: 00344A32

lstrcmpiW.KERNEL32(?,?), ref: 00344D40
_wcscmp.LIBCMT ref: 00344D5A
MoveFileW.KERNEL32(?,?), ref: 00344D75

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 281c923d6085e258eade913cb5204305940337cf7cf01cf3b2e77b180372f286
Instruction ID: 2a460fce6bac61ebb3d37e5b268560e453073b78ee8df88067efc0c1705cdb8b
Opcode Fuzzy Hash: 281c923d6085e258eade913cb5204305940337cf7cf01cf3b2e77b180372f286
Instruction Fuzzy Hash: 355165B24083859BC726DB90D891ADFB3ECAF85350F40492EF685D7152EF34B588CB56

Function 00368645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 003686FF

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 67b9eb36d5e5c2fbc5631fa0792a0e588c26307420ac0dece9cd0b91fff9fd40
Instruction ID: 612bfbac9b79a17d195d32cad42af3859208aba9c98cf96831b90d928227a15d
Opcode Fuzzy Hash: 67b9eb36d5e5c2fbc5631fa0792a0e588c26307420ac0dece9cd0b91fff9fd40
Instruction Fuzzy Hash: 8651B330600244BFDB229F24DC85FAD7B68FB09310F60C311FA55E61A4CFB1A990CB51

Function 002E2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0031C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0031C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0031C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0031C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0031C370
DestroyIcon.USER32(00000000), ref: 0031C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0031C39C
DestroyIcon.USER32(?), ref: 0031C3AB

Part of subcall function 0036A4AF: DeleteObject.GDI32(00000000), ref: 0036A4E8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 0d7cb8850bba6f6adaf729b96e4d61b0b2fd55c25af7dd7653c80c708204e89f
Instruction ID: de7482655931de8d8423f2a8fa81c138a420aab32523d8ba130d550e9bc33c23
Opcode Fuzzy Hash: 0d7cb8850bba6f6adaf729b96e4d61b0b2fd55c25af7dd7653c80c708204e89f
Instruction Fuzzy Hash: BD518D746A0245EFDB25DF65DC45FAA37B9FB08310F504528F912972A0DBB0ECA0DB60

Function 0033966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0033A84C
Part of subcall function 0033A82C: GetCurrentThreadId.KERNEL32 ref: 0033A853
Part of subcall function 0033A82C: AttachThreadInput.USER32(00000000,?,00339683,?,00000001), ref: 0033A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 0033968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 003396AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 003396AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 003396B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 003396D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 003396D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 003396E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 003396F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 003396FB

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: c466abf951c5e06956074d7549a73632d7b30ce2d810f577ae19afc16fd67ee0
Instruction ID: 9f3470bc89c9aaafea05a9fdd11e205fca1d493773b3831c73c82f6e1c0c3e37
Opcode Fuzzy Hash: c466abf951c5e06956074d7549a73632d7b30ce2d810f577ae19afc16fd67ee0
Instruction Fuzzy Hash: AA11E1B1910618BEF6126F60EC8EF6A7F2DEB4C7A0F104425F244AB0A0C9F35C10DAA4

Function 00338921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0033853C,00000B00,?,?), ref: 0033892A
HeapAlloc.KERNEL32(00000000,?,0033853C,00000B00,?,?), ref: 00338931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0033853C,00000B00,?,?), ref: 00338946
GetCurrentProcess.KERNEL32(?,00000000,?,0033853C,00000B00,?,?), ref: 0033894E
DuplicateHandle.KERNEL32(00000000,?,0033853C,00000B00,?,?), ref: 00338951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0033853C,00000B00,?,?), ref: 00338961
GetCurrentProcess.KERNEL32(0033853C,00000000,?,0033853C,00000B00,?,?), ref: 00338969
DuplicateHandle.KERNEL32(00000000,?,0033853C,00000B00,?,?), ref: 0033896C
CreateThread.KERNEL32(00000000,00000000,00338992,00000000,00000000,00000000), ref: 00338986

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 6e76cfe012066118c87080d0299d43b428f1e5d5ffd0c37588ca91cb8b705909
Instruction ID: 0c63fc51febdcc19b20d9a81a64464481872c5e5953944ba3862753a9ff9aa01
Opcode Fuzzy Hash: 6e76cfe012066118c87080d0299d43b428f1e5d5ffd0c37588ca91cb8b705909
Instruction Fuzzy Hash: F401BBB5240308FFE711ABA5EC4DF6B3BACEB89751F408421FA05DB1A1CAB19810CB20

Function 00359B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00359BA4, 00359EC8
Not an Object type, xrefs: 00359B7B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 029a76455c358d77074060838f1bf712a0e0a0ed9d3bb6e8b4387135635bbd0f
Instruction ID: 9984cc2eda1d6ac7a1e3db7cf5df0b9348ba53ee46e9a43f492fa58728159b70
Opcode Fuzzy Hash: 029a76455c358d77074060838f1bf712a0e0a0ed9d3bb6e8b4387135635bbd0f
Instruction Fuzzy Hash: 5DC19271A00209DFDF12DF58D885FAEB7F9EB48311F15846AED05AB2A0E7709D49CB90

Function 0035975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 0033710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?,?,?,00337455), ref: 00337127
Part of subcall function 0033710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?,?), ref: 00337142
Part of subcall function 0033710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?,?), ref: 00337150
Part of subcall function 0033710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?), ref: 00337160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00359806
_memset.LIBCMT ref: 00359813
_memset.LIBCMT ref: 00359956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00359982
CoTaskMemFree.OLE32(?), ref: 0035998D

Strings

NULL Pointer assignment, xrefs: 003599DB

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: ffe8281b80d49d05eaaa68cd7e2ab4859681ec57cf1333c6fa60d470a011c55e
Instruction ID: 478379552a7549359d609d531853c031b08fa12307f17b61488865df200dbadb
Opcode Fuzzy Hash: ffe8281b80d49d05eaaa68cd7e2ab4859681ec57cf1333c6fa60d470a011c55e
Instruction Fuzzy Hash: B5912A71D00269EBDB11DFA5DC85EDEBBB9BF08310F10415AF819AB291DB719A44CFA0

Function 00366D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00366E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00366E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00366E52
_wcscat.LIBCMT ref: 00366EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00366EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00366EF2

Strings

SysListView32, xrefs: 00366DF6

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: bc033e6379a7ff538f8be92b6dfbce7bd05ff4cdc26ea54f98b3ec890532d5d5
Instruction ID: 5ab4ef27bc93c018a64d96b4bf5810af16da437462d025b4cf59cc449aee5235
Opcode Fuzzy Hash: bc033e6379a7ff538f8be92b6dfbce7bd05ff4cdc26ea54f98b3ec890532d5d5
Instruction Fuzzy Hash: D4418275A00348AFDF22DF64CC86BEEB7E9EF08390F11842AF555E7191D6729D848B60

Function 0035E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00343C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00343C7A
Part of subcall function 00343C55: Process32FirstW.KERNEL32(00000000,?), ref: 00343C88
Part of subcall function 00343C55: CloseHandle.KERNEL32(00000000), ref: 00343D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0035E9A4
GetLastError.KERNEL32 ref: 0035E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0035E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0035EA63
GetLastError.KERNEL32(00000000), ref: 0035EA6E
CloseHandle.KERNEL32(00000000), ref: 0035EAA3

Strings

SeDebugPrivilege, xrefs: 0035E9C2

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 7552b67a611ecebf49a0a398809fa47fda2188018d647e297d99ac830bca70c6
Instruction ID: fe02a32d217075d6cf987bdd2c32d2161dce291505ec06f1fc73a9ac91ce87d2
Opcode Fuzzy Hash: 7552b67a611ecebf49a0a398809fa47fda2188018d647e297d99ac830bca70c6
Instruction Fuzzy Hash: BB41BE712002019FDB16EF24DC96F6EB7A9AF41314F148459F9029F2E2CBB4A958CF92

Function 00342F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00343033

Strings

stop, xrefs: 00343004
blank, xrefs: 00342FB5
warning, xrefs: 0034301C
question, xrefs: 00342FEC
info, xrefs: 00342FD4

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: b74d719babd1e714ea134fc921a2297c55e723915f85671c0c0f64cbde98983e
Instruction ID: f00f1ad879e299e75beefa7efaa2a367d2d02d974b8e1497ceab0d67a4b498f7
Opcode Fuzzy Hash: b74d719babd1e714ea134fc921a2297c55e723915f85671c0c0f64cbde98983e
Instruction Fuzzy Hash: 2D112B31388346BEEB179B14DC42CAB77DC9F16360B20012AF901AF5C1DBB17F4456A5

Function 003442F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00344312
LoadStringW.USER32(00000000), ref: 00344319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0034432F
LoadStringW.USER32(00000000), ref: 00344336
_wprintf.LIBCMT ref: 0034435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0034437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00344357

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 8a2c8b3debc8d25013a93b62405b747a1520b67cc94d12ea2e3f44ce1cb958f2
Instruction ID: e668abb54b7f466fefae140aed8aa4a5fbcbf48457a4502e20a2a085e01da27f
Opcode Fuzzy Hash: 8a2c8b3debc8d25013a93b62405b747a1520b67cc94d12ea2e3f44ce1cb958f2
Instruction Fuzzy Hash: 0D014FF6904208BFE752ABA0ED89EE677ACEB08700F0045A2F745E6051EAB45E954B70

Function 0036D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

GetSystemMetrics.USER32(0000000F), ref: 0036D47C
GetSystemMetrics.USER32(0000000F), ref: 0036D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0036D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0036D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0036D716
ShowWindow.USER32(00000003,00000000), ref: 0036D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0036D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 0036D77D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 812bb7aad41e3bb1b89aa16cd5601fe08f38049127cbe52bdb9730c35c974846
Instruction ID: c3003022e745903fbfaac28a6b45c0617f221be90bc86eff0ace89f280412f95
Opcode Fuzzy Hash: 812bb7aad41e3bb1b89aa16cd5601fe08f38049127cbe52bdb9730c35c974846
Instruction Fuzzy Hash: FBB1A930A00225EFDF16CF68C9857AD7BB5BF08701F09C069EC499F699DB74A950CBA0

Function 002E2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0031C1C7,00000004,00000000,00000000,00000000), ref: 002E2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0031C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 002E2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0031C1C7,00000004,00000000,00000000,00000000), ref: 0031C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0031C1C7,00000004,00000000,00000000,00000000), ref: 0031C286

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 4b0ed00d0af3b8ea3bccf0a30944168714710e0673f8c85d3b2f9479b362ff7b
Instruction ID: a39899f65b61c2f4ce315ebe1ca2745a293fbeb7217124aba5d7bf1458665689
Opcode Fuzzy Hash: 4b0ed00d0af3b8ea3bccf0a30944168714710e0673f8c85d3b2f9479b362ff7b
Instruction Fuzzy Hash: 8E412D312B46C1DFCB3A9F2ADC8877A7B9DBB45300F94883DE08746660C6B098E9D710

Function 003470C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 003470DD

Part of subcall function 00300DB6: std::exception::exception.LIBCMT ref: 00300DEC
Part of subcall function 00300DB6: __CxxThrowException@8.LIBCMT ref: 00300E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00347114
EnterCriticalSection.KERNEL32(?), ref: 00347130
_memmove.LIBCMT ref: 0034717E
_memmove.LIBCMT ref: 0034719B
LeaveCriticalSection.KERNEL32(?), ref: 003471AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 003471BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 003471DE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 6716ba2e1b9b82d4be9297d899e94d45ee451d82b9d2365d58545be4c7018162
Instruction ID: 6e55f3a0c0a82c76dc29af052534006ecea2353b476e08f0a7a46358ca94028c
Opcode Fuzzy Hash: 6716ba2e1b9b82d4be9297d899e94d45ee451d82b9d2365d58545be4c7018162
Instruction Fuzzy Hash: ED316D35900205EFCB06DFA4DD85AAEB7B8FF45310F1481A5E904AF286DB70AA10CBA0

Function 003661D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 003661EB
GetDC.USER32(00000000), ref: 003661F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003661FE
ReleaseDC.USER32(00000000,00000000), ref: 0036620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00366246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00366257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0036902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00366291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 003662B1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: aae2b8ab85026a80c5d0a3c8cef481d29b24a4cdc4e9d17ab607b25dbea0484a
Instruction ID: 9a775ddd026ab5ddf5f0df8144470064217f0660a0154877da7e4d547210b698
Opcode Fuzzy Hash: aae2b8ab85026a80c5d0a3c8cef481d29b24a4cdc4e9d17ab607b25dbea0484a
Instruction Fuzzy Hash: 52314F72101214BFEB128F50DC8AFEA3BADEF4A765F058065FE089A1A1C6B59C41CB74

Function 0033BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0033BBC4
_memcmp.LIBCMT ref: 0033BBE6
_memcmp.LIBCMT ref: 0033BBFE
_memcmp.LIBCMT ref: 0033BC11
_memcmp.LIBCMT ref: 0033BC2B
_memcmp.LIBCMT ref: 0033BC3E
_memcmp.LIBCMT ref: 0033BC56
_memcmp.LIBCMT ref: 0033BC71

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 466c80b357a84131816f3baaf1ad645548985f0f2944ebef3d506a5bc575d26f
Instruction ID: a4c5ab6b98dabf9eb065a50749af63b1e1b52e3c64980519dd8cb5e9aaef6c1b
Opcode Fuzzy Hash: 466c80b357a84131816f3baaf1ad645548985f0f2944ebef3d506a5bc575d26f
Instruction Fuzzy Hash: 0E2199616012067BE6276A129DD2FFFF76D9E10388F058024FF099A697EF58DE1182B1

Function 0034EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

Part of subcall function 002FFC86: _wcscpy.LIBCMT ref: 002FFCA9

_wcstok.LIBCMT ref: 0034EC94
_wcscpy.LIBCMT ref: 0034ED23
_memset.LIBCMT ref: 0034ED56

Strings

X, xrefs: 0034ED93

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: fee707aa5828cad852e2ee22c30a1bf7398f368c43fad09f029fe6e2abdb1e6d
Instruction ID: 4c590a8230d5dba7635fec90587e68179605a0fb4c771701ac23283148c901a1
Opcode Fuzzy Hash: fee707aa5828cad852e2ee22c30a1bf7398f368c43fad09f029fe6e2abdb1e6d
Instruction Fuzzy Hash: E9C19D315183409FC725EF24C881AAAB7E4FF85314F50492DF89A9B2A2DB70EC55CF82

Function 002E1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42542ad7ab98834322ae6fdaaeff064b2f791ab179e292c82b033e3c0a2427ac
Instruction ID: 3bf804611fe31152e1202027b67ef5fcf2e71f8e4530764a50e3b4d5ab24b491
Opcode Fuzzy Hash: 42542ad7ab98834322ae6fdaaeff064b2f791ab179e292c82b033e3c0a2427ac
Instruction Fuzzy Hash: 6F719D30910149EFCB05CF99CC48EBEBB78FF89310F508169F915AA291D770AA61CF60

Function 00356B76 Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adeaf36736f03bb75893d185591d1250d4f2c015d0d8298a4782925c01c6f994
Instruction ID: 7a86d76e3af1a0a9dd0cc980b8d7f9cfbec36e4b946863fcb045d1b4c310b14f
Opcode Fuzzy Hash: adeaf36736f03bb75893d185591d1250d4f2c015d0d8298a4782925c01c6f994
Instruction Fuzzy Hash: 7E61AF71208340AFD711EB25DC82E6FB7F8AF84714F90492DF9959B2A2DB709D04CB92

Function 0036B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00FD6B68), ref: 0036B3EB
IsWindowEnabled.USER32(00FD6B68), ref: 0036B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0036B4DB
SendMessageW.USER32(00FD6B68,000000B0,?,?), ref: 0036B512
IsDlgButtonChecked.USER32(?,?), ref: 0036B54F
GetWindowLongW.USER32(00FD6B68,000000EC), ref: 0036B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0036B589

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 56571f4d977f05b3b7d375d6ac53cdaeb951f63db675f62499642922bdd4c7f6
Instruction ID: b32b0cca46b9cefe77da3d40f22df18470fa0c5be87c44e2f509d6c63cb67dbf
Opcode Fuzzy Hash: 56571f4d977f05b3b7d375d6ac53cdaeb951f63db675f62499642922bdd4c7f6
Instruction Fuzzy Hash: 18717034604204EFDB239F55C894FBAB7B9EF0A300F15C059E956D7266CB72A991CF50

Function 0035F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0035F448
_memset.LIBCMT ref: 0035F511
ShellExecuteExW.SHELL32(?), ref: 0035F556

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

Part of subcall function 002FFC86: _wcscpy.LIBCMT ref: 002FFCA9

GetProcessId.KERNEL32(00000000), ref: 0035F5CD
CloseHandle.KERNEL32(00000000), ref: 0035F5FC

Strings

@, xrefs: 0035F525

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: a38bdffe2007586079225ddaac4f849e3b196d4c21186e648aeb3c6e587a58ad
Instruction ID: 9c95d44102a07f42d095131debbf7280dc2577d7995772c5ceb738b00300dd04
Opcode Fuzzy Hash: a38bdffe2007586079225ddaac4f849e3b196d4c21186e648aeb3c6e587a58ad
Instruction Fuzzy Hash: 7861BEB5A006199FCB06EF65C4819AEBBF5FF49310F14846AE856AB361CB30AD55CF80

Function 00340F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00340F8C
GetKeyboardState.USER32(?), ref: 00340FA1
SetKeyboardState.USER32(?), ref: 00341002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00341030
PostMessageW.USER32(?,00000101,00000011,?), ref: 0034104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00341095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 003410B8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 246d7219cf74b5d79c68c9ae65e1bfaa2b5192e6d358024cb309f7d468ca29f6
Instruction ID: 577023f3fdc3bd305efba773456f5daa8ee6b381c20e4a4f814fabe2b8cf6c7e
Opcode Fuzzy Hash: 246d7219cf74b5d79c68c9ae65e1bfaa2b5192e6d358024cb309f7d468ca29f6
Instruction Fuzzy Hash: B751C2A0604BD53DFB3742348C45BB6BFE96B06304F098589E2D58E8D2D2E9BCD8D751

Function 00340D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00340DA5
GetKeyboardState.USER32(?), ref: 00340DBA
SetKeyboardState.USER32(?), ref: 00340E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00340E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00340E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00340EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00340EC9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7e478fe98468b716356f05a23bbff5b11dcc085baeef032aff84d5d556890204
Instruction ID: 61e72fa94efe2eb91677742e30a90a2e1746da814385853ad08b0c5ac08d8a76
Opcode Fuzzy Hash: 7e478fe98468b716356f05a23bbff5b11dcc085baeef032aff84d5d556890204
Instruction Fuzzy Hash: 7D51D7A0A44BD57DFB3B47748C55B7A7ED95B06300F088889E2D49E4C2D3A5BCD8E750

Function 003455FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0034560A
_wcsncpy.LIBCMT ref: 0034563F
_wcsncpy.LIBCMT ref: 00345671
_wcsncpy.LIBCMT ref: 003456A4
_wcsncpy.LIBCMT ref: 003456E6
_wcsncpy.LIBCMT ref: 00345720
_wcsncpy.LIBCMT ref: 0034574F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 0315c183138b348514b6f25f00428f334da2cb3721d4ba78eeda4f90662f9771
Instruction ID: f6577c0f532d5a7981ee2fda0bb93140f93766188cd5a39cca178d40f423093f
Opcode Fuzzy Hash: 0315c183138b348514b6f25f00428f334da2cb3721d4ba78eeda4f90662f9771
Instruction Fuzzy Hash: D641A365C1161876CB13EBF48C4A9CFB7BC9F05310F508966E609E7262EA34B345C7E6

Function 0033D56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0033D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0033D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0033D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0033D69D

Strings

,,7, xrefs: 0033D578
DllGetClassObject, xrefs: 0033D610

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,7$DllGetClassObject
API String ID: 753597075-2297170642
Opcode ID: cf494ec7a496e52031dbfdb8909500a3a85b7bab73e260758443acd15cc70198
Instruction ID: f4c4b9e238f7257767ecad3f274dffd700fb4972d899a30126ba02ada5044d00
Opcode Fuzzy Hash: cf494ec7a496e52031dbfdb8909500a3a85b7bab73e260758443acd15cc70198
Instruction Fuzzy Hash: 28418CB1600204EFDB16CF64E8C5A9ABBB9EF45310F5681A9FD099F205D7B1DE44CBA0

Function 00343671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0034466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00343697,?), ref: 0034468B

Part of subcall function 0034466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00343697,?), ref: 003446A4

lstrcmpiW.KERNEL32(?,?), ref: 003436B7
_wcscmp.LIBCMT ref: 003436D3
MoveFileW.KERNEL32(?,?), ref: 003436EB
_wcscat.LIBCMT ref: 00343733
SHFileOperationW.SHELL32(?), ref: 0034379F

Strings

\*.*, xrefs: 0034372D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 93f1d33e5f9b0f0fe46a3d1581cde3bc686661411dbb0a268ce9a9d4e6e7bf04
Instruction ID: 65c357e7cc878401c4a4aabdc22e87c2b9f78b53851ff5e514e43bb0466544e7
Opcode Fuzzy Hash: 93f1d33e5f9b0f0fe46a3d1581cde3bc686661411dbb0a268ce9a9d4e6e7bf04
Instruction Fuzzy Hash: F0417F71508345AEC753EF64D495ADF77ECAF89380F40082EF499CB251EA34E689CB52

Function 00367291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003672AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00367351
IsMenu.USER32(?), ref: 00367369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003673B1
DrawMenuBar.USER32 ref: 003673C4

Strings

0, xrefs: 0036729E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 9df013efc0f5775be6eeac7a6de45aa700e935acb16bcdb38951f70ac0820c98
Instruction ID: d057048a0fec9127771662d02e79c614d4d3556d43c601a81811535cdf70e08b
Opcode Fuzzy Hash: 9df013efc0f5775be6eeac7a6de45aa700e935acb16bcdb38951f70ac0820c98
Instruction Fuzzy Hash: F8413779A04208EFDB21DF50D884A9ABBF8FB06314F658429FD15A7354D730AD50DF90

Function 00360FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00360FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00360FFE
FreeLibrary.KERNEL32(00000000), ref: 003610B5

Part of subcall function 00360FA5: RegCloseKey.ADVAPI32(?), ref: 0036101B
Part of subcall function 00360FA5: FreeLibrary.KERNEL32(?), ref: 0036106D
Part of subcall function 00360FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00361090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00361058

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 3ffaeabc415d5fa1ca189529d2d22cb074e94e0d71dfa5f6840e4947a0f54feb
Instruction ID: cbac5dd94ece456ca9266e1502e8f3e900645e07e3b0499e5e41937588dd782b
Opcode Fuzzy Hash: 3ffaeabc415d5fa1ca189529d2d22cb074e94e0d71dfa5f6840e4947a0f54feb
Instruction Fuzzy Hash: 3F310D71901109BFDF16DF90EC89EFFBBBCEF08340F048169E501A6151EA759E899AA0

Function 003662CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 003662EC
GetWindowLongW.USER32(00FD6B68,000000F0), ref: 0036631F
GetWindowLongW.USER32(00FD6B68,000000F0), ref: 00366354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00366386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 003663B0
GetWindowLongW.USER32(00000000,000000F0), ref: 003663C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 003663DB

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 28c25dbb6951be426c86c951af1e77b8f53eb93b37575c794abf187b2710b5f2
Instruction ID: 9ce075d467ae98868c3ef57659a30c50a3bdbba9ea4cb63d715890f7669a05d3
Opcode Fuzzy Hash: 28c25dbb6951be426c86c951af1e77b8f53eb93b37575c794abf187b2710b5f2
Instruction Fuzzy Hash: 82310338644150AFDB22CF18EC86F5937E9FB4A754F2A81A4F511DF2B5CB71A8409B50

Function 0033DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0033DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0033DB54
SysAllocString.OLEAUT32(00000000), ref: 0033DB57
SysAllocString.OLEAUT32(?), ref: 0033DB75
SysFreeString.OLEAUT32(?), ref: 0033DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 0033DBA3
SysAllocString.OLEAUT32(?), ref: 0033DBB1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4e177346bb903ccf6ebcaf382dde49bbb000035f2637b4af80d2652867a44958
Instruction ID: d09d0135d5e738666e7a5a18ed3eee0119107d41f24b997ec57d4ae52b8fc03c
Opcode Fuzzy Hash: 4e177346bb903ccf6ebcaf382dde49bbb000035f2637b4af80d2652867a44958
Instruction Fuzzy Hash: 2121B676604219AFDF12DFB9EC88CBBB7ACEB09360F018565F915DB290DA70DC418760

Function 00356173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00357D8B: inet_addr.WSOCK32(00000000), ref: 00357DB6

socket.WSOCK32(00000002,00000001,00000006), ref: 003561C6
WSAGetLastError.WSOCK32(00000000), ref: 003561D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0035620E
connect.WSOCK32(00000000,?,00000010), ref: 00356217
WSAGetLastError.WSOCK32 ref: 00356221
closesocket.WSOCK32(00000000), ref: 0035624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00356263

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 017f0880c43a24222facf75c8cfa4d8d810ed2558ad3d6f65235c8eb5b166db7
Instruction ID: 8aa558fa39e124fcbf380cb522ff2200ab7bb9fd553ab94cb4eac63fd71df4c1
Opcode Fuzzy Hash: 017f0880c43a24222facf75c8cfa4d8d810ed2558ad3d6f65235c8eb5b166db7
Instruction Fuzzy Hash: A1319271600204AFDF11AF24DC86FBD77ACEB45751F448469FD05AB2A1CB70AD48CBA1

Function 0033F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0033F671
__wcsnicmp.LIBCMT ref: 0033F692
__wcsnicmp.LIBCMT ref: 0033F6AC

Strings

#notrayicon, xrefs: 0033F669
#requireadmin, xrefs: 0033F68C
#OnAutoItStartRegister, xrefs: 0033F6A6

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: b5e4482cc407d55b429b8d2734ff44b953b46ad49d6951802fc1407fc67e025f
Instruction ID: d4cf3181e0cb186be8753277cd72f474d53e345084fd5f8a7d5c235577f026ef
Opcode Fuzzy Hash: b5e4482cc407d55b429b8d2734ff44b953b46ad49d6951802fc1407fc67e025f
Instruction Fuzzy Hash: 30217972A056116FC233A634EC53FBB739CDF55390F91403AF4468B091EB559D41C394

Function 003675CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002E1D73
Part of subcall function 002E1D35: GetStockObject.GDI32(00000011), ref: 002E1D87
Part of subcall function 002E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 002E1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00367632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0036763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0036764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00367659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00367665

Strings

Msctls_Progress32, xrefs: 00367603

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 7dd741a7a7e4a8162fdaa759d6bfc2da8084738ff1e1a83f51978fd111bb21d7
Instruction ID: 8f6c0cdc99657c93c0d630a89aa39fe849c1a4137a14d2b9d69324b07ae898d9
Opcode Fuzzy Hash: 7dd741a7a7e4a8162fdaa759d6bfc2da8084738ff1e1a83f51978fd111bb21d7
Instruction Fuzzy Hash: 3811B2B2150219BFEF128F64CC85EE77F6DEF08798F018115FA04A60A0CA729C21DBA4

Function 00309AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00309AE6

Part of subcall function 00303187: EncodePointer.KERNEL32(00000000), ref: 0030318A
Part of subcall function 00303187: __initp_misc_winsig.LIBCMT ref: 003031A5
Part of subcall function 00303187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00309EA0
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00309EB4
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00309EC7
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00309EDA
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00309EED
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00309F00
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00309F13
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00309F26
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00309F39
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00309F4C
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00309F5F
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00309F72
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00309F85
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00309F98
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00309FAB
Part of subcall function 00303187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00309FBE

__mtinitlocks.LIBCMT ref: 00309AEB
__mtterm.LIBCMT ref: 00309AF4

Part of subcall function 00309B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00309AF9,00307CD0,0039A0B8,00000014), ref: 00309C56
Part of subcall function 00309B5C: _free.LIBCMT ref: 00309C5D
Part of subcall function 00309B5C: DeleteCriticalSection.KERNEL32(02:,?,?,00309AF9,00307CD0,0039A0B8,00000014), ref: 00309C7F

__calloc_crt.LIBCMT ref: 00309B19
__initptd.LIBCMT ref: 00309B3B
GetCurrentThreadId.KERNEL32 ref: 00309B42

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: c2b5d2b10ec9e399f02239d942dd150bbd0c93bff26bcbec481fbf2c823e906b
Instruction ID: 15ca496e870922d662fd47cd239e4e993b58f8a195eb1648665c7f9ad8879332
Opcode Fuzzy Hash: c2b5d2b10ec9e399f02239d942dd150bbd0c93bff26bcbec481fbf2c823e906b
Instruction Fuzzy Hash: BFF0F03220B3115AE637B774BC3378A3B94DF02730F214A1BF4A4C90D3EF20844001A0

Function 0036B635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036B644
_memset.LIBCMT ref: 0036B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,003A6F20,003A6F64), ref: 0036B682
CloseHandle.KERNEL32 ref: 0036B694

Strings

do:, xrefs: 0036B64D
o:, xrefs: 0036B63E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: o:$do:
API String ID: 3277943733-67440133
Opcode ID: 1648efd8ffc1a3c6670d2423d6320ce578b6d3779a5014587342c477790afc08
Instruction ID: e9c8db313c809294715a2580995e12dd8148d01445ab9936502b24bb743b5058
Opcode Fuzzy Hash: 1648efd8ffc1a3c6670d2423d6320ce578b6d3779a5014587342c477790afc08
Instruction Fuzzy Hash: 46F05EB65403007FE6123761BC0BFBB7A9CEB0A395F048020FA09E9192E7B54C008BA8

Function 0030406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00303F85), ref: 00304085
GetProcAddress.KERNEL32(00000000), ref: 0030408C
EncodePointer.KERNEL32(00000000), ref: 00304097
DecodePointer.KERNEL32(00303F85), ref: 003040B2

Strings

combase.dll, xrefs: 00304080
RoUninitialize, xrefs: 00304074

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 747ae10c0079c84d46d81fc0852497b836821e6a658e8e13991eef68415903e5
Instruction ID: 18e5f4b1f85b957642dd2068108637835ca2224933a8014e773c8445c6205982
Opcode Fuzzy Hash: 747ae10c0079c84d46d81fc0852497b836821e6a658e8e13991eef68415903e5
Instruction Fuzzy Hash: CDE0B6B4682300EFEB23AF61FC1DB567AACB705742F208424F211E11A0CBF64604CB14

Function 003464B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0034660B
_memmove.LIBCMT ref: 00346546

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

_memmove.LIBCMT ref: 003465B9
_memmove.LIBCMT ref: 003466A0
_memmove.LIBCMT ref: 003466B9
_memmove.LIBCMT ref: 003466D5

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 06c3e0da596de7e5ebd166ea91c544cb533233ce1895cc83c049d75c6dd0b7a7
Instruction ID: cedeff112f558c2fff0693bce9038a80dbc164f7c97a72478cbf6b7ab0081e84
Opcode Fuzzy Hash: 06c3e0da596de7e5ebd166ea91c544cb533233ce1895cc83c049d75c6dd0b7a7
Instruction Fuzzy Hash: 1361CC3090068A9BCF06EF60CC92EFE37A8AF06308F454429F8556F292DB38EC15CB51

Function 003601E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 00360E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0035FDAD,?,?), ref: 00360E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003602BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003602FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00360320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00360349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0036038C
RegCloseKey.ADVAPI32(00000000), ref: 00360399

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 82b9be25324dbe0c018051b452ef4bf4596406debf05469f43f2ec7e0c6fc7ea
Instruction ID: eaca93385461b0a85a0012553e54f317bf290d72f51a6ff4fba8041c13cd3baa
Opcode Fuzzy Hash: 82b9be25324dbe0c018051b452ef4bf4596406debf05469f43f2ec7e0c6fc7ea
Instruction Fuzzy Hash: E8517C31118240AFC706EF64C896E6FBBE8FF85314F54892DF5858B2A2DB31E914CB52

Function 00365799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 003657FB
GetMenuItemCount.USER32(00000000), ref: 00365832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0036585A
GetMenuItemID.USER32(?,?), ref: 003658C9
GetSubMenu.USER32(?,?), ref: 003658D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00365928

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 99be9d1a48ec86df8ffbb089abd1c68d63125281832aa4f00a331192ebda25e8
Instruction ID: b28b04160dc379b240e5061cba0d2cb2a89bd311d627228e5be3c7a356d76706
Opcode Fuzzy Hash: 99be9d1a48ec86df8ffbb089abd1c68d63125281832aa4f00a331192ebda25e8
Instruction Fuzzy Hash: 31517F31E01615EFCF12DF64C845AAEBBB4EF49320F118069E852BB351CB74AE41CB90

Function 0033EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0033EF06
VariantClear.OLEAUT32(00000013), ref: 0033EF78
VariantClear.OLEAUT32(00000000), ref: 0033EFD3
_memmove.LIBCMT ref: 0033EFFD
VariantClear.OLEAUT32(?), ref: 0033F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0033F078

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 2b2bb4d92656a6aa98c95f4f5b24bf15eb2dc5e6068d2ad205d01bbc6536a2f0
Instruction ID: 27b5ad81a132b4033d8208657c04ffd43bec06f33b4bac2fd97936a1664dd9ff
Opcode Fuzzy Hash: 2b2bb4d92656a6aa98c95f4f5b24bf15eb2dc5e6068d2ad205d01bbc6536a2f0
Instruction Fuzzy Hash: 585166B5A00209EFCB15CF58C884AAAB7B8FF4C314F15856AE959DB301E734E951CFA0

Function 0034220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00342258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003422A3
IsMenu.USER32(00000000), ref: 003422C3
CreatePopupMenu.USER32 ref: 003422F7
GetMenuItemCount.USER32(000000FF), ref: 00342355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00342386

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 09f2ca82329089113a70537af98d60c95bcb3cda4c8108651c48e2fcfeab812c
Instruction ID: a891d671065f845d59e2ca40d12157b2ed9e4dd058823b56cb0453e4b20b4a88
Opcode Fuzzy Hash: 09f2ca82329089113a70537af98d60c95bcb3cda4c8108651c48e2fcfeab812c
Instruction Fuzzy Hash: 51519934600209EFDF22CF68D888BAFBBF9AF45314F558129F851AF290D3B4A944CB51

Function 002E1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 002E179A
GetWindowRect.USER32(?,?), ref: 002E17FE
ScreenToClient.USER32(?,?), ref: 002E181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 002E182C
EndPaint.USER32(?,?), ref: 002E1876

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 299900de6e201a4ef8d13bf30e0f6deb09aefbbf46380c8745af4ec6d4a987f7
Instruction ID: 65f5538d791a317abfed0f9da9955710c1ea08f0b775849a426a945c25230428
Opcode Fuzzy Hash: 299900de6e201a4ef8d13bf30e0f6deb09aefbbf46380c8745af4ec6d4a987f7
Instruction Fuzzy Hash: F641CF30210340AFD712DF25DC84FBA7BECEB4A720F044238F9A48B2A1C7709865DB61

Function 0036B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(003A57B0,00000000,00FD6B68,?,?,003A57B0,?,0036B5A8,?,?), ref: 0036B712
EnableWindow.USER32(00000000,00000000), ref: 0036B736
ShowWindow.USER32(003A57B0,00000000,00FD6B68,?,?,003A57B0,?,0036B5A8,?,?), ref: 0036B796
ShowWindow.USER32(00000000,00000004,?,0036B5A8,?,?), ref: 0036B7A8
EnableWindow.USER32(00000000,00000001), ref: 0036B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0036B7EF

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 778c950ee0fd87cd8a9758588d6d33553a7647b9561741d5bd058999cac14bea
Instruction ID: 1604c0654beb6ce39690259b0b0a816b6839939c42f223581a8aba1e77cd8469
Opcode Fuzzy Hash: 778c950ee0fd87cd8a9758588d6d33553a7647b9561741d5bd058999cac14bea
Instruction Fuzzy Hash: A3417B34600240AFDB23CF24C499B94BBE0FF45351F1981B9E948CF6A6C771A896CF60

Function 0035709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00354E41,?,?,00000000,00000001), ref: 003570AC

Part of subcall function 003539A0: GetWindowRect.USER32(?,?), ref: 003539B3

GetDesktopWindow.USER32 ref: 003570D6
GetWindowRect.USER32(00000000), ref: 003570DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0035710F

Part of subcall function 00345244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003452BC

GetCursorPos.USER32(?), ref: 0035713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00357199

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: fa405cc3291482e269472cec678da13e2034e722f5b62b8bb75b90cdc6a1670e
Instruction ID: a48a45532e88b0486247d1be1a25a89748c08e8eb12e56d3db8542aab67f5356
Opcode Fuzzy Hash: fa405cc3291482e269472cec678da13e2034e722f5b62b8bb75b90cdc6a1670e
Instruction Fuzzy Hash: EA31D272509705AFD721DF14E849F9BB7E9FF89314F000919F9859B191C770EA09CB92

Function 00338879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003380A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003380C0
Part of subcall function 003380A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003380CA
Part of subcall function 003380A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003380D9
Part of subcall function 003380A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003380E0
Part of subcall function 003380A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003380F6

GetLengthSid.ADVAPI32(?,00000000,0033842F), ref: 003388CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 003388D6
HeapAlloc.KERNEL32(00000000), ref: 003388DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 003388F6
GetProcessHeap.KERNEL32(00000000,00000000,0033842F), ref: 0033890A
HeapFree.KERNEL32(00000000), ref: 00338911

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: d95aba5c5684883f323eb5db92a5f3eadf06c7daeed7049e2ccc931563007da8
Instruction ID: cd74a78e9a669546e1eedf08a8eb4862c4ec7a510d2138a6c27290d6c8bfbbe6
Opcode Fuzzy Hash: d95aba5c5684883f323eb5db92a5f3eadf06c7daeed7049e2ccc931563007da8
Instruction Fuzzy Hash: C011AF71501209FFDB129FA4DC49BBE77ACFB45355F108028F885DB110CB769904DB60

Function 003385B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 003385E2
OpenProcessToken.ADVAPI32(00000000), ref: 003385E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 003385F8
CloseHandle.KERNEL32(00000004), ref: 00338603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00338632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00338646

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ee3f7e755d758209f663ebb4999b11cdfcf0052ff6dbdeb3295ba7ae7334c8f4
Instruction ID: 1be293f2ef0ddbbf3f6766a1e43bb4ff0858d838f30a051511105c7b4c1fd587
Opcode Fuzzy Hash: ee3f7e755d758209f663ebb4999b11cdfcf0052ff6dbdeb3295ba7ae7334c8f4
Instruction Fuzzy Hash: 9B115C72500209AFDF028FA4ED49BEE7BADEF08344F058064FE04A2160C7B18D64DB60

Function 0033B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0033B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 0033B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0033B7CD
ReleaseDC.USER32(00000000,00000000), ref: 0033B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0033B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 0033B7FE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 15ea59656c02f1b9b7dbf7076535bf729caa385b9346497fc069b78d80fd5528
Instruction ID: 2021b00c89b5e6ca8b3201fb16789ed6df4adcea8f1d4b30503f4e6f63f0081d
Opcode Fuzzy Hash: 15ea59656c02f1b9b7dbf7076535bf729caa385b9346497fc069b78d80fd5528
Instruction Fuzzy Hash: 59014475E00219BFEB119BA6DD85A5EBFBCEF48751F008075FA04A7291D6719C10CF91

Function 00300162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00300193
MapVirtualKeyW.USER32(00000010,00000000), ref: 0030019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 003001A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 003001B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 003001B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 003001C1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 67f3b57cc70860c65716376eb21225587e9477edcd4e32d5b13cadab42b1595d
Instruction ID: 15178a129dbf707510b02159b1a8c7e1222d778d5e95daf792f8ff7c93d27b1e
Opcode Fuzzy Hash: 67f3b57cc70860c65716376eb21225587e9477edcd4e32d5b13cadab42b1595d
Instruction Fuzzy Hash: B5016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BE15C47941C7F5A864CBE5

Function 003453E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003453F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0034540F
GetWindowThreadProcessId.USER32(?,?), ref: 0034541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0034542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00345437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0034543E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: eea3664a3b7fe804edf4da65c3b2274cb95d0345bdbbb502d7183e94b1e098da
Instruction ID: 8c7ead1dfd307a9fa4df7ba3973ac8182d80fc67e05da568f9b8e23456d2e04f
Opcode Fuzzy Hash: eea3664a3b7fe804edf4da65c3b2274cb95d0345bdbbb502d7183e94b1e098da
Instruction Fuzzy Hash: 91F06D32240158BFE3225BA2EC0EEAB7A7CEBC7B11F004169FA04D105196E01A0186B5

Function 00347230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00347243
EnterCriticalSection.KERNEL32(?,?,002F0EE4,?,?), ref: 00347254
TerminateThread.KERNEL32(00000000,000001F6,?,002F0EE4,?,?), ref: 00347261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,002F0EE4,?,?), ref: 0034726E

Part of subcall function 00346C35: CloseHandle.KERNEL32(00000000,?,0034727B,?,002F0EE4,?,?), ref: 00346C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00347281
LeaveCriticalSection.KERNEL32(?,?,002F0EE4,?,?), ref: 00347288

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: f8062d185189371298381bc93bbf849061dd70b1e319706e022789d5bf44a929
Instruction ID: a5dd47dd4b18879d7341ccd3f38676095f6005128ee748259a9408acc90221f2
Opcode Fuzzy Hash: f8062d185189371298381bc93bbf849061dd70b1e319706e022789d5bf44a929
Instruction Fuzzy Hash: 49F09A3A044202AFD7131B24FC8C9DA377DFF45302F010A31F102940A0CBB62810CE50

Function 00338992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0033899D
UnloadUserProfile.USERENV(?,?), ref: 003389A9
CloseHandle.KERNEL32(?), ref: 003389B2
CloseHandle.KERNEL32(?), ref: 003389BA
GetProcessHeap.KERNEL32(00000000,?), ref: 003389C3
HeapFree.KERNEL32(00000000), ref: 003389CA

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: cb674ed75dcf915c25031415a76a515af84678dd50cea47c65229412a79978c5
Instruction ID: abea6776c5269eb8b4d59f371433452365fea080c8b0525b16d6ba808df135e3
Opcode Fuzzy Hash: cb674ed75dcf915c25031415a76a515af84678dd50cea47c65229412a79978c5
Instruction Fuzzy Hash: 7AE05276104505FFDA021FE5FC0C95ABB6DFB8A7A2B608631F21981570CBB29461DB50

Function 00337530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00372C7C,?), ref: 003376EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00372C7C,?), ref: 00337702
CLSIDFromProgID.OLE32(?,?,00000000,0036FB80,000000FF,?,00000000,00000800,00000000,?,00372C7C,?), ref: 00337727
_memcmp.LIBCMT ref: 00337748

Strings

,,7, xrefs: 0033753D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,7
API String ID: 314563124-1335535671
Opcode ID: 0c9610d09f79518f11c19bb9d82cd18ff766b27f15cbdbbb6d1c7b10a71269dc
Instruction ID: 3c9ff4dd9bd4620f9709a3c72c8ce5ae2f8c094306f28b4572f5d0ecd5e586e4
Opcode Fuzzy Hash: 0c9610d09f79518f11c19bb9d82cd18ff766b27f15cbdbbb6d1c7b10a71269dc
Instruction Fuzzy Hash: C2812DB5A00109EFCB15DFA4C984EEEB7B9FF89315F204598F505AB250DB71AE06CB60

Function 003585ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00358613
CharUpperBuffW.USER32(?,?), ref: 00358722
VariantClear.OLEAUT32(?), ref: 0035889A

Part of subcall function 00347562: VariantInit.OLEAUT32(00000000), ref: 003475A2
Part of subcall function 00347562: VariantCopy.OLEAUT32(00000000,?), ref: 003475AB
Part of subcall function 00347562: VariantClear.OLEAUT32(00000000), ref: 003475B7

Strings

Incorrect Parameter format, xrefs: 0035864B, 0035880D
AUTOIT.ERROR, xrefs: 00358728

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: ad1716ba8a2ad0d7b4ffc70bfb599aa1490b25547abfcf26355d5cf4b8a9e52c
Instruction ID: bec70bef37074f672edcbd478852ce4d2a6d94b1f5cbfd4a4c4e34d5ce74e9c4
Opcode Fuzzy Hash: ad1716ba8a2ad0d7b4ffc70bfb599aa1490b25547abfcf26355d5cf4b8a9e52c
Instruction Fuzzy Hash: 63919D70604341DFCB11DF25C484D5ABBE8EF89715F44892EF88A9B361DB30E949CB92

Function 00342A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002FFC86: _wcscpy.LIBCMT ref: 002FFCA9

_memset.LIBCMT ref: 00342B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00342BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00342C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00342C97

Strings

0, xrefs: 00342B73

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 828a5949684dd31bfa209a4bbca8346de4d38e6c9a921794daf703ea7637046d
Instruction ID: 80b8648e279aa67ad02e0adedf942f9cc827d3e99b5a5b0995aee7e73cff3eb4
Opcode Fuzzy Hash: 828a5949684dd31bfa209a4bbca8346de4d38e6c9a921794daf703ea7637046d
Instruction Fuzzy Hash: 0451CD716083009ED7269F28D885A6FB7E8EF45350F450A2DF895EB1D1DBB0EC44CB92

Function 002F3137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002F3277
_memmove.LIBCMT ref: 002F3310
_free.LIBCMT ref: 002F3336
_memmove.LIBCMT ref: 002F33E9

Strings

_/, xrefs: 002F3322
3c/, xrefs: 002F3225

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove$_free
String ID: 3c/$_/
API String ID: 2620147621-3203948279
Opcode ID: bf8e94bbb269e272fd18229a6217363baf5e8769d1d776559447db1a7fb6368e
Instruction ID: 539325840ab9ac3f671fea644ac2b3dd504fa7b82cdc4457551b39ed8c0d953f
Opcode Fuzzy Hash: bf8e94bbb269e272fd18229a6217363baf5e8769d1d776559447db1a7fb6368e
Instruction Fuzzy Hash: A3518A716143418FDB26CF28C891B6BBBE5FF85350F09482DEA8987350EB31E911CB92

Function 002F6192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F6248
_memmove.LIBCMT ref: 002F62E4
_memset.LIBCMT ref: 002F6308

Strings

ERCP, xrefs: 002F61B3
3c/, xrefs: 002F62AF

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3c/$ERCP
API String ID: 2532777613-1699281995
Opcode ID: 3f8420cfd2ada35abe687e5c517615935b8c785c14f1804460f2da0832debdee
Instruction ID: f4afa3882f045760dfb9db8f63229f52e52cb536d3d05279206ba9988ef458d8
Opcode Fuzzy Hash: 3f8420cfd2ada35abe687e5c517615935b8c785c14f1804460f2da0832debdee
Instruction Fuzzy Hash: E051AF71A1030ADFDB25CF65C885BAAB7F4EF04744F20457EE94ACB291E770AA50CB40

Function 00342753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003427C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 003427DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00342822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,003A5890,00000000), ref: 0034286B

Strings

0, xrefs: 003427B5

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: e1a6ac4b17529af622af70b4ac2410ef3434844af1b46276b5de56b13af23722
Instruction ID: d0a4a7336e2b4563f3f0caedece7866b74fcaa5dbd5c6565b26a2310d0ce3a65
Opcode Fuzzy Hash: e1a6ac4b17529af622af70b4ac2410ef3434844af1b46276b5de56b13af23722
Instruction Fuzzy Hash: B341AE702043419FD722DF25C844B2BBBE8EF85314F45496DF9A6AB292DB70B805CB52

Function 0035D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0035D7C5

Part of subcall function 002E784B: _memmove.LIBCMT ref: 002E7899

Strings

winapi, xrefs: 0035D836
cdecl, xrefs: 0035D81C
stdcall, xrefs: 0035D847
none, xrefs: 0035D8A0

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: b0fe17b72ec327667ad58182852304df60fa016fd8ad0b4bd7682d219b46904b
Instruction ID: 575d0f79488a2ac4d9fe9799422f70d2556eb25eb7859341e0a8fa2bb623e70e
Opcode Fuzzy Hash: b0fe17b72ec327667ad58182852304df60fa016fd8ad0b4bd7682d219b46904b
Instruction Fuzzy Hash: 8331B071A14219ABCF11EF58C891EEEB3B4FF14320F008629E8259B6D1DB31AD09CB80

Function 00338E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 0033AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0033AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00338F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00338F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00338F57

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

Strings

ComboBox, xrefs: 00338E9E
ListBox, xrefs: 00338ED3

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 24322e65d91cda15032ccc23c89843a20e9c6c0753db43320186dcd836a3a077
Instruction ID: 2f3a2425c992ee5b5ea51cb898cb4b2c321d8aadc20777a7ed656e47485922ab
Opcode Fuzzy Hash: 24322e65d91cda15032ccc23c89843a20e9c6c0753db43320186dcd836a3a077
Instruction Fuzzy Hash: 6C214671A48208BEDB16ABB0EC86DFFB769DF01320F048519F421971E1CF384D1ACA20

Function 0035182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0035184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00351872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003518A2
InternetCloseHandle.WININET(00000000), ref: 003518E9

Part of subcall function 00352483: GetLastError.KERNEL32(?,?,00351817,00000000,00000000,00000001), ref: 00352498
Part of subcall function 00352483: SetEvent.KERNEL32(?,?,00351817,00000000,00000000,00000001), ref: 003524AD

Strings

, xrefs: 00351893

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: b966497589c770500501cb7b6ba25bab6964c02b5850b091c1326618ed32dcb9
Instruction ID: 3be319077d229189e4c4fcc242fb3d99861a98e2fb78fbb4800317b4355b0df8
Opcode Fuzzy Hash: b966497589c770500501cb7b6ba25bab6964c02b5850b091c1326618ed32dcb9
Instruction Fuzzy Hash: D921BEB6500208BFEB229B61DC85FBB77EDEB49746F11412AF805A6250EB608D0897A1

Function 003663E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 002E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002E1D73
Part of subcall function 002E1D35: GetStockObject.GDI32(00000011), ref: 002E1D87
Part of subcall function 002E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 002E1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00366461
LoadLibraryW.KERNEL32(?), ref: 00366468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0036647D
DestroyWindow.USER32(?), ref: 00366485

Strings

SysAnimate32, xrefs: 0036643C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 2955ad90d75a052814ac98f9df43b2c43f2fbf3504adff71a4b6384132e02659
Instruction ID: be7f5de68125de191f40eb62640a14957d6b4f4a348f456b23f8b5eb4a4de21d
Opcode Fuzzy Hash: 2955ad90d75a052814ac98f9df43b2c43f2fbf3504adff71a4b6384132e02659
Instruction Fuzzy Hash: DA21CD71200205BFEF134F66EC82EBB37ACEB483A4F21C629FA10921A4CB71DC519720

Function 00346D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00346DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00346DEF
GetStdHandle.KERNEL32(0000000C), ref: 00346E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00346E3B

Strings

nul, xrefs: 00346E36

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 5cba066ac78a178bbb1912710c9949d10aca825de899a57f9895d9a0b4c4b4c4
Instruction ID: 60e84d762c156bed51ce62c69b8beb95856fcef7009718a82fea94b08f08012b
Opcode Fuzzy Hash: 5cba066ac78a178bbb1912710c9949d10aca825de899a57f9895d9a0b4c4b4c4
Instruction Fuzzy Hash: 33219574A00209AFDB219F29DC46A9977F8EF46720F204A19FCA1DB2D0D770A9508B52

Function 00346E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00346E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00346EBB
GetStdHandle.KERNEL32(000000F6), ref: 00346ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00346F06

Strings

nul, xrefs: 00346F01

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 9ed5d006f35c881cc9e11fe2af8321191e8c02403c1c9049912ab1c2b984f413
Instruction ID: 55aa2d5f66d2860c05a627ec261f31495d1a0dc31b0c2a7586dbaae427d8ac5c
Opcode Fuzzy Hash: 9ed5d006f35c881cc9e11fe2af8321191e8c02403c1c9049912ab1c2b984f413
Instruction Fuzzy Hash: 1C21C1796003059FDB229F69DD46A9A77E8EF46720F204A19FCE0DB2D0D770B894CB12

Function 0034AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0034AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0034ACA8
__swprintf.LIBCMT ref: 0034ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0036F910), ref: 0034ACFF

Strings

%lu, xrefs: 0034ACBB

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 46337ea73a77230fc169281d0b1dccac9d1edeaf56aa19b3703a12d9490d0d44
Instruction ID: 9e1c01d8b42b6ba8dbdf86d10a1d039cc42edbfc4294fca99c4d162b270fb835
Opcode Fuzzy Hash: 46337ea73a77230fc169281d0b1dccac9d1edeaf56aa19b3703a12d9490d0d44
Instruction Fuzzy Hash: F5217130A00109AFCB11DF65D985DEE7BB8FF89314B008069F909DB251DB71EE51CB61

Function 00341142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0033FCED,?,00340D40,?,00008000), ref: 0034115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,0033FCED,?,00340D40,?,00008000), ref: 00341184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0033FCED,?,00340D40,?,00008000), ref: 0034118E
Sleep.KERNEL32(?,?,?,?,?,?,?,0033FCED,?,00340D40,?,00008000), ref: 003411C1

Strings

@4, xrefs: 0034119D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID: @4
API String ID: 2875609808-465690154
Opcode ID: 3be9d965b7cfd8ec4cdb30697852bca8f5d59a91c9edd09d048ec0e27f6bdaf6
Instruction ID: c65140e76ab75f4fbcc5fe5f3f869c9fade0ed9d31b8e8fbbf6c26041dd10596
Opcode Fuzzy Hash: 3be9d965b7cfd8ec4cdb30697852bca8f5d59a91c9edd09d048ec0e27f6bdaf6
Instruction Fuzzy Hash: D9113C31D0091DDBCF029FA5E849AEEBBBCFF0A751F014056EA41BA240DB70A590CB95

Function 00341AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00341B19

Strings

EXISTS, xrefs: 00341B41
REMOVE, xrefs: 00341B1F
KEYS, xrefs: 00341B30
APPEND, xrefs: 00341B52

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 16314734e00d28f198d2985a792c8f6b558bcf48f7d6198c5234ab3ae6d66d3e
Instruction ID: d58b59f4c2ceb206cb04a1322b6bd16d2b52fcf9b55008328f59e0c6fa08b251
Opcode Fuzzy Hash: 16314734e00d28f198d2985a792c8f6b558bcf48f7d6198c5234ab3ae6d66d3e
Instruction Fuzzy Hash: 381161349201488FCF05EF64D861AFEB7B4FF66304F558465D815AB6A2EB326D0ACF50

Function 0035EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0035EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0035EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0035ED6A
CloseHandle.KERNEL32(?), ref: 0035EDEB

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 94d0adebcd28bad10a8e4ee931ddd961e07a15f50d4a9ee6f330b8b67d4e7d8f
Instruction ID: a6e893a24aaa0e7a796d466ef67e79be3a4ef4a1f3f8c8cf4fb10d72612d79fa
Opcode Fuzzy Hash: 94d0adebcd28bad10a8e4ee931ddd961e07a15f50d4a9ee6f330b8b67d4e7d8f
Instruction Fuzzy Hash: BD81A0B16443009FD725EF29C886F2AB7E5AF44710F44881DF999DB2A2DBB0AD44CF42

Function 00360037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 00360E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0035FDAD,?,?), ref: 00360E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003600FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0036013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00360183
RegCloseKey.ADVAPI32(?,?), ref: 003601AF
RegCloseKey.ADVAPI32(00000000), ref: 003601BC

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 6dcb83897eef9fa7fa93758769620ab087a9454c31ef730403e1d9bbd23d46be
Instruction ID: 891f0142813884e44fa55ea37a0e2f43aaa06eb5c1f850a5ff3d26bf782c6c6e
Opcode Fuzzy Hash: 6dcb83897eef9fa7fa93758769620ab087a9454c31ef730403e1d9bbd23d46be
Instruction Fuzzy Hash: 2B518D31218244AFD705EF54CC82E6BB7E8FF85304F40892DF5968B2A2DB31E954CB52

Function 0035D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0035D927
GetProcAddress.KERNEL32(00000000,?), ref: 0035D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0035D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0035DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0035DA21

Part of subcall function 002E5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00347896,?,?,00000000), ref: 002E5A2C
Part of subcall function 002E5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00347896,?,?,00000000,?,?), ref: 002E5A50

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 1d709c59d1638cb3bcd81bc4bdb03c8788401d84175b9fbc1258f86e95fddd4b
Instruction ID: cd9de29b9a9e364f18503baf91a40d0589f5f26b9dd35cf4fd3ebb7a4ccf8de7
Opcode Fuzzy Hash: 1d709c59d1638cb3bcd81bc4bdb03c8788401d84175b9fbc1258f86e95fddd4b
Instruction Fuzzy Hash: 83513635A00249DFCB11EFA8C484DADB7B8FF09325B458069E855AB322D770AD55CF90

Function 0034E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0034E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0034E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0034E687

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0034E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0034E6B4

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: c8e8c1a2b9901d55476974479c78a81ced6eecd9aa0d9dc50c684d29a3ea79a0
Instruction ID: 689e1f81ac568a6070175e39890beba207be5e7a3c4d69ef8c0f49f3d79f737f
Opcode Fuzzy Hash: c8e8c1a2b9901d55476974479c78a81ced6eecd9aa0d9dc50c684d29a3ea79a0
Instruction Fuzzy Hash: 1B510735A10245DFCB01EF65C981AAEBBF5EF09314F1480A9E849AB362CB35ED51DF50

Function 0036A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b06a0b2bb67f1e98636814aaddcdfd1c41e3c9e3d95fee1a6efa4f01c8b3d2
Instruction ID: bdb1dd0e9656b06919a7b0371fd878fb3124af535cdf34f70ccd4512a46599b1
Opcode Fuzzy Hash: 90b06a0b2bb67f1e98636814aaddcdfd1c41e3c9e3d95fee1a6efa4f01c8b3d2
Instruction Fuzzy Hash: E241F435904904AFD722DF28DC48FA9BBACFB0A310F168165F916B72E5CB70AD41DE51

Function 002E2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 002E2357
ScreenToClient.USER32(003A57B0,?), ref: 002E2374
GetAsyncKeyState.USER32(00000001), ref: 002E2399
GetAsyncKeyState.USER32(00000002), ref: 002E23A7

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 5a67af9075751b53acdda1a94a602534ab350600c307cb711977b093f777cfa0
Instruction ID: b8ba4ac2fbe63b8cb3f59ca1540482ab6aba391859bcd00dc1c6acc90e1cc2cb
Opcode Fuzzy Hash: 5a67af9075751b53acdda1a94a602534ab350600c307cb711977b093f777cfa0
Instruction Fuzzy Hash: BD41A335614105FFCF1A9F69CC44AE9BB78FB09360F20435AF82A96290C7749DA4DF90

Function 003363AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003363E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00336433
TranslateMessage.USER32(?), ref: 0033645C
DispatchMessageW.USER32(?), ref: 00336466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00336475

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 946afe7445003322ef35b288155642e1cbe8961ebec324a4ae68c0dfbb7efc23
Instruction ID: c1aa3c7e066e5122c40c526f5314d5893802959bb7675ea400a31a44e21bf17b
Opcode Fuzzy Hash: 946afe7445003322ef35b288155642e1cbe8961ebec324a4ae68c0dfbb7efc23
Instruction Fuzzy Hash: 3731F231E00642BFDB27CFB1DCC6BB67BACAB02310F118169E421C30A1E7659889DB60

Function 00338A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00338A30
PostMessageW.USER32(?,00000201,00000001), ref: 00338ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00338AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00338AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00338AF8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1a82a605a064d28328df3d556d127436d6efccbe99221eb138494365a449a500
Instruction ID: f03ce90cad695b31831dbe10e8eacb1ae0eabbfc8749e82fdd560b8878fb0c0a
Opcode Fuzzy Hash: 1a82a605a064d28328df3d556d127436d6efccbe99221eb138494365a449a500
Instruction Fuzzy Hash: 8731CE71500219EFDF15CFA8D98CA9E7BB9FB05315F10822AF925EB2D0C7B09914DB90

Function 0033B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0033B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0033B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0033B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0033B27F
_wcsstr.LIBCMT ref: 0033B289

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 15afc1bf8d49b9383a5798d79005b3374c405905be18685e97566c9a9572a56b
Instruction ID: 5e1e2c1c7bb53298b3d65395bb647cc37474af79da324876cc6ebda6e01ed92a
Opcode Fuzzy Hash: 15afc1bf8d49b9383a5798d79005b3374c405905be18685e97566c9a9572a56b
Instruction Fuzzy Hash: FD21F531605200BBEB179B75DC89E7FBB9CDF49710F118229F905DE1A1EFA1DC4092A0

Function 0036B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

GetWindowLongW.USER32(?,000000F0), ref: 0036B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0036B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0036B1CF
GetSystemMetrics.USER32(00000004), ref: 0036B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00350E90,00000000), ref: 0036B216

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 47db2e275c7e2e851ca63562d3d3eee68a45de854a4b5a60592c9519264b5281
Instruction ID: 897a1c3117ef85e4c8af37e7e6810fd60175d41e362877f2d497e4630d073ad3
Opcode Fuzzy Hash: 47db2e275c7e2e851ca63562d3d3eee68a45de854a4b5a60592c9519264b5281
Instruction Fuzzy Hash: 4D21A671A10251AFCB129F38DC14A6A7BA8FB06361F118B34F932D71E4D73098A0CF90

Function 00339307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00339320

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00339352
__itow.LIBCMT ref: 0033936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00339392
__itow.LIBCMT ref: 003393A3

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 35db44ada06dc2fe7a19ad3d7c05ec95301f33f621e2dfb2ef5fd33178914e8b
Instruction ID: 1ee1aa2a3b9431872e7248a8ae5320672da0a294964fb4fbd79def600bce2f81
Opcode Fuzzy Hash: 35db44ada06dc2fe7a19ad3d7c05ec95301f33f621e2dfb2ef5fd33178914e8b
Instruction Fuzzy Hash: 94210475704208EBDB12AA619CC9FEE3BACEF48720F04402AFA05DB1D0D6F0CD518BA1

Function 00355A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00355A6E
GetForegroundWindow.USER32 ref: 00355A85
GetDC.USER32(00000000), ref: 00355AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00355ACD
ReleaseDC.USER32(00000000,00000003), ref: 00355B08

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 8225543cf0bd3d6b549a4103e8984792f368e372a73082486135fa4ddb0405d0
Instruction ID: 502744edcd120ec4db89fb05f6a5b75b13d4a15720eade80361982566965c8f0
Opcode Fuzzy Hash: 8225543cf0bd3d6b549a4103e8984792f368e372a73082486135fa4ddb0405d0
Instruction Fuzzy Hash: D621AE75A00204AFDB01EF65DC98AAABBE9EF48351F14C079F80997362CA70EC44CB90

Function 002E12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002E134D
SelectObject.GDI32(?,00000000), ref: 002E135C
BeginPath.GDI32(?), ref: 002E1373
SelectObject.GDI32(?,00000000), ref: 002E139C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 3568f66220bda69ee8266c7b06ecb08ce52248b3cc3b22535de638a9a46157b5
Instruction ID: 715460764c6d6eb06a85c9124bc9a80cfed8584f580c176e0f1e70a9fc6f6bd0
Opcode Fuzzy Hash: 3568f66220bda69ee8266c7b06ecb08ce52248b3cc3b22535de638a9a46157b5
Instruction Fuzzy Hash: 09218E30A51649EFDB128F26EC047AD7BECFB02721F548266F810965B0D3B898B1DF90

Function 00344A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00344ABA
__beginthreadex.LIBCMT ref: 00344AD8
MessageBoxW.USER32(?,?,?,?), ref: 00344AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00344B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00344B0A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 217f8de2b0e5da56223a71cd63fb3faaa794b88f97d898cc8e8614252a8322ea
Instruction ID: 49813d3401ff444d43598f6de6a9d5dd42791d01e4a676084b234759b141cde7
Opcode Fuzzy Hash: 217f8de2b0e5da56223a71cd63fb3faaa794b88f97d898cc8e8614252a8322ea
Instruction Fuzzy Hash: C9110876905614BFC7038FA8EC08B9B7FECEB46320F154275F814D7250D6B1D90487A0

Function 00338202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0033821E
GetLastError.KERNEL32(?,00337CE2,?,?,?), ref: 00338228
GetProcessHeap.KERNEL32(00000008,?,?,00337CE2,?,?,?), ref: 00338237
HeapAlloc.KERNEL32(00000000,?,00337CE2,?,?,?), ref: 0033823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00338255

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 856a0d0a916591cf2a330a0d10f45af89ada193947341351351a487ea68da2a2
Instruction ID: 06f773d6ef7d6dde770beb2d16cdd5b66206c7ba006f7c7579b594788bdd0ac6
Opcode Fuzzy Hash: 856a0d0a916591cf2a330a0d10f45af89ada193947341351351a487ea68da2a2
Instruction Fuzzy Hash: 04016D71201604BFDB224FA5EC88D6B7BACFF8A754F504829F809C2220DAB18C10CA60

Function 0033710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?,?,?,00337455), ref: 00337127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?,?), ref: 00337142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?,?), ref: 00337150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?), ref: 00337160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337044,80070057,?,?), ref: 0033716C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 4d4025162cb651ead293e104ea72453499cdd0346c290bc7201cdf0f332752ea
Instruction ID: 6c04528d2cebe655c1b4a65c4910ef5d1d8efb7657898532f08f36634671efa9
Opcode Fuzzy Hash: 4d4025162cb651ead293e104ea72453499cdd0346c290bc7201cdf0f332752ea
Instruction Fuzzy Hash: 21017CB7A05204AFDB224F64EC84AAA7BADEB447A1F1540A4FD48D3220D7B1DD40DBA0

Function 00345244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00345260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0034526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00345276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00345280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003452BC

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: c1a7e808ad7035432960cbc8d561b7b395ff03d2355242aadc2f25bc29a3db81
Instruction ID: 37f4b7d873a5277824b12660d314a5d639e21895c545b27d1311a7ac4b3c84d8
Opcode Fuzzy Hash: c1a7e808ad7035432960cbc8d561b7b395ff03d2355242aadc2f25bc29a3db81
Instruction Fuzzy Hash: 62011731D01A1DDBCF02EFE4E8499EDBBBCBB09711F414956E941B6141CBB065508BA5

Function 0033810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00338121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0033812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0033813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00338141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00338157

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: de4bf29114103d2ade2d3c49dac99d32890429ae8def049bebafb1166380f160
Instruction ID: 9c80dd210f74298705ed3218deb7213862efe01366988244d2df337abe8d3835
Opcode Fuzzy Hash: de4bf29114103d2ade2d3c49dac99d32890429ae8def049bebafb1166380f160
Instruction Fuzzy Hash: 44F06275600304AFEB120FA5ECCCE673BACFF4A754F104025F985C6150CBA1DD41DA60

Function 0033C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0033C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 0033C20E
MessageBeep.USER32(00000000), ref: 0033C226
KillTimer.USER32(?,0000040A), ref: 0033C242
EndDialog.USER32(?,00000001), ref: 0033C25C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: b7a2388c7926989f446ed07362fabc76f3a8083d2726e1b0758aaf2581203704
Instruction ID: 192e1d29020281bc4255c9f2dac301c260d17e77fcd0823365c9a2c266bc1f15
Opcode Fuzzy Hash: b7a2388c7926989f446ed07362fabc76f3a8083d2726e1b0758aaf2581203704
Instruction Fuzzy Hash: 5B01A7304143049BEF225B54ED8EB97777CBB00706F004669E582E14E0D7E469548B50

Function 002E13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 002E13BF
StrokeAndFillPath.GDI32(?,?,0031B888,00000000,?), ref: 002E13DB
SelectObject.GDI32(?,00000000), ref: 002E13EE
DeleteObject.GDI32 ref: 002E1401
StrokePath.GDI32(?), ref: 002E141C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: d3ffd7bca1ae8329d8bebd8f020303387a2033ad5761d9ed00e4fda9848a554a
Instruction ID: 564a6a03588a6eb7d2ec73162cc3b337aa5cb08c703657839a585a06fedf58c3
Opcode Fuzzy Hash: d3ffd7bca1ae8329d8bebd8f020303387a2033ad5761d9ed00e4fda9848a554a
Instruction Fuzzy Hash: E6F01930215B49EFDB135F26EC4C7583FACAB02326F48C224E429485F2C77849A5DF20

Function 0034C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0034C432
CoCreateInstance.OLE32(00372D6C,00000000,00000001,00372BDC,?), ref: 0034C44A

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

CoUninitialize.OLE32 ref: 0034C6B7

Strings

.lnk, xrefs: 0034C3C6, 0034C3EE, 0034C3F8

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: c8608d1ac2c4219f9a0f6631aa41cd14fd5eb94a70137d98936c8260ba23c83d
Instruction ID: acf468555b04be95a5629c289ab7f11e28a3778c4eb620878b7c2cc30d61edf0
Opcode Fuzzy Hash: c8608d1ac2c4219f9a0f6631aa41cd14fd5eb94a70137d98936c8260ba23c83d
Instruction Fuzzy Hash: 9FA17BB1154245AFD700EF54C881EABB7ECFF85304F40492DF1998B1A2EB71EA49CB92

Function 002F2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00300DB6: std::exception::exception.LIBCMT ref: 00300DEC
Part of subcall function 00300DB6: __CxxThrowException@8.LIBCMT ref: 00300E01

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 002E7A51: _memmove.LIBCMT ref: 002E7AAB

__swprintf.LIBCMT ref: 002F2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 002F2D66

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 66ca1ba385f720eddce27adb04c237e62179a4bc672457c34057ca0263895a2c
Instruction ID: 8610b9a5e594614c3b2fddb3f8167f370afbfcaa20c64881124aaf0067de6c77
Opcode Fuzzy Hash: 66ca1ba385f720eddce27adb04c237e62179a4bc672457c34057ca0263895a2c
Instruction Fuzzy Hash: 7591CC31128215DFC715EF25D896C7EB7A8EF85350F50082DF9869B2A2EB30ED58CB52

Function 0034B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 002E4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002E4743,?,?,002E37AE,?), ref: 002E4770

CoInitialize.OLE32(00000000), ref: 0034B9BB
CoCreateInstance.OLE32(00372D6C,00000000,00000001,00372BDC,?), ref: 0034B9D4
CoUninitialize.OLE32 ref: 0034B9F1

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

Strings

.lnk, xrefs: 0034B99D, 0034B9AB

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 836b7c3fb59430bc50a72437c7057b1a7174d4824d7ab6fe0aa9ad371ec44926
Instruction ID: bfffc9cd5017962ed3338d48cbb65ee20e56f33dcd76d9173f4ce39625384ee3
Opcode Fuzzy Hash: 836b7c3fb59430bc50a72437c7057b1a7174d4824d7ab6fe0aa9ad371ec44926
Instruction Fuzzy Hash: B1A142756042419FCB01EF15C884D6ABBE5FF89314F058999F8999B3A2CB31EC45CB92

Function 0033B2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0033B4BE

Strings

%7, xrefs: 0033B561
Container, xrefs: 0033B43B
AutoIt3GUI, xrefs: 0033B436

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%7
API String ID: 3565006973-1255959897
Opcode ID: de1a13191a76bb87ab94ed22b6e6f698801ed1f6fb588369375862526501cdaa
Instruction ID: c90574c5243662c624a052ae05b6c2d12ea0e7048a02989f80a3f96811b840ff
Opcode Fuzzy Hash: de1a13191a76bb87ab94ed22b6e6f698801ed1f6fb588369375862526501cdaa
Instruction Fuzzy Hash: BC914974600601EFDB15DF64C8C4B6ABBE9FF49710F20856DEA4ACB6A1DB70E841CB60

Function 0030501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 003050AD

Part of subcall function 003100F0: __87except.LIBCMT ref: 0031012B

Strings

pow, xrefs: 00305085, 003050A2

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: f64a88d4a615471583a83ae0cae1f709cf9702af272935bd0e30d519c9c71480
Instruction ID: ae3d70cc267bcfbeced1989c500db2014b516449058bf29991d94d7de0d6622e
Opcode Fuzzy Hash: f64a88d4a615471583a83ae0cae1f709cf9702af272935bd0e30d519c9c71480
Instruction Fuzzy Hash: 03518D74A0A60296DB1F7724CC613BF3BD89B44700F208D69E4D58A2E9DF788DD49E86

Function 00328584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0032862B
_memmove.LIBCMT ref: 00328685

Strings

_/, xrefs: 003286FF, 0032DFDC, 0032DFF8
3c/, xrefs: 0032860C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _memmove
String ID: 3c/$_/
API String ID: 4104443479-3203948279
Opcode ID: 1cf7db0550346c3bc9676e85fe692b9724af8a6ea3322f96e1694cf8209fb601
Instruction ID: 310100961ba48a1f79367e7726a70666a8a1f8251c0c6d25928cba6c5895abcd
Opcode Fuzzy Hash: 1cf7db0550346c3bc9676e85fe692b9724af8a6ea3322f96e1694cf8209fb601
Instruction Fuzzy Hash: 50517E70E016199FCF25CF68D880AAEBBF1FF44304F248529E95AD7250EB70E965CB51

Function 003397F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003414BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00339296,?,?,00000034,00000800,?,00000034), ref: 003414E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0033983F

Part of subcall function 00341487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003392C5,?,?,00000800,?,00001073,00000000,?,?), ref: 003414B1

Part of subcall function 003413DE: GetWindowThreadProcessId.USER32(?,?), ref: 00341409
Part of subcall function 003413DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0033925A,00000034,?,?,00001004,00000000,00000000), ref: 00341419
Part of subcall function 003413DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0033925A,00000034,?,?,00001004,00000000,00000000), ref: 0034142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003398AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003398F9

Strings

@, xrefs: 00339911

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: e4a17746a452757ded543868da5133210a5aa2ec658fade120f7c1d77b2ca3c7
Instruction ID: c9fbffffc051d55f011abf95859020fd0ceabd788d1677a3340c0ce40a917411
Opcode Fuzzy Hash: e4a17746a452757ded543868da5133210a5aa2ec658fade120f7c1d77b2ca3c7
Instruction Fuzzy Hash: 3A41427690011CBFDB11DFA5CC85BDEBBB8EB49300F004199FA55BB191DA716E85CBA0

Function 00367946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0036F910,00000000,?,?,?,?), ref: 003679DF
GetWindowLongW.USER32 ref: 003679FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00367A0C

Strings

SysTreeView32, xrefs: 003679B1

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 5c31c9249b3d7f5107ef674a94dbc115219fea15cc555f16f8e21c0be7d80a76
Instruction ID: 8863947092a8d8b4bad7e89086fd556e4d0e94117d5bdbef880225d9a5bc6f8e
Opcode Fuzzy Hash: 5c31c9249b3d7f5107ef674a94dbc115219fea15cc555f16f8e21c0be7d80a76
Instruction Fuzzy Hash: D731E131204206AFDB128F78DC41BEA77A9EF05328F658725F876A32E4D731ED608B50

Function 003673D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00367461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00367475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00367499

Strings

SysMonthCal32, xrefs: 0036742C

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: dcc88928dc89ecdba0e5352a5e8cc038cbf6b0be198be59bada47e18ca757580
Instruction ID: da2edccd9198848f0dfb2455d7b6f2ad187497c36790c03d3d393c6a7ba2a236
Opcode Fuzzy Hash: dcc88928dc89ecdba0e5352a5e8cc038cbf6b0be198be59bada47e18ca757580
Instruction Fuzzy Hash: B5218032504218ABDF138F55CC46FEA3B69EB48724F124114FA156B194DAB5A891DBA0

Function 00367B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00367C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00367C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00367C5F

Strings

msctls_updown32, xrefs: 00367BC4

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 3ef24d4a66e7c02bae1d7ba6ee9c4fe4ec40b0632d8c6623302d5cf6585a1c7a
Instruction ID: c8945d588b3d934e1df4948130be8d999856d844aa3a62c87bfd8e3837d39d9b
Opcode Fuzzy Hash: 3ef24d4a66e7c02bae1d7ba6ee9c4fe4ec40b0632d8c6623302d5cf6585a1c7a
Instruction Fuzzy Hash: 132190B5204208AFEB12DF28DCC1DA777ECEF4A398B554059FA119B3A1CB71EC518B60

Function 00366CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00366D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00366D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00366D70

Strings

Listbox, xrefs: 00366D08

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: cba76e3d659e4989be72d686fb32ed814f962b484a7c38df31b78e11f4535995
Instruction ID: 5e587048e985a543c7ae7db2659488a9216efcdb468cdd29e0cffe0140cb5cd5
Opcode Fuzzy Hash: cba76e3d659e4989be72d686fb32ed814f962b484a7c38df31b78e11f4535995
Instruction Fuzzy Hash: 8A219232610118BFDF128F54DC46FAB3BBEEF89790F02C128FA459B1A4C6719C518BA0

Function 003539E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00353A66

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Strings

, $, xrefs: 00353AA6
%7, xrefs: 003539F4
AUTOITCALLVARIABLE%d, xrefs: 00353A58

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%7
API String ID: 3506404897-1747605927
Opcode ID: b858c1319a1c88a9041f69a388f67ce550558b5af037065a104b56f2a4e2854a
Instruction ID: db2d224d9c2d7425bf952e43f2d9754ff3426ffa4f908df795a6b265c11b9da5
Opcode Fuzzy Hash: b858c1319a1c88a9041f69a388f67ce550558b5af037065a104b56f2a4e2854a
Instruction Fuzzy Hash: 4121CE30A50218AFCF12EF64CC82EEE77B8AF44340F504455F945AB192DB30EA55CF61

Function 0036770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00367772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00367787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00367794

Strings

msctls_trackbar32, xrefs: 00367749

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 224e035606a7369076517428e3822f2059be2e367787270cf05e9eaa2d9b5187
Instruction ID: 14d9828f0cd0da9bcccb6f454e023464326ec2e0909467407c7fe1982631c741
Opcode Fuzzy Hash: 224e035606a7369076517428e3822f2059be2e367787270cf05e9eaa2d9b5187
Instruction Fuzzy Hash: 14110A72244208BFEF215F65CC05FE7776DEF89B58F128128F641A6090D672E851DB20

Function 00306B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00306B93
__calloc_crt.LIBCMT ref: 00306BAC

Strings

9, xrefs: 00306BD1
@B:, xrefs: 00306BC3

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __calloc_crt
String ID: 9$@B:
API String ID: 3494438863-3118007625
Opcode ID: d5861d30b1030a9fffa7d67d069ff2ba00be2a5260499ca9fb47e5b1917ceebf
Instruction ID: 351279f62b0c5b3cb683943068d34c21482c0f23fa63b51897345ae0b405176c
Opcode Fuzzy Hash: d5861d30b1030a9fffa7d67d069ff2ba00be2a5260499ca9fb47e5b1917ceebf
Instruction Fuzzy Hash: 39F068B52067119BF767DF5ABC62B9637A8E711730F500816E105CE5D8EB70885186D4

Function 00309B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00309B94

Part of subcall function 00309C0B: __mtinitlocknum.LIBCMT ref: 00309C1D
Part of subcall function 00309C0B: EnterCriticalSection.KERNEL32(00000000,?,00309A7C,0000000D), ref: 00309C36

__updatetlocinfoEx_nolock.LIBCMT ref: 00309BA4

Part of subcall function 00309100: ___addlocaleref.LIBCMT ref: 0030911C
Part of subcall function 00309100: ___removelocaleref.LIBCMT ref: 00309127
Part of subcall function 00309100: ___freetlocinfo.LIBCMT ref: 0030913B

Strings

89, xrefs: 00309B85
89, xrefs: 00309B8A, 00309B9F, 00309BAB

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 89$89
API String ID: 547918592-2601411883
Opcode ID: 1f03361c8d2f80727743f511fc4ab36efbdcc3f3693f7e17097611b62a1afb21
Instruction ID: 784b2039a433d2b0369f1dd8a66d324eaaad7fa02573f05b917e25dbf9d9d808
Opcode Fuzzy Hash: 1f03361c8d2f80727743f511fc4ab36efbdcc3f3693f7e17097611b62a1afb21
Instruction Fuzzy Hash: A5E0C27194B700EAEE13FBA46923B4C36549B40B31F21225BF0955D0C3CEF408008657

Function 002E4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,002E4B83,?), ref: 002E4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 002E4C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 002E4C50
kernel32.dll, xrefs: 002E4C3F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 1720e9b2d0f75b43005b121ca64a216a6a3523d066f509d9331465b93058a09c
Instruction ID: f8662862e0db65f17a878327cb60788d6d86795c55b36f3e76dfea520f2af768
Opcode Fuzzy Hash: 1720e9b2d0f75b43005b121ca64a216a6a3523d066f509d9331465b93058a09c
Instruction Fuzzy Hash: ABD01730560713CFDB22AF32E90865A76E8AF0A391F61D83AD496D7164E6B4D880CA50

Function 002E4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,002E4BD0,?,002E4DEF,?,003A52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 002E4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 002E4C23

Strings

kernel32.dll, xrefs: 002E4C0C
Wow64DisableWow64FsRedirection, xrefs: 002E4C1D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 0f0d287f444ca46cbacd15ac7c300984a2f3b9cee66ed75b75e1965b37137f4a
Instruction ID: 6d20351016f40cc9d8dda5cb22ae41b5fc651473b3c51f37416766abd5937216
Opcode Fuzzy Hash: 0f0d287f444ca46cbacd15ac7c300984a2f3b9cee66ed75b75e1965b37137f4a
Instruction Fuzzy Hash: 7DD01230551B13CFD721AF71E908646BAD9EF0A791F51DC3AE886D7150E6F0D480C750

Function 00360DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00361039), ref: 00360DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00360E07

Strings

advapi32.dll, xrefs: 00360DF0
RegDeleteKeyExW, xrefs: 00360E01

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 4af21103132c75af552b730d8e33c7e4e08b38c1fb5f19d7be3a3e363d2b0165
Instruction ID: 604dbf21bd86f224a17a9bc72272411c5d2cfde8a255ea6f714a9524c080fec0
Opcode Fuzzy Hash: 4af21103132c75af552b730d8e33c7e4e08b38c1fb5f19d7be3a3e363d2b0165
Instruction Fuzzy Hash: CAD01270510723CFE7225F75D809787B6D9AF06391F12CC7ED486D2150D6F1D4A0C650

Function 003590E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00358CF4,?,0036F910), ref: 003590EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00359100

Strings

GetModuleHandleExW, xrefs: 003590FA
kernel32.dll, xrefs: 003590E9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 8b63400df5fa53cf8f8bc48e7d43b420421ba7ebfe4ee2e8a7dabed094a80747
Instruction ID: 60fe46b327e7cf9b924221199997725c39fb7d9d78ff0d970175f19ccafa1b90
Opcode Fuzzy Hash: 8b63400df5fa53cf8f8bc48e7d43b420421ba7ebfe4ee2e8a7dabed094a80747
Instruction Fuzzy Hash: 56D01235510723CFDB229F31E81864676D8AF06396F13C83AD887D6560E7B0C480C650

Function 00321714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00321718
__swprintf.LIBCMT ref: 00321749

Strings

WIN_XPe, xrefs: 00321788
%.3d, xrefs: 00321723

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 37f26962911bd62e7bfd749393318ce7df0f7af2bd3d378973c386b7025a67c1
Instruction ID: 3ced9919fb3112744da186dd0bae87040fc2edf7dc24110600d410b8c88e47f4
Opcode Fuzzy Hash: 37f26962911bd62e7bfd749393318ce7df0f7af2bd3d378973c386b7025a67c1
Instruction Fuzzy Hash: 1ED05B7285512CFACB139795BD98CFD737CB7A9301F500463F402D2440E2718755EA21

Function 0033717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5524de51302305216f5d945197b925b03a9ad29f67841b4e79badd54b7ddda24
Instruction ID: 78b3f12e31bf8967a183aa80933abc945f55e75f58dcbeded920b6e3f1127ee9
Opcode Fuzzy Hash: 5524de51302305216f5d945197b925b03a9ad29f67841b4e79badd54b7ddda24
Instruction Fuzzy Hash: 8DC16DB5A04216EFCB25CFA5C884EAEBBB5FF48314F158598E805EB251D730ED81DB90

Function 0035E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0035E0BE
CharLowerBuffW.USER32(?,?), ref: 0035E101

Part of subcall function 0035D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0035D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0035E301
_memmove.LIBCMT ref: 0035E314

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 1e7e67f624aae5113538007b2e03087d643086db3f193ef9044550ada5dbaa08
Instruction ID: 8e7d5cbe4459dad49f1d320dc2c2a268346eabd53a0918c7194337e59062db2e
Opcode Fuzzy Hash: 1e7e67f624aae5113538007b2e03087d643086db3f193ef9044550ada5dbaa08
Instruction Fuzzy Hash: 93C16B756083419FC719DF28C480A6ABBE4FF89714F04896EF8999B361D731EA49CF81

Function 00358093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003580C3
CoUninitialize.OLE32 ref: 003580CE

Part of subcall function 0033D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0033D5D4

VariantInit.OLEAUT32(?), ref: 003580D9
VariantClear.OLEAUT32(?), ref: 003583AA

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: e1d04b63062712f54eece8a990021b84ccc657c061f00d2815f3121b5be6aa49
Instruction ID: 5759805de7810dc88aceaaf3206f3420562d8dc5e0a89036f0da25421a3aec0d
Opcode Fuzzy Hash: e1d04b63062712f54eece8a990021b84ccc657c061f00d2815f3121b5be6aa49
Instruction Fuzzy Hash: 66A147792147419FCB01DF25C481F2AB7E4BF89314F444859F99AAB3A2CB30ED49CB82

Function 0033687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0033688E
SysAllocString.OLEAUT32(00000000), ref: 00336937
VariantCopy.OLEAUT32 ref: 00336966
VariantClear.OLEAUT32(?), ref: 0033698D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: f3077d7d492d9139be70de5b54444b14310e763d0884f3f5f148fab1e3aff245
Instruction ID: cc3daf1f431c64f5e0586779b40c4c6760d9699fc80675ab5b9cb1d823ac910b
Opcode Fuzzy Hash: f3077d7d492d9139be70de5b54444b14310e763d0884f3f5f148fab1e3aff245
Instruction Fuzzy Hash: 2951A0B4610341AEDB26EF65D8D6A2AF3E9AF45310F20D81FE586DB691DB70D8808B11

Function 003697F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00FE0A40,?), ref: 00369863
ScreenToClient.USER32(00000002,00000002), ref: 00369896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00369903

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 0b575a09c162a39cdc216f78b24a34d3ab72e79fec7b5c767c8daf68f6666c28
Instruction ID: c16055d85c8d8e7c2a90826532f9ce976bc09244adfde210766e885cfa079160
Opcode Fuzzy Hash: 0b575a09c162a39cdc216f78b24a34d3ab72e79fec7b5c767c8daf68f6666c28
Instruction Fuzzy Hash: 91514E34A00209AFCB12CF14D884AAE7BF9FF46360F11C15AF8659B2A4D731AD51CB90

Function 00339A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00339AD2
__itow.LIBCMT ref: 00339B03

Part of subcall function 00339D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00339DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00339B6C
__itow.LIBCMT ref: 00339BC3

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 694db7a9ea37f758df3a20c8effc77bf8631e81b29de7342ef80026fb78a3e57
Instruction ID: fbe0e1fecfe3282908cc1f53fcc87c76172d9dd1136af019b9dcdfd3516011eb
Opcode Fuzzy Hash: 694db7a9ea37f758df3a20c8effc77bf8631e81b29de7342ef80026fb78a3e57
Instruction Fuzzy Hash: E341C570A00248EBDF12DF55D885BFEBBB9EF44750F40005AF909A7291DBB09D54CBA1

Function 003569AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 003569D1
WSAGetLastError.WSOCK32(00000000), ref: 003569E1

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00356A45
WSAGetLastError.WSOCK32(00000000), ref: 00356A51

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 2b4c69eb06fa706bf2486bc5062aca51f5ee484dd3b2cbe53124fb834c5d6b76
Instruction ID: d24ecd3f58a6481420645cb48c72a66417dad58cedbb6a50a06d225a96a3577c
Opcode Fuzzy Hash: 2b4c69eb06fa706bf2486bc5062aca51f5ee484dd3b2cbe53124fb834c5d6b76
Instruction Fuzzy Hash: F141C4747802006FEB21AF25CC87F7977A89F04B14F84C029FA599F2D2DAB09D508B91

Function 0035641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0036F910), ref: 003564A7
_strlen.LIBCMT ref: 003564D9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 7da1dab50af646cfeea1665b1661547afc8bab96a72c460b9d8dbb9dcd665a8a
Instruction ID: ddf0c4b485942a31b87c514362a3da9bb2d5b59022dea581885e6055efc460d2
Opcode Fuzzy Hash: 7da1dab50af646cfeea1665b1661547afc8bab96a72c460b9d8dbb9dcd665a8a
Instruction Fuzzy Hash: 0141E631640104AFCB15EBA5ECD6FAEB7B8AF15310F908565FD199B2A2EB30AD14CB50

Function 0034B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0034B89E
GetLastError.KERNEL32(?,00000000), ref: 0034B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0034B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0034B915

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: bcabd8a4e16465eaceda3f475c92b330b7fc908e0699c412ce851f34154070c3
Instruction ID: c25964aa86e826a55002dd49800be127628780ba205099750dacf9602cd8f194
Opcode Fuzzy Hash: bcabd8a4e16465eaceda3f475c92b330b7fc908e0699c412ce851f34154070c3
Instruction Fuzzy Hash: 4A413739600650DFCB11EF15C484A59BBE5AF8A310F498099EC8AAF362CB30FD51CF91

Function 00368851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003688DE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: d2be773b5216afda526c1667ccb2f7c7d65a8469d6764ba9d776c282f595884c
Instruction ID: 8c4f7a0e91e07738c0eb3b7d6a271d3859bedda6f46418996e93ee867625da1c
Opcode Fuzzy Hash: d2be773b5216afda526c1667ccb2f7c7d65a8469d6764ba9d776c282f595884c
Instruction Fuzzy Hash: D231C134600108AFEB239B68DC49BBC7BE9EB0E310F95C612FA51E71A5CB70DD509B52

Function 0036AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0036AB60
GetWindowRect.USER32(?,?), ref: 0036ABD6
PtInRect.USER32(?,?,0036C014), ref: 0036ABE6
MessageBeep.USER32(00000000), ref: 0036AC57

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 0107d663ae97372b6fdb2aa59fd30c1ea7b742a952d2d8e22a8af32b59178fcb
Instruction ID: 834b83578d177ae9a578aeac64e08d1ff6d2f829b6103b722330dba34dd3f00a
Opcode Fuzzy Hash: 0107d663ae97372b6fdb2aa59fd30c1ea7b742a952d2d8e22a8af32b59178fcb
Instruction Fuzzy Hash: E3416C30600919DFCB13DF58D884A697BF9FF49710F19C0A9E815EB269D730A841CF92

Function 00340AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00340B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00340B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00340BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00340BFB

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d26e4d544bd2356e999a07d3362e427391ade633f1ed086becbc4dd37f4082ab
Instruction ID: 6474ced9b32a000804534fcdb0883cc72efc1b23b80d8e66a9e9f025821918b3
Opcode Fuzzy Hash: d26e4d544bd2356e999a07d3362e427391ade633f1ed086becbc4dd37f4082ab
Instruction Fuzzy Hash: C1315A30F44208AEFF3B8B258C05BFABBE9EB45318F04425AE6915A1D1C3B9ED409759

Function 00340C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00340C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00340C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00340CE1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00340D33

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c6ee995b130d64a85ca284df7d3c4c9585dec435c39493a688d7c5ee367e671a
Instruction ID: 05f675658f346f63ee2ebcbdef89565875d1187eca3c7a34ef27586ea48b0f8f
Opcode Fuzzy Hash: c6ee995b130d64a85ca284df7d3c4c9585dec435c39493a688d7c5ee367e671a
Instruction Fuzzy Hash: 81314830F40208AEFF3A8B6598447FEBBE9AF46314F04832AE6915E5D1C375AD458791

Function 003161C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 003161FB
__isleadbyte_l.LIBCMT ref: 00316229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00316257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0031628D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 70225420bb0b08e69c5570dc495601d96040d4341f152fa8aa38145b3f495c74
Instruction ID: 4c986465ff1529d5efa56bcfaf0d52177d05c5bd09a32808959002f5b5942ac2
Opcode Fuzzy Hash: 70225420bb0b08e69c5570dc495601d96040d4341f152fa8aa38145b3f495c74
Instruction Fuzzy Hash: E331C130600246AFDF2B8FA4CC46BFA7BA9FF4A310F164428E8648B1A1D730D991D790

Function 00364EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00364F02

Part of subcall function 00343641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0034365B
Part of subcall function 00343641: GetCurrentThreadId.KERNEL32 ref: 00343662
Part of subcall function 00343641: AttachThreadInput.USER32(00000000,?,00345005), ref: 00343669

GetCaretPos.USER32(?), ref: 00364F13
ClientToScreen.USER32(00000000,?), ref: 00364F4E
GetForegroundWindow.USER32 ref: 00364F54

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 70fa9fe08685559c62d80efa496dab66280110455b40c6d26808a6cd74609413
Instruction ID: ad0af05133926d2b6895f24900a4eade9a7293b589595ef9fdeb7a65fe80fc87
Opcode Fuzzy Hash: 70fa9fe08685559c62d80efa496dab66280110455b40c6d26808a6cd74609413
Instruction Fuzzy Hash: D8311CB2D00108AFDB01EFA6C8859EEB7FDEF94300F50406AE415E7211DA759E55CFA1

Function 0036C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

GetCursorPos.USER32(?), ref: 0036C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0031B9AB,?,?,?,?,?), ref: 0036C4E7
GetCursorPos.USER32(?), ref: 0036C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0031B9AB,?,?,?), ref: 0036C56E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 84e5fb98c71ba465e22c7d107a3f12065b15d22883dea11d487f5f07e7208bfc
Instruction ID: cb85e46887e7f0037b33202112a65d9a90d723b9158406baa4e0b09dbb28a3f6
Opcode Fuzzy Hash: 84e5fb98c71ba465e22c7d107a3f12065b15d22883dea11d487f5f07e7208bfc
Instruction Fuzzy Hash: 5D31C335610158EFCB17CF59CC58EBA7BB9EB0A310F448065FA468B262C731AD50DFA4

Function 00338656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0033810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00338121
Part of subcall function 0033810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0033812B
Part of subcall function 0033810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0033813A
Part of subcall function 0033810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00338141
Part of subcall function 0033810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00338157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 003386A3
_memcmp.LIBCMT ref: 003386C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003386FC
HeapFree.KERNEL32(00000000), ref: 00338703

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: b039c2c3ec098faf6badf33524c4e9476aa43efe13cfd38abab361ae86d657b2
Instruction ID: d1d305e52328886ddc059f6f29e7c045ed9b8bcdad926df29d90985c326a55c9
Opcode Fuzzy Hash: b039c2c3ec098faf6badf33524c4e9476aa43efe13cfd38abab361ae86d657b2
Instruction Fuzzy Hash: 7E21B071E00209EFDB11DFA8C99ABEEB7B8FF45304F158159E544AB240DB70AE05CB90

Function 0030098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 003009AE

Part of subcall function 002E5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00347896,?,?,00000000), ref: 002E5A2C
Part of subcall function 002E5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00347896,?,?,00000000,?,?), ref: 002E5A50

_fprintf.LIBCMT ref: 003009E5
OutputDebugStringW.KERNEL32(?), ref: 00335DBB

Part of subcall function 00304AAA: _flsall.LIBCMT ref: 00304AC3

__setmode.LIBCMT ref: 00300A1A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 9fe03491e0cf77fb9ec57a2c2763f860a56f04aa7c4aca90e707717271bb9c05
Instruction ID: d68a5ee8da73bbb17d4ccb6dda5c19a44fcd8f9ca59a896907cb011e326daf7a
Opcode Fuzzy Hash: 9fe03491e0cf77fb9ec57a2c2763f860a56f04aa7c4aca90e707717271bb9c05
Instruction Fuzzy Hash: BA116A71A056487FC706B3B99C57AFE77AC9F42320F500015F2045B1D2EF2159528BE1

Function 00351767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003517A3

Part of subcall function 0035182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0035184C
Part of subcall function 0035182D: InternetCloseHandle.WININET(00000000), ref: 003518E9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 60a4f3625f05ea7cd47639e9a3c75b67b5eb7143731bbbae8c9dcb1758b3d8be
Instruction ID: ca5fc880808b22c32492d0fe80042780fc87fb70fc6033918037ae00bb155f92
Opcode Fuzzy Hash: 60a4f3625f05ea7cd47639e9a3c75b67b5eb7143731bbbae8c9dcb1758b3d8be
Instruction Fuzzy Hash: BD21D435200601BFEB239F60DC00FBBBBADFF48712F10412AFD1196660DB71981497A0

Function 00343A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0036FAC0), ref: 00343A64
GetLastError.KERNEL32 ref: 00343A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00343A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0036FAC0), ref: 00343ADF

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 710525c68e13212b4707125e7367667b77fccbfd53c47824f8222b6ec579b80d
Instruction ID: 6e0ac34f865ca226e8a268a3edfb7cfdf0bb07a52c6e30fb7132db7616608f03
Opcode Fuzzy Hash: 710525c68e13212b4707125e7367667b77fccbfd53c47824f8222b6ec579b80d
Instruction Fuzzy Hash: 282183745882059F8311DF28D8818AAB7E8FE55364F104A2DF499CB2A1D731EE45CF92

Function 003150E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00315101

Part of subcall function 0030571C: __FF_MSGBANNER.LIBCMT ref: 00305733
Part of subcall function 0030571C: __NMSG_WRITE.LIBCMT ref: 0030573A
Part of subcall function 0030571C: RtlAllocateHeap.NTDLL(00FC0000,00000000,00000001,00000000,?,?,?,00300DD3,?), ref: 0030575F

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a87c3a81c944720b19ce75709743267e6537b40e78d4a25679fd0b145ea51f68
Instruction ID: bd952784376ee266ad4bbfe4ac175b27a4c59eabf618a40e5da954358fd2868c
Opcode Fuzzy Hash: a87c3a81c944720b19ce75709743267e6537b40e78d4a25679fd0b145ea51f68
Instruction Fuzzy Hash: 6011E372502A11FFCF272F74BC5579E379CAB993A1F214539F9449A290DE7088808790

Function 002E44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002E44CF

Part of subcall function 002E407C: _memset.LIBCMT ref: 002E40FC
Part of subcall function 002E407C: _wcscpy.LIBCMT ref: 002E4150
Part of subcall function 002E407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002E4160

KillTimer.USER32(?,00000001,?,?), ref: 002E4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002E4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0031D4B9

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 475b281b07b4146be5149801b8413126bc1b728e93b23e83b4b3eee5b8271dfc
Instruction ID: 77101d15a18c985a6d819c35e306c1ab6ef35d075855f578a26de38869e1cc57
Opcode Fuzzy Hash: 475b281b07b4146be5149801b8413126bc1b728e93b23e83b4b3eee5b8271dfc
Instruction Fuzzy Hash: 37213470804384AFE733DB25D849BEBBBECAF16308F44049DE68E56181CBB02A84CB41

Function 00356369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002E5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00347896,?,?,00000000), ref: 002E5A2C
Part of subcall function 002E5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00347896,?,?,00000000,?,?), ref: 002E5A50

gethostbyname.WSOCK32(?), ref: 00356399
WSAGetLastError.WSOCK32(00000000), ref: 003563A4
_memmove.LIBCMT ref: 003563D1
inet_ntoa.WSOCK32(?), ref: 003563DC

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: eb5ad7030c01a4844ea14d465fe68c9bc131c56e25a6cb5163bd4f790c65b0e8
Instruction ID: 878bc3cf7466b5c925c556c470cf8640fa00f293858865bd9246bcb1df1e0ac4
Opcode Fuzzy Hash: eb5ad7030c01a4844ea14d465fe68c9bc131c56e25a6cb5163bd4f790c65b0e8
Instruction Fuzzy Hash: 7E116071510109AFCB05FBA5ED86CEEBBB8AF04315B544075F906AB272DB30AE14CBA1

Function 00338B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00338B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00338B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00338B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00338BA4

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f7d238406286e6daf3c9091215690c689826b6f4c2814a4b41259279bf1d82ff
Instruction ID: 15f3896696d5088d9cf64fc7f843d49db52dcaed740b1296ffd02ac399c47eca
Opcode Fuzzy Hash: f7d238406286e6daf3c9091215690c689826b6f4c2814a4b41259279bf1d82ff
Instruction Fuzzy Hash: BE110679901219BFEB11DBA5C885EADFBB8EB48710F2040A5EA00B7290DA716E11DB94

Function 002E1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 002E2612: GetWindowLongW.USER32(?,000000EB), ref: 002E2623

DefDlgProcW.USER32(?,00000020,?), ref: 002E12D8
GetClientRect.USER32(?,?), ref: 0031B5FB
GetCursorPos.USER32(?), ref: 0031B605
ScreenToClient.USER32(?,?), ref: 0031B610

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 861f86828fb74d75efea17ed555680c8c1e8329fb7acd95db49b17d750b355ff
Instruction ID: f4647431f3ceee319ff6629229040a8b7278cf40ded8d6902d2c85d1b4c4259e
Opcode Fuzzy Hash: 861f86828fb74d75efea17ed555680c8c1e8329fb7acd95db49b17d750b355ff
Instruction Fuzzy Hash: 9D112835A50069EFCB01DFA9DC899EE77BCFB06300F804466FA12E7140C770AA618BA5

Function 0033D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0033D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0033D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0033D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0033D897

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 4423485c98c46557c68daf007d30fbff90da9b634b236226c94216ca25435952
Instruction ID: fac3296e12d92898fe16b041a6113f485b55fb4ba07d0aaaabbda7eea5a24cf9
Opcode Fuzzy Hash: 4423485c98c46557c68daf007d30fbff90da9b634b236226c94216ca25435952
Instruction Fuzzy Hash: AF113C75A05304DBE3228F51FC88F92BBACEB00B00F108569A516DB450D7F0F5499BA1

Function 00316FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00316FDB

Part of subcall function 003176C2: __fltout2.LIBCMT ref: 003176EB

__cftog_l.LIBCMT ref: 00317001
__cftoe_l.LIBCMT ref: 00317033

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 2f50f4407d939a0f8253c584fe91ad8e243cf3d7c031c3cbd24e4e8b4749d5b4
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 88014B7644824ABFCF1B5E84CC05CEE3F76BB1C390F598415FA1858031D236CAB1AB81

Function 0036B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0036B2E4
ScreenToClient.USER32(?,?), ref: 0036B2FC
ScreenToClient.USER32(?,?), ref: 0036B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036B33B

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 71d797a7aad13c7b5303adb4a3becb22553b0c0a932d8de08e6839f075583065
Instruction ID: c18ec6d82afba46145152cb439898723802d4559f7f6dbfb975bf84b2ae98439
Opcode Fuzzy Hash: 71d797a7aad13c7b5303adb4a3becb22553b0c0a932d8de08e6839f075583065
Instruction Fuzzy Hash: 031143B9D00209EFDB41CFA9D8849EEFBB9FB08310F108166E914E3220D775AA658F50

Function 00346BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00346BE6

Part of subcall function 003476C4: _memset.LIBCMT ref: 003476F9

_memmove.LIBCMT ref: 00346C09
_memset.LIBCMT ref: 00346C16
LeaveCriticalSection.KERNEL32(?), ref: 00346C26

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 107631e9735b7c23442ad846313c755c655bfcf5882c6da79cc013802a9d2c4e
Instruction ID: 1e0d641e6d2a6c8b7cb9793ab1946ea998baa902dddc41a6abdb27866d6cacad
Opcode Fuzzy Hash: 107631e9735b7c23442ad846313c755c655bfcf5882c6da79cc013802a9d2c4e
Instruction Fuzzy Hash: F7F05E3A200100AFCF026F55EC95A8ABF6AEF45320F04C061FE086E267C771E821CBB4

Function 002E2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 002E2231
SetTextColor.GDI32(?,000000FF), ref: 002E223B
SetBkMode.GDI32(?,00000001), ref: 002E2250
GetStockObject.GDI32(00000005), ref: 002E2258
GetWindowDC.USER32(?,00000000), ref: 0031BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 0031BE90
GetPixel.GDI32(00000000,?,00000000), ref: 0031BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 0031BEC2
GetPixel.GDI32(00000000,?,?), ref: 0031BEE2
ReleaseDC.USER32(?,00000000), ref: 0031BEED

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: f9a48139c632fc2718ec60d258c0ef4d649bd8a31989485b60dd778e433561dc
Instruction ID: 5550716793c7f1261e37cb5d9ebab3731ea0eba97978b8a4475e389395cd5ed2
Opcode Fuzzy Hash: f9a48139c632fc2718ec60d258c0ef4d649bd8a31989485b60dd778e433561dc
Instruction Fuzzy Hash: E0E03932504244EEDB265F64FC0D7D87F19EB06336F00C366FA69880E187B18990DB22

Function 00338712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0033871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,003382E6), ref: 00338722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,003382E6), ref: 0033872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,003382E6), ref: 00338736

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 774e44ef7ee3bc9bee731e5850ac5cc2512203e21b1d4b2f7cc4dc57d06a7984
Instruction ID: 05dcccb6ddf62a8229c073f0b2aa680233157bb58b5f8932b6f5c087fe5e1187
Opcode Fuzzy Hash: 774e44ef7ee3bc9bee731e5850ac5cc2512203e21b1d4b2f7cc4dc57d06a7984
Instruction Fuzzy Hash: 47E08637615312AFD7215FB0BD0CB563BACFF50791F15C828F285CA040DA748481CB50

Function 002E6240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%7, xrefs: 002E624E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID:
String ID: %7
API String ID: 0-3028279668
Opcode ID: 5e9d5748ac5482d0191b2a99f8129b4d04e11f0e703dfc9c2ee08a4e23388867
Instruction ID: 2b348093716bbade3daf61a9b4e660a34a7c770fd532e2cd0b4fe8a1048f43b1
Opcode Fuzzy Hash: 5e9d5748ac5482d0191b2a99f8129b4d04e11f0e703dfc9c2ee08a4e23388867
Instruction Fuzzy Hash: 64B10B71CA018ADBCF24DF96C4899FEB7B5FF68350F904026E901A7191DB709EA1CB51

Function 0035AEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 0035AFAE

Strings

xb:, xrefs: 0035B010
xb:, xrefs: 0035AFE4

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: __itow_s
String ID: xb:$xb:
API String ID: 3653519197-137600594
Opcode ID: 0544ebd401e8f54882d9a6ddd19b053599889e8e3ed9a037e0fb0c265b05b1ba
Instruction ID: 674442639d7e3a2fbd86fa82c97641b18f3ce85996bdc766cbad090ad2cd903a
Opcode Fuzzy Hash: 0544ebd401e8f54882d9a6ddd19b053599889e8e3ed9a037e0fb0c265b05b1ba
Instruction Fuzzy Hash: 40B18F70A00109EFCB15DF55C891EAAFBB9FF59301F148159FD459B2A2EB30EA85CB60

Function 0034AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 002FFC86: _wcscpy.LIBCMT ref: 002FFCA9

Part of subcall function 002E9837: __itow.LIBCMT ref: 002E9862
Part of subcall function 002E9837: __swprintf.LIBCMT ref: 002E98AC

__wcsnicmp.LIBCMT ref: 0034B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0034B0F6

Strings

LPT, xrefs: 0034B027

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 633acb625381577f7419fc43848d367f1bf9b16f69d719846395fc4374f33aca
Instruction ID: 7690389f9fb3926100de61269632a86ac870f7c62bee820cbbc92a2079f3b976
Opcode Fuzzy Hash: 633acb625381577f7419fc43848d367f1bf9b16f69d719846395fc4374f33aca
Instruction Fuzzy Hash: 71614E75A10219AFCB15DF94C891EAEF7F8EF08710F11406AF956AB2A1D770EE84CB50

Function 002F2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 002F2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 002F2981

Strings

@, xrefs: 002F2975

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 1fa32227cf01968ab582adc70d28b2fad5b886f5b14aba9bce573acb358f13fb
Instruction ID: 7e344b2013f0a3c04f5353816378b717edd035b3be4bf542c1e6ac0052690445
Opcode Fuzzy Hash: 1fa32227cf01968ab582adc70d28b2fad5b886f5b14aba9bce573acb358f13fb
Instruction Fuzzy Hash: 2E5147724187849BD320EF11D886BAFBBECFB85344F82885DF2D8410A1DB718579CB66

Function 00349734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 002E4F0B: __fread_nolock.LIBCMT ref: 002E4F29

_wcscmp.LIBCMT ref: 00349824
_wcscmp.LIBCMT ref: 00349837

Strings

FILE, xrefs: 00349770

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 75b5d58e0e850d619f0b4e142d15f360571802dc34475ab937eede1435c9eece
Instruction ID: a9c80596108becfce9dadb602ff7b78e756a1268108a8f03949c7be3453a98e4
Opcode Fuzzy Hash: 75b5d58e0e850d619f0b4e142d15f360571802dc34475ab937eede1435c9eece
Instruction Fuzzy Hash: 6F41D971A40209BADF21ABA5CC45FEFBBFDDF86710F41046AF904EB181DA71A9048B61

Function 00320574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0032057F

Strings

Dd:, xrefs: 002EA317
Dd:, xrefs: 002EA151

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClearVariant
String ID: Dd:$Dd:
API String ID: 1473721057-3397519643
Opcode ID: 7a851d629a4c650d3394494ad433ef64f64076676f8bc90b1674157a7ede41a2
Instruction ID: fd6a93b296b6fe0c8601b8074f7ee1e6b3773cc9ebc5de278f09b9d8cc024ab9
Opcode Fuzzy Hash: 7a851d629a4c650d3394494ad433ef64f64076676f8bc90b1674157a7ede41a2
Instruction Fuzzy Hash: 7C5102786683828FD755CF1AC484A1ABBF1FB99340F94885DE9858B361D331EC91CF42

Function 0035258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0035259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 003525D4

Strings

|, xrefs: 003525A5

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: e7735c8383783b5bdf548a0d41558d0dda339d271ae761125c99ca431c89aa6b
Instruction ID: 3b6583057f34ed779e9fe22595135ff92edd55e29e17dbef914b5eeb1b86b358
Opcode Fuzzy Hash: e7735c8383783b5bdf548a0d41558d0dda339d271ae761125c99ca431c89aa6b
Instruction Fuzzy Hash: C6311671C10159ABCF02AFA1CC85EEFBFB8FF09310F100069ED14A6162EA315956DF60

Function 00367A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00367B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00367B76

Strings

', xrefs: 00367ACA

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 3b1beaa7afb124fda37a335b154cc83ed0340a4c25393f4b12b0f5a94ba8e5a7
Instruction ID: b82d37cb4c2df96417b85e9d62ee1393fe9a588534cd7a246793efad7a35239e
Opcode Fuzzy Hash: 3b1beaa7afb124fda37a335b154cc83ed0340a4c25393f4b12b0f5a94ba8e5a7
Instruction Fuzzy Hash: 61413974A043099FDB15CFA4C880BEABBB9FF09304F51416AE905EB395E770A951CFA0

Function 00366A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00366B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00366B53

Strings

static, xrefs: 00366AB3

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 57b37161a559aba03922c796ec91c6cb0d92af1d3a9c2c28bca10a580f57dd10
Instruction ID: 7a88192db34492cfd62256a55039115823d1170fad7ce61f54017211cd0300ce
Opcode Fuzzy Hash: 57b37161a559aba03922c796ec91c6cb0d92af1d3a9c2c28bca10a580f57dd10
Instruction Fuzzy Hash: E631BEB1210204AEDB129F65CC81BFB77ACFF48760F11C619F9A6D7190DA30AC91CB60

Function 003428A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00342911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0034294C

Strings

0, xrefs: 0034290A

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 28bb7e1ab2b48234f50d131bbfa15dcc4290b5993f6879c12f82b1fe6903da51
Instruction ID: be6383f2906c9c7e7e84b401e738edc9a6b3bde428195319387a816517e58cc4
Opcode Fuzzy Hash: 28bb7e1ab2b48234f50d131bbfa15dcc4290b5993f6879c12f82b1fe6903da51
Instruction Fuzzy Hash: FC31C1316003099FEB2ACF58C885BAFBBF8EF45350F560029F985BE1A0D770A950CB51

Function 003666D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00366761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0036676C

Strings

Combobox, xrefs: 0036672E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 183dabc95e4765e1f6c4e621023ecbf12be967f18afc09ca1c3365ddec57e6f0
Instruction ID: 01443cc4a3d3be59179ef5b1fdee746ce9ba8d97d6ab179f92fc050a38ff9415
Opcode Fuzzy Hash: 183dabc95e4765e1f6c4e621023ecbf12be967f18afc09ca1c3365ddec57e6f0
Instruction Fuzzy Hash: 4611B271200208AFEF128F54DC82EEB7B6EEB483A8F118129F91497294D671DC618BA0

Function 00366C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 002E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002E1D73
Part of subcall function 002E1D35: GetStockObject.GDI32(00000011), ref: 002E1D87
Part of subcall function 002E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 002E1D91

GetWindowRect.USER32(00000000,?), ref: 00366C71
GetSysColor.USER32(00000012), ref: 00366C8B

Strings

static, xrefs: 00366C4E

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 516daead2c1fec309825b49bc6556b04abd0f782fc9c92d5676780c0c126be40
Instruction ID: 259df5b0a03f9e09b6475e39ed7b2b52832a1d5426b7cdeeebbfb9b4c4cfb715
Opcode Fuzzy Hash: 516daead2c1fec309825b49bc6556b04abd0f782fc9c92d5676780c0c126be40
Instruction Fuzzy Hash: 5D212972510209AFDF05DFA8DC46AEA7BA8FB08354F018629F995D2250D775E860DB60

Function 00366920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 003669A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 003669B1

Strings

edit, xrefs: 00366986

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 593015561f90e3029963d333b5f57a37638675672bea4791171981f82c4d77de
Instruction ID: 6a2f2be232a4e448246275c88aa7526457c388e4fcf060a57d667160f9f03fc8
Opcode Fuzzy Hash: 593015561f90e3029963d333b5f57a37638675672bea4791171981f82c4d77de
Instruction Fuzzy Hash: 55118F71510104AFEB128E74DC46AEB37ADEB063B8F518724FDA5A71E8C771DC509B60

Function 003429AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00342A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00342A41

Strings

0, xrefs: 00342A18

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 6039f3b1911b3fa5a3aac4a698663a7e8679fa6ff4a1233b7b9674cbd945c803
Instruction ID: 5f8cd73c883eda9c5b60ebd2eac229eaf92fc3f2114a165f92cc88c06fb47921
Opcode Fuzzy Hash: 6039f3b1911b3fa5a3aac4a698663a7e8679fa6ff4a1233b7b9674cbd945c803
Instruction Fuzzy Hash: D4117C32A01114AEDB33DA98D844BABB7FCAB46314F964021FD55BB290DB70BD4AC791

Function 003521D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0035222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00352255

Strings

<local>, xrefs: 0035221D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: de0a400af8abe73940ef4071524444368da4829a001907424d00f63a042a76d9
Instruction ID: fb8377f5aef1910367ead797345f88cbf416c58400d358866f39a86492842446
Opcode Fuzzy Hash: de0a400af8abe73940ef4071524444368da4829a001907424d00f63a042a76d9
Instruction Fuzzy Hash: 5611E074601225BEDB268F118C84EBBFBACFF17352F10862AFD1586410D2705988DAF0

Function 002F092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,002E3C14,003A52F8,?,?,?), ref: 002F096E

Part of subcall function 002E7BCC: _memmove.LIBCMT ref: 002E7C06

_wcscat.LIBCMT ref: 00324CB7

Strings

S:, xrefs: 002F09AE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: S:
API String ID: 257928180-3014345657
Opcode ID: 79d5eb4c2877752efcf4714b932ce16a0b248b5e5ec0a8f80cfcddc446b45928
Instruction ID: 6ca3896426b5468065f48f00bdb2f3f986f38a4b0a44a66ddb2922a063e2f20e
Opcode Fuzzy Hash: 79d5eb4c2877752efcf4714b932ce16a0b248b5e5ec0a8f80cfcddc446b45928
Instruction Fuzzy Hash: 2511A935A1520DAB8B41EB64DC45EDDB3E8EF08780B4084B5FA44D7186EAF096944B10

Function 00338E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 0033AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0033AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00338E73

Strings

ComboBox, xrefs: 00338E12
ListBox, xrefs: 00338E3D

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 58f61f93fcad743af268a3f38b71ad2cbf13ed03e810257b58b2aa1d1204658b
Instruction ID: 97232889f08c289d22368ede6e37e5b331ece26c3be8e7eedcc2c669a2d88c50
Opcode Fuzzy Hash: 58f61f93fcad743af268a3f38b71ad2cbf13ed03e810257b58b2aa1d1204658b
Instruction Fuzzy Hash: FB012871A59228ABCF16EBA0CC828FE7368EF01320F400A19F871572E2DF315818C690

Function 00338CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 0033AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0033AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00338D6B

Strings

ComboBox, xrefs: 00338D0A
ListBox, xrefs: 00338D35

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 773624dd2b2baf6aec11de0e82258ea1088f3986fc7833cb9c3e6c7749957970
Instruction ID: 70ebbed6ec37377f4719e8772a7951400b8b6b1dcc068e88ddfa3dd7b749123f
Opcode Fuzzy Hash: 773624dd2b2baf6aec11de0e82258ea1088f3986fc7833cb9c3e6c7749957970
Instruction Fuzzy Hash: AF01F771A55208ABCF16EBA1CD92EFE73ACDF15300F500019B805672E2DF115E18D6B2

Function 00338D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E7DE1: _memmove.LIBCMT ref: 002E7E22

Part of subcall function 0033AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0033AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00338DEE

Strings

ComboBox, xrefs: 00338D8F
ListBox, xrefs: 00338DBA

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: cc4b169158f7c5f7e696087a75d4be925132358acd7cce778d999ed966607135
Instruction ID: d50346a934dc88bf792a76f9bc73087e1c62d293da74ccc750b01339c0ae99c5
Opcode Fuzzy Hash: cc4b169158f7c5f7e696087a75d4be925132358acd7cce778d999ed966607135
Instruction Fuzzy Hash: 84012671A99208BBCF12EBA4CD92EFE77ACCF11300F500019B805632D2DE218E18D6B2

Function 0033C4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0033C534

Part of subcall function 0033C816: _memmove.LIBCMT ref: 0033C860
Part of subcall function 0033C816: VariantInit.OLEAUT32(00000000), ref: 0033C882
Part of subcall function 0033C816: VariantCopy.OLEAUT32(00000000,?), ref: 0033C88C

VariantClear.OLEAUT32(?), ref: 0033C556

Strings

d}9, xrefs: 0033C517

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}9
API String ID: 2932060187-1963668829
Opcode ID: 911163420166d4261d9284d03552f7a39ed7e47e14302879b0b8fa1c63daa3d1
Instruction ID: 7ed093e91ba6a3637a3f81cc427e9498f2186fd92a4226f30e2a1bbe8e9d007d
Opcode Fuzzy Hash: 911163420166d4261d9284d03552f7a39ed7e47e14302879b0b8fa1c63daa3d1
Instruction Fuzzy Hash: E511FEB19007089FC711DF9AD88489AB7F8FB18310B50852EE58A97651D771AA44CF90

Function 00344F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00344F46
_wcscmp.LIBCMT ref: 00344F58

Strings

#32770, xrefs: 00344F52

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 913ff7342c77c77199eaf33acc0569ea43dafe4e788fa8ea706662102531f15d
Instruction ID: db6f414d0e4239b6eb87b0f7eb074cbb52666a69dffedd784872f7784e8e7e44
Opcode Fuzzy Hash: 913ff7342c77c77199eaf33acc0569ea43dafe4e788fa8ea706662102531f15d
Instruction Fuzzy Hash: A6E0D1335042282BD7119755AC45FA7F7ECDB46B70F010067FD04D7051D5609A4587E0

Function 0031B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0031B314: _memset.LIBCMT ref: 0031B321

Part of subcall function 00300940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0031B2F0,?,?,?,002E100A), ref: 00300945

IsDebuggerPresent.KERNEL32(?,?,?,002E100A), ref: 0031B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,002E100A), ref: 0031B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0031B2FE

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 7d8704ab5675f3956ae2c4399d7f76c459d17c6216fdf80c82d3be7379894643
Instruction ID: 394643ab5937708680c955c79e09c52191bea7f8fdc814d5b9951666aaa4fa29
Opcode Fuzzy Hash: 7d8704ab5675f3956ae2c4399d7f76c459d17c6216fdf80c82d3be7379894643
Instruction Fuzzy Hash: FAE06D782007408FD726AF28E404782BAE8EF08304F008D6CE496C7650E7B4E484CBA1

Function 00321935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00321775

Part of subcall function 0035BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0032195E,?), ref: 0035BFFE
Part of subcall function 0035BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0035C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0032196D

Strings

WIN_XPe, xrefs: 00321788

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 0646b767f03fd1b7f365c00fc5e3683f2d274821cdb84bc1d190a100a47632b9
Instruction ID: 3d3991ce29390f18207d3e2ff0e45b654444c524b821e77c05216dc9c274a4a1
Opcode Fuzzy Hash: 0646b767f03fd1b7f365c00fc5e3683f2d274821cdb84bc1d190a100a47632b9
Instruction Fuzzy Hash: 04F0ED71814119DFDB27DFA9EA84AECBBFCBB98301F640095E102A61A0D7B14F85DF60

Function 00365964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0036596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00365981

Part of subcall function 00345244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003452BC

Strings

Shell_TrayWnd, xrefs: 00365967

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: cfc485d57fcd2817e07e8058d7589b48bfd6df77c2ef6ab67eb0c2803556a874
Instruction ID: dec15e8935e3b42a0dd47fd672d08a0196bc902ab37faaa21b7e1cb3a5b99707
Opcode Fuzzy Hash: cfc485d57fcd2817e07e8058d7589b48bfd6df77c2ef6ab67eb0c2803556a874
Instruction Fuzzy Hash: BDD0C931784711BBE665AB70AC0BFD76A58AB42B55F015826F34AAE1D1C9E0A800C654

Function 00365998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003659AE
PostMessageW.USER32(00000000), ref: 003659B5

Part of subcall function 00345244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003452BC

Strings

Shell_TrayWnd, xrefs: 003659A7

Memory Dump Source

Source File: 00000000.00000002.1656155543.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.1656129406.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656243805.0000000000394000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656308009.000000000039E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656330521.00000000003A7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_new booking 9086432659087.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 7407e3d3d8f40a42c4065c106fa164c55e0b7a56772686f03e3dec1a12252f09
Instruction ID: a9745d9840c8988c16c718be9767e6ac3c41c146156217cd45cd74d24b610382
Opcode Fuzzy Hash: 7407e3d3d8f40a42c4065c106fa164c55e0b7a56772686f03e3dec1a12252f09
Instruction Fuzzy Hash: C8D0C9317807117BE666AB70AC0BFD76658AB46B55F015826F346AE1D1C9E0A800C658

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report new booking 9086432659087.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autCBE4.tmp

C:\Users\user\AppData\Local\Temp\unjust

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
new booking 9086432659087.exe

Function 002E3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 002E49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 002E4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00349155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 002E301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 002E3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 002E708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 002E3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 002E3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 002E3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 002EF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 01064220 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 002E39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01064000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142
fileCOMMON

Function 002E407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre