Edit tour

Windows Analysis Report
rDOC24INV0616.exe

Overview

General Information

Sample name:	rDOC24INV0616.exe
Analysis ID:	1575888
MD5:	27245367b5716caadd5ea798614ada6c
SHA1:	2911bbbee9b31885767710b8a146c2b67578f139
SHA256:	3b78171bc9f38f684826c2cd33953cd0023239cdd561637e1593f89dffea56fe
Tags:	exeuser-Porcupine
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rDOC24INV0616.exe (PID: 7396 cmdline: "C:\Users\user\Desktop\rDOC24INV0616.exe" MD5: 27245367B5716CAADD5EA798614ADA6C)

RegSvcs.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\rDOC24INV0616.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alltoursegypt.com", "Username": "admin@alltoursegypt.com", "Password": "OPldome23#12klein"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4164764218.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34edb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f4d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34fd7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35069:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x350d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35145:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x351db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3526b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.4164764218.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4164764218.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: rDOC24INV0616.exe PID: 7396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rDOC24INV0616.exe PID: 7396	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7412	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34edb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f4d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34fd7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35069:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x350d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35145:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x351db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3526b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34edb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f4d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34fd7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35069:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x350d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35145:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x351db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3526b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rDOC24INV0616.exe.38b0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rDOC24INV0616.exe.38b0000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rDOC24INV0616.exe.38b0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330db:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3314d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331d7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33269:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33345:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3346b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 192.254.186.165, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7412, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alltoursegypt.com", "Username": "admin@alltoursegypt.com", "Password": "OPldome23#12klein"}

Multi AV Scanner detection for submitted file

Source: rDOC24INV0616.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: rDOC24INV0616.exe

Joe Sandbox ML: detected

Source: rDOC24INV0616.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: rDOC24INV0616.exe, 00000000.00000003.1702811373.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, rDOC24INV0616.exe, 00000000.00000003.1706514878.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rDOC24INV0616.exe, 00000000.00000003.1702811373.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, rDOC24INV0616.exe, 00000000.00000003.1706514878.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A1445A
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1C6D1 FindFirstFileW,FindClose,	0_2_00A1C6D1
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00A1C75C
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1EF95
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1F0F2
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A1F3F3
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A137EF
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A13B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A13B12
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A1BCBC

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A222EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00A222EE

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.alltoursegypt.com

Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://alltoursegypt.com
Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alltoursegypt.com
Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/01
Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: rDOC24INV0616.exe, 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: rDOC24INV0616.exe, 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000001.00000002.4164764218.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, NmHr1WHWKO.cs

.Net Code: lhg

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A24164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00A24164

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A24164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00A24164

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A23F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00A23F66

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A1001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00A1001C

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A3CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00A3CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rDOC24INV0616.exe.38b0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: This is a third-party compiled AutoIt script.	0_2_009B3B3A
Source: rDOC24INV0616.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: rDOC24INV0616.exe, 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_41a4311d-4
Source: rDOC24INV0616.exe, 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_fb016923-2
Source: rDOC24INV0616.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6ad6bb44-3
Source: rDOC24INV0616.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_b09013d1-5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A1A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00A1A1EF

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A08310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00A08310

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A151BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00A151BD

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009BE6A0	0_2_009BE6A0
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DD975	0_2_009DD975
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009D21C5	0_2_009D21C5
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009E62D2	0_2_009E62D2
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A303DA	0_2_00A303DA
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009E242E	0_2_009E242E
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009D25FA	0_2_009D25FA
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009C66E1	0_2_009C66E1
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A0E616	0_2_00A0E616
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009E878F	0_2_009E878F
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A18889	0_2_00A18889
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009C8808	0_2_009C8808
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009E6844	0_2_009E6844
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A30857	0_2_00A30857
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DCB21	0_2_009DCB21
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009E6DB6	0_2_009E6DB6
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009C6F9E	0_2_009C6F9E
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009C3030	0_2_009C3030
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009D3187	0_2_009D3187
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DF1D9	0_2_009DF1D9
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009B1287	0_2_009B1287
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009D1484	0_2_009D1484
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009C5520	0_2_009C5520
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009D7696	0_2_009D7696
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009C5760	0_2_009C5760
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009D1978	0_2_009D1978
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009E9AB5	0_2_009E9AB5
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009BFCE0	0_2_009BFCE0
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009D1D90	0_2_009D1D90
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DBDA6	0_2_009DBDA6
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A37DDB	0_2_00A37DDB
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009C3FE0	0_2_009C3FE0
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009BDF00	0_2_009BDF00
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_013730F0	0_2_013730F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E84A98	1_2_00E84A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E83E80	1_2_00E83E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E841C8	1_2_00E841C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E8F9C8	1_2_00E8F9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E8A978	1_2_00E8A978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06305E68	1_2_06305E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06303690	1_2_06303690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0630F6EF	1_2_0630F6EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_063046D8	1_2_063046D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0630A260	1_2_0630A260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06309313	1_2_06309313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0630B040	1_2_0630B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06301148	1_2_06301148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0630E1F9	1_2_0630E1F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0630BE48	1_2_0630BE48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06305788	1_2_06305788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_063064B0	1_2_063064B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0630C4A0	1_2_0630C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06303DCF	1_2_06303DCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06300328	1_2_06300328

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: String function: 009D0AE3 appears 70 times
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: String function: 009B7DE1 appears 35 times
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: String function: 009D8900 appears 42 times

Source: rDOC24INV0616.exe, 00000000.00000003.1703400525.0000000003BBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rDOC24INV0616.exe
Source: rDOC24INV0616.exe, 00000000.00000003.1702811373.0000000003A13000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rDOC24INV0616.exe
Source: rDOC24INV0616.exe, 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename106790a0-b81d-4bde-9832-48ebd9bb7fec.exe4 vs rDOC24INV0616.exe

Source: rDOC24INV0616.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rDOC24INV0616.exe.38b0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A1A06A GetLastError,FormatMessageW,

0_2_00A1A06A

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A081CB AdjustTokenPrivileges,CloseHandle,		0_2_00A081CB
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A087E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00A087E1

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A1B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00A1B3FB

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A2EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00A2EE0D

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A283BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00A283BB

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009B4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_009B4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

File created: C:\Users\user\AppData\Local\Temp\autF6E.tmp

Jump to behavior

Source: rDOC24INV0616.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rDOC24INV0616.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\rDOC24INV0616.exe "C:\Users\user\Desktop\rDOC24INV0616.exe"
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rDOC24INV0616.exe"
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rDOC24INV0616.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: rDOC24INV0616.exe

Static file information: File size 1072128 > 1048576

Source: rDOC24INV0616.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rDOC24INV0616.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rDOC24INV0616.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rDOC24INV0616.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rDOC24INV0616.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rDOC24INV0616.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rDOC24INV0616.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: rDOC24INV0616.exe, 00000000.00000003.1702811373.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, rDOC24INV0616.exe, 00000000.00000003.1706514878.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rDOC24INV0616.exe, 00000000.00000003.1702811373.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, rDOC24INV0616.exe, 00000000.00000003.1706514878.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp

Source: rDOC24INV0616.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rDOC24INV0616.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rDOC24INV0616.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rDOC24INV0616.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rDOC24INV0616.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009B4B37 LoadLibraryA,GetProcAddress,

0_2_009B4B37

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1848F push FFFFFF8Bh; iretd	0_2_00A18491
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DE70F push edi; ret	0_2_009DE711
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DE828 push esi; ret	0_2_009DE82A
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009D8945 push ecx; ret	0_2_009D8958
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DEAEC push edi; ret	0_2_009DEAEE
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DEA03 push esi; ret	0_2_009DEA05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00E80C55 push edi; retf	1_2_00E80C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0630ABF9 push ecx; iretd	1_2_0630AC00

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009B48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_009B48D7
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A35376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00A35376

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009D3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009D3187

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

API/Special instruction interceptor: Address: 1372D14

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rDOC24INV0616.exe, 00000000.00000002.1709096991.0000000001270000.00000004.00000020.00020000.00000000.sdmp, rDOC24INV0616.exe, 00000000.00000003.1695771440.0000000001270000.00000004.00000020.00020000.00000000.sdmp, rDOC24INV0616.exe, 00000000.00000003.1695682280.0000000001217000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: FIDDLER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2172			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7676			Jump to behavior

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-105386

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

API coverage: 4.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A1445A
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1C6D1 FindFirstFileW,FindClose,	0_2_00A1C6D1
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00A1C75C
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1EF95
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1F0F2
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A1F3F3
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A137EF
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A13B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A13B12
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A1BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00A1BCBC

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009B49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009B49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98318	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97042	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96494	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94998	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94219	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

API call chain: ExitProcess graph end node

graph_0-103777

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A23F09 BlockInput,

0_2_00A23F09

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009B3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_009B3B3A

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009E5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_009E5A7C

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009B4B37 LoadLibraryA,GetProcAddress,

0_2_009B4B37

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_01371950 mov eax, dword ptr fs:[00000030h]	0_2_01371950
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_01372F80 mov eax, dword ptr fs:[00000030h]	0_2_01372F80
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_01372FE0 mov eax, dword ptr fs:[00000030h]	0_2_01372FE0

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A080A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00A080A9

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DA124 SetUnhandledExceptionFilter,		0_2_009DA124
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_009DA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_009DA155

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 88F008

Jump to behavior

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A087B1 LogonUserW,

0_2_00A087B1

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009B3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_009B3B3A

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009B48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_009B48D7

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A14C27 mouse_event,

0_2_00A14C27

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rDOC24INV0616.exe"

Jump to behavior

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A07CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00A07CAF

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_00A0874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00A0874B

Source: rDOC24INV0616.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: rDOC24INV0616.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009D862B cpuid

0_2_009D862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009E4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_009E4E87

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009F1E06 GetUserNameW,

0_2_009F1E06

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009E3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_009E3F3A

Source: C:\Users\user\Desktop\rDOC24INV0616.exe

Code function: 0_2_009B49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009B49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDOC24INV0616.exe.38b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4164764218.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4164764218.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDOC24INV0616.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7412, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: rDOC24INV0616.exe	Binary or memory string: WIN_81
Source: rDOC24INV0616.exe	Binary or memory string: WIN_XP
Source: rDOC24INV0616.exe	Binary or memory string: WIN_XPe
Source: rDOC24INV0616.exe	Binary or memory string: WIN_VISTA
Source: rDOC24INV0616.exe	Binary or memory string: WIN_7
Source: rDOC24INV0616.exe	Binary or memory string: WIN_8
Source: rDOC24INV0616.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDOC24INV0616.exe.38b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4164764218.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDOC24INV0616.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7412, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDOC24INV0616.exe.38b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDOC24INV0616.exe.38b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4164764218.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4164764218.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDOC24INV0616.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7412, type: MEMORYSTR

Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A26283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00A26283
Source: C:\Users\user\Desktop\rDOC24INV0616.exe	Code function: 0_2_00A26747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00A26747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	221 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	341 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rDOC24INV0616.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
rDOC24INV0616.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://r10.o.lencr.org0#	0%	Avira URL Cloud	safe
http://alltoursegypt.com	0%	Avira URL Cloud	safe
http://mail.alltoursegypt.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	172.67.74.152	true	false	high
alltoursegypt.com	192.254.186.165	true	true	unknown
mail.alltoursegypt.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.alltoursegypt.com	RegSvcs.exe, 00000001.00000002.4164764218.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	rDOC24INV0616.exe, 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://r10.o.lencr.org0#	RegSvcs.exe, 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.i.lencr.org/01	RegSvcs.exe, 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.dyn.com/	rDOC24INV0616.exe, 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://api.ipify.org/t	RegSvcs.exe, 00000001.00000002.4164764218.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4164764218.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	RegSvcs.exe, 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C50000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163845845.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166352549.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://alltoursegypt.com	RegSvcs.exe, 00000001.00000002.4164764218.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164764218.0000000002C02000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
192.254.186.165	alltoursegypt.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575888
Start date and time:	2024-12-16 11:01:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rDOC24INV0616.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 50 Number of non-executed functions: 277
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: rDOC24INV0616.exe

Simulations

Behavior and APIs

Time	Type	Description
05:02:17	API Interceptor	11642534x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.74.152	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
192.254.186.165	INVOICE NO. USF23-24072 IGR23110.exe	Get hash	malicious	AgentTesla	Browse
	Shipping Documents 72908672134.exe	Get hash	malicious	AgentTesla	Browse
	PUK ITALIA PO 120610549.EXE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	PqCznDthHP.exe	Get hash	malicious	Edge Stealer	Browse	104.26.13.205
	https://www.canva.com/design/DAGZLdpMEGI/O58JBUDFuRvFcdZ0tgIwgA/edit?utm_content=DAGZLdpMEGI&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	duschno.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	chos.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	http://ap2vxmyqxf.ballyentoe.shop	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.12.205
	installer.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	zapret.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	x86.elf	Get hash	malicious	Mirai	Browse	192.163.243.124
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	192.185.150.180
	1.elf	Get hash	malicious	Unknown	Browse	74.91.233.206
	m68k.elf	Get hash	malicious	Unknown	Browse	142.6.100.244
	powerpc.elf	Get hash	malicious	Unknown	Browse	162.145.74.216
	IGz.sh4.elf	Get hash	malicious	Mirai	Browse	98.130.22.72
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	50.6.247.204
	https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com	Get hash	malicious	Unknown	Browse	69.49.230.198
	FS-SZHAJCVS.msi	Get hash	malicious	Unknown	Browse	162.214.64.212
	https://nam.dcv.ms/0CX72Iqyxf	Get hash	malicious	HTMLPhisher	Browse	162.241.252.227
CLOUDFLARENETUS	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	http://minimalfreaks.co	Get hash	malicious	HTMLPhisher	Browse	104.16.79.73
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	MessengerAdmin.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	172.67.164.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://t.co/eSJUUrWOcO	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	172.67.74.152
	InvoiceNr274728.pdf.lnk	Get hash	malicious	Unknown	Browse	172.67.74.152
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	172.67.74.152
	KlarnaInvoice229837.pdf.lnk	Get hash	malicious	LummaC	Browse	172.67.74.152
	Arrival Notice.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.74.152
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	jignesh.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	skibidi.exe	Get hash	malicious	Quasar	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\rDOC24INV0616.exe
File Type:	data
Category:	dropped
Size (bytes):	156262
Entropy (8bit):	7.84486083059971
Encrypted:	false
SSDEEP:	3072:I/dKLg1V6cFjNuT/StPJufXj8O91BYkx8mwkPo8+Kt8ER9c4jJVstMeq:IFb64RuT/Svu7ThYabw0oySCjrwMeq
MD5:	D8A947BBB35502E8EC8357C01C3AF205
SHA1:	11F3B0102CEEBF8CF15F2AC8F06B136E974D3B5F
SHA-256:	4828BE0C9E63BE88DB05B982A45384AE11FE46B947C044A8B51229211A42EE86
SHA-512:	48B62793DDE627DFCFB972F9BD03A4B0E0F78B503058E6E181E2D0E39CBBDF502450ADD477146E13B6C65B55336B2E4542A48FF259195CDC91FD24CBDC6581C7
Malicious:	false
Reputation:	low
Preview:	EA06.....E.s..^.J...nv.iQ.VkT.}.cZ..&s....U..&5..F..1.X..v ..........2.g....Co.P.9..iz.K......Q...%.w!.]b.{..m>.Xi....#0X.>m}...3...\....^.K.T.i..oQ.T@.1...&.;......H.J.2..0Pf5.x.Fj ..... ...W.s...cJ..iT.}L.c.0...0U.\p...L&.Z....7.W.B? ....O.N@.;C.L...........`...63...+.....N.^...%H...W.....K..0..h......cVY.Z.<.S.U...aQ.V...<......0.....Pf.. ..M..+Q.d.aG.S.U`..aZ.U.<?....~.-.s.y.@.0.....l..[.'..$.H%..$..+...b#C......Z_2.Ak8j%....</..E..T%t.....'5...Wb..(u.5;...y.....#...R....O.q$SX......._.Wx.N .-.zo...$u...O>.L/..^wF.}kz.P.C..\|<_o.'.<.A-....x...N.{/..R..>..+.......`.......x..N...x..2..! c..........0Z........'..&.G&...B+..{.....O...a.7.&2cm..:......Ff.......E P.f...o....cM.Cm5.Uo5..)T...}.....uv.N..&..=.{{..V.5..w=.9....Nt.`..liU^.....Tv`..>...r...._cJ...m.......294F]$.Pj...y0.A.VXTRC>.H.r1M.....5..!..#.ef.a..-u.]#.%.0)..E>m5.[.4....@.I......M .\|.<.Ti...b.C..);).~.W.NmU\|.?...tJL.p.PY.3..kJ......iQ...........y.+.....H"5..V...mi.^}

C:\Users\user\AppData\Local\Temp\caprone

Download File

Process:	C:\Users\user\Desktop\rDOC24INV0616.exe
File Type:	data
Category:	dropped
Size (bytes):	247296
Entropy (8bit):	6.757514629801149
Encrypted:	false
SSDEEP:	6144:ZHogSr2kk/yje+NuG1I6RArpg/mGIMRBiyRYPikpJDfoY7e:ZHogSr2kkKje+sGeHrAmGIMRBiyuPiWy
MD5:	35D2D03336970C78B01F07626837D831
SHA1:	39B345E08FE0B9B2E96F1E4BA7C5C42AD12FBF41
SHA-256:	CF7F026C2B9F37A8A27011314A874E08D22A6D754BD20BC80BCB0BDACFA64CDC
SHA-512:	F8C7233B00A9D187E5F4DE5831140860548560150BA87F557D4F73E43B17CF7DF627AFFA99453589EABC314BA481EF6D5E019F5D23FB434BAE2AE951743EB04F
Malicious:	false
Reputation:	low
Preview:	...0PWNJQRO6.4Q.YZKOC1Z.L30SWNJURO61Z4QLYZKOC1ZKL30SWNJURO6.Z4QBF.EO.8.j.2\|.v."<!oFC5S#-4z(.-_5?lQUs%;$u;!.u.gq!6>.aN<PoL30SWNJ..O6}[7Q8...OC1ZKL30.WLK^SD61.7QLQZKOC1Z..00SwNJU.L61ZtQLyZKOA1ZOL30SWNJQRO61Z4QLy^KOA1ZKL30QW..UR_61J4QLYJKOS1ZKL30CWNJURO61Z4Q$.YK.C1ZK.00.RNJURO61Z4QLYZKOC1ZKL70_WNJURO61Z4QLYZKOC1ZKL30SWNJURO61Z4QLYZKOC1ZKL30SWNJUrO69Z4QLYZKOC1ZCl30.WNJURO61Z4Qb-?3;C1Z..00SwNJU.L61X4QLYZKOC1ZKL30sWN{ <DRZ4Q.\ZKO.2ZKJ30S.MJURO61Z4QLYZK.C1.e>V\<4NJYRO61Z0QL[ZKO.2ZKL30SWNJURO6qZ4.LYZKOC1ZKL30SWNJ..L61Z4Q.YZKMC4Z..10GlOJVRO60Z4WLYZKOC1ZKL30SWNJURO61Z4QLYZKOC1ZKL30SWNJURO61Z4QQ...yd.1.:1P.l.5.5..'.. ..@.$.0X....C...../2..Y.D..B....".BP+N....t9Q:A+b-dCR.N....onBq..W". ...Oh."5..~...tl..x^8....7..(#^.2'>&0\|.WW;F8.[.JOC1Z........<.l.Y;OxK".....^Kf...+RO6UZ4Q>YZK.C1Z.L30<WNJ;RO6OZ4Q2YZK.C1Z.L30dWNJpRO6\Z4QhYZK1C1Z.1<?..#&..61Z4Qy..{..........\|$.1mSb.=....4..C[.$.....A..1x.[.1Ml.i]JJ75QPJIYoA}..pN]^NMD5YGq={...k.t......=...9.&KL30SW.JU.O61.Q.YZK.C.Z..30S.J.R.6..Q

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.0240478795055425
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rDOC24INV0616.exe
File size:	1'072'128 bytes
MD5:	27245367b5716caadd5ea798614ada6c
SHA1:	2911bbbee9b31885767710b8a146c2b67578f139
SHA256:	3b78171bc9f38f684826c2cd33953cd0023239cdd561637e1593f89dffea56fe
SHA512:	4b070802766c6673df0db4626971a227fe3429838a86d63b7655d4b4c794349f25f8ad019abb07cd30f8693ca34b1d3719997b1e9c36585df9c9e7e3242c58c9
SSDEEP:	24576:Du6J33O0c+JY5UZ+XC0kGso6FaI3F423lXTJwSfNmraWY:Nu0c++OCvkGs9FaI3X39HgY
TLSH:	5E35BE2273DDC360CB769173BF6AB7016EBB3C614630B85B2F980D7DA950162162D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675FEB03 [Mon Dec 16 08:55:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F1AA481B64Ah
jmp 00007F1AA480E414h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F1AA480E59Ah
cmp edi, eax
jc 00007F1AA480E8FEh
bt dword ptr [004C31FCh], 01h
jnc 00007F1AA480E599h
rep movsb
jmp 00007F1AA480E8ACh
cmp ecx, 00000080h
jc 00007F1AA480E764h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F1AA480E5A0h
bt dword ptr [004BE324h], 01h
jc 00007F1AA480EA70h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F1AA480E73Dh
test edi, 00000003h
jne 00007F1AA480E74Eh
test esi, 00000003h
jne 00007F1AA480E72Dh
bt edi, 02h
jnc 00007F1AA480E59Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F1AA480E5A3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F1AA480E5F5h
bt esi, 03h
jnc 00007F1AA480E648h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x3d2ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x105000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x3d2ec	0x3d400	0b01f7df61a7a48a9c13fb5e42359249	False	0.8924386160714286	data	7.809883244045794	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x105000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x345b1	data			1.000354396616445
RT_GROUP_ICON	0x103d6c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x103de4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x103df8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x103e0c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x103e20	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x103efc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 11:02:16.878691912 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:16.878726006 CET	443	49730	172.67.74.152	192.168.2.4
Dec 16, 2024 11:02:16.878829002 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:16.922419071 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:16.922437906 CET	443	49730	172.67.74.152	192.168.2.4
Dec 16, 2024 11:02:18.156686068 CET	443	49730	172.67.74.152	192.168.2.4
Dec 16, 2024 11:02:18.156766891 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:18.161972046 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:18.161983967 CET	443	49730	172.67.74.152	192.168.2.4
Dec 16, 2024 11:02:18.162391901 CET	443	49730	172.67.74.152	192.168.2.4
Dec 16, 2024 11:02:18.207859039 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:18.229744911 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:18.275336027 CET	443	49730	172.67.74.152	192.168.2.4
Dec 16, 2024 11:02:18.590650082 CET	443	49730	172.67.74.152	192.168.2.4
Dec 16, 2024 11:02:18.590802908 CET	443	49730	172.67.74.152	192.168.2.4
Dec 16, 2024 11:02:18.590868950 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:18.597444057 CET	49730	443	192.168.2.4	172.67.74.152
Dec 16, 2024 11:02:19.902466059 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:20.022577047 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:20.022706985 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:21.284820080 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:21.285098076 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:21.405191898 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:21.652127028 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:21.652461052 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:21.772280931 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:22.020457029 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:22.021739960 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:22.141788960 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:22.398214102 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:22.398284912 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:22.398320913 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:22.398471117 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:22.431610107 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:22.551518917 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:22.798727036 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:22.802562952 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:22.922389984 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:23.169420958 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:23.212305069 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:23.333605051 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:23.579679012 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:23.580054998 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:23.701106071 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:24.098495960 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:24.098794937 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:24.218730927 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:24.465296984 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:24.468787909 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:24.588598967 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:24.844113111 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:24.845053911 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:24.964929104 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:25.211896896 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:25.212599993 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:25.212680101 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:25.212704897 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:25.212734938 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:25.332551003 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:25.332591057 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:25.332722902 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:25.332736015 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:25.634262085 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:25.676743984 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:25.679426908 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:25.799498081 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:26.046217918 CET	587	49731	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:26.050621033 CET	49731	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:26.063411951 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:26.183588982 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:26.183726072 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:27.406558990 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:27.406739950 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:27.526591063 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:27.773518085 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:27.774892092 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:27.894809008 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:28.144006014 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:28.144781113 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:28.264744997 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:28.521202087 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:28.521255970 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:28.521295071 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:28.521447897 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:28.523312092 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:28.643240929 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:28.890878916 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:28.892116070 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:29.011981010 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:29.259129047 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:29.259368896 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:29.379980087 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:29.626817942 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:29.627145052 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:29.746988058 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:29.996860027 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:29.997256994 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:30.117145061 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:30.363893986 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:30.364547014 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:30.484452963 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:30.740809917 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:30.741031885 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:30.860820055 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.107280016 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.111865044 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.111943007 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.111943960 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.111984968 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.112117052 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.112117052 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.112117052 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.112190008 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.112190962 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:02:31.231734991 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.231770992 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.231786013 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.231822968 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.232048988 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.232069016 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.232120991 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.232388020 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.232479095 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.232491970 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.232503891 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.232516050 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.497407913 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:02:31.551645994 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:03:59.114825964 CET	49732	587	192.168.2.4	192.254.186.165
Dec 16, 2024 11:03:59.234545946 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:03:59.480969906 CET	587	49732	192.254.186.165	192.168.2.4
Dec 16, 2024 11:03:59.481559992 CET	49732	587	192.168.2.4	192.254.186.165

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 11:02:16.707719088 CET	62873	53	192.168.2.4	1.1.1.1
Dec 16, 2024 11:02:16.845494986 CET	53	62873	1.1.1.1	192.168.2.4
Dec 16, 2024 11:02:19.086836100 CET	63547	53	192.168.2.4	1.1.1.1
Dec 16, 2024 11:02:19.900691986 CET	53	63547	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 11:02:16.707719088 CET	192.168.2.4	1.1.1.1	0xef3	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 11:02:19.086836100 CET	192.168.2.4	1.1.1.1	0xc1c7	Standard query (0)	mail.alltoursegypt.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 11:02:16.845494986 CET	1.1.1.1	192.168.2.4	0xef3	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 16, 2024 11:02:16.845494986 CET	1.1.1.1	192.168.2.4	0xef3	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 16, 2024 11:02:16.845494986 CET	1.1.1.1	192.168.2.4	0xef3	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 16, 2024 11:02:19.900691986 CET	1.1.1.1	192.168.2.4	0xc1c7	No error (0)	mail.alltoursegypt.com	alltoursegypt.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 11:02:19.900691986 CET	1.1.1.1	192.168.2.4	0xc1c7	No error (0)	alltoursegypt.com		192.254.186.165	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.74.152	443	7412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 10:02:18 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-16 10:02:18 UTC	424	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 10:02:18 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8f2dd6492ee98c35-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1906&min_rtt=1904&rtt_var=718&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1518460&cwnd=242&unsent_bytes=0&cid=03880b1ad499bf5c&ts=454&x=0"
2024-12-16 10:02:18 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 16, 2024 11:02:21.284820080 CET	587	49731	192.254.186.165	192.168.2.4	220-gator3170.hostgator.com ESMTP Exim 4.96.2 #2 Mon, 16 Dec 2024 04:02:21 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Dec 16, 2024 11:02:21.285098076 CET	49731	587	192.168.2.4	192.254.186.165	EHLO 813435
Dec 16, 2024 11:02:21.652127028 CET	587	49731	192.254.186.165	192.168.2.4	250-gator3170.hostgator.com Hello 813435 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Dec 16, 2024 11:02:21.652461052 CET	49731	587	192.168.2.4	192.254.186.165	STARTTLS
Dec 16, 2024 11:02:22.020457029 CET	587	49731	192.254.186.165	192.168.2.4	220 TLS go ahead
Dec 16, 2024 11:02:27.406558990 CET	587	49732	192.254.186.165	192.168.2.4	220-gator3170.hostgator.com ESMTP Exim 4.96.2 #2 Mon, 16 Dec 2024 04:02:27 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Dec 16, 2024 11:02:27.406739950 CET	49732	587	192.168.2.4	192.254.186.165	EHLO 813435
Dec 16, 2024 11:02:27.773518085 CET	587	49732	192.254.186.165	192.168.2.4	250-gator3170.hostgator.com Hello 813435 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Dec 16, 2024 11:02:27.774892092 CET	49732	587	192.168.2.4	192.254.186.165	STARTTLS
Dec 16, 2024 11:02:28.144006014 CET	587	49732	192.254.186.165	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	05:02:13
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\rDOC24INV0616.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rDOC24INV0616.exe"
Imagebase:	0x9b0000
File size:	1'072'128 bytes
MD5 hash:	27245367B5716CAADD5EA798614ADA6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1709566627.00000000038B0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:02:14
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rDOC24INV0616.exe"
Imagebase:	0x610000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4164764218.0000000002B54000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4164764218.0000000002B4C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4164764218.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4164764218.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4163635878.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	8.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	157

Executed Functions

Function 009B3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009B3B68
IsDebuggerPresent.KERNEL32 ref: 009B3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,00A752F8,00A752E0,?,?), ref: 009B3BEB

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

Part of subcall function 009C092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,009B3C14,00A752F8,?,?,?), ref: 009C096E

SetCurrentDirectoryW.KERNEL32(?), ref: 009B3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00A67770,00000010), ref: 009ED281
SetCurrentDirectoryW.KERNEL32(?,00A752F8,?,?,?), ref: 009ED2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00A64260,00A752F8,?,?,?), ref: 009ED33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 009ED346

Part of subcall function 009B3A46: GetSysColorBrush.USER32(0000000F), ref: 009B3A50
Part of subcall function 009B3A46: LoadCursorW.USER32(00000000,00007F00), ref: 009B3A5F
Part of subcall function 009B3A46: LoadIconW.USER32(00000063), ref: 009B3A76
Part of subcall function 009B3A46: LoadIconW.USER32(000000A4), ref: 009B3A88
Part of subcall function 009B3A46: LoadIconW.USER32(000000A2), ref: 009B3A9A
Part of subcall function 009B3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009B3AC0
Part of subcall function 009B3A46: RegisterClassExW.USER32(?), ref: 009B3B16

Part of subcall function 009B39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009B3A03
Part of subcall function 009B39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009B3A24
Part of subcall function 009B39D5: ShowWindow.USER32(00000000,?,?), ref: 009B3A38
Part of subcall function 009B39D5: ShowWindow.USER32(00000000,?,?), ref: 009B3A41

Part of subcall function 009B434A: _memset.LIBCMT ref: 009B4370
Part of subcall function 009B434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 009B4415

Strings

runas, xrefs: 009ED33A
This is a third-party compiled AutoIt script., xrefs: 009ED279

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 246344187b6cbbaee3de740a3a59bc85d8cb79303cc7ab84941397d0ecc3c594
Instruction ID: 8abf6edc9cade92ed6036845224493ebc063f8cff1bec3d63beee2e29ad09584
Opcode Fuzzy Hash: 246344187b6cbbaee3de740a3a59bc85d8cb79303cc7ab84941397d0ecc3c594
Instruction Fuzzy Hash: 4251E630D04248BEDF01EBF5DD05FED7B78AB85720F00C569F865B61A2DAB04A46CB61

Function 009B49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 009B49CD

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

GetCurrentProcess.KERNEL32(?,00A3FAEC,00000000,00000000,?), ref: 009B4A9A
IsWow64Process.KERNEL32(00000000), ref: 009B4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 009B4AE7
FreeLibrary.KERNEL32(00000000), ref: 009B4AF2
GetSystemInfo.KERNEL32(00000000), ref: 009B4B23
GetSystemInfo.KERNEL32(00000000), ref: 009B4B2F

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: bae21f626df4347170339be21b79f75e385c76127efdb8c1c7abb2c50f6d1627
Instruction ID: 0c167c3d1f1ee25df9fadb4adbe07d7ef332c8c84575796de102cf05d8c3ead6
Opcode Fuzzy Hash: bae21f626df4347170339be21b79f75e385c76127efdb8c1c7abb2c50f6d1627
Instruction Fuzzy Hash: 9991F73198A7C0DECB32DB7885501EAFFF9AF6A310B444E6DD0C793A42D224E908D759

Function 009B4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,009B4D8E,?,?,00000000,00000000), ref: 009B4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009B4D8E,?,?,00000000,00000000), ref: 009B4EB0
LoadResource.KERNEL32(?,00000000,?,?,009B4D8E,?,?,00000000,00000000,?,?,?,?,?,?,009B4E2F), ref: 009ED937
SizeofResource.KERNEL32(?,00000000,?,?,009B4D8E,?,?,00000000,00000000,?,?,?,?,?,?,009B4E2F), ref: 009ED94C
LockResource.KERNEL32(009B4D8E,?,?,009B4D8E,?,?,00000000,00000000,?,?,?,?,?,?,009B4E2F,00000000), ref: 009ED95F

Strings

SCRIPT, xrefs: 009B4EA6

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 5575a94fe41f38b259ebc8982f7954553799474d9e7f1f72ea40efa53c073721
Instruction ID: 0b7a4ee956aa002ad4f3655716c5d4679e422747ed56ce3f01dc91f90547df14
Opcode Fuzzy Hash: 5575a94fe41f38b259ebc8982f7954553799474d9e7f1f72ea40efa53c073721
Instruction Fuzzy Hash: C3119A70640300BFD7218BA5EC48FA77BBEFBC5B21F204268F80686261DB71EC019A60

Function 00A1445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,009EE398), ref: 00A1446A
FindFirstFileW.KERNELBASE(?,?), ref: 00A1447B
FindClose.KERNEL32(00000000), ref: 00A1448B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 409c93353ec068c223923599ec431f8161bde6253f6b5bad2e130c2ebbf26ee5
Instruction ID: cd90eccdaa306e37379fb350b3379968fefd45bdec4db4af1762e9d02f28c0c7
Opcode Fuzzy Hash: 409c93353ec068c223923599ec431f8161bde6253f6b5bad2e130c2ebbf26ee5
Instruction Fuzzy Hash: 91E0D833820511AB4210ABBCEC0D8EA775C9E09335F104715F835C20E0F774594096D5

Function 009BE6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 009F3E62

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 7d36f0e76cfd20469161bbd096887d0de174cc82b1a72bfdbd623e8a9e825866
Instruction ID: 79fe08eb71547e99b7075ad05df38178779a7b7c21ac820e6bef3ad449389b4d
Opcode Fuzzy Hash: 7d36f0e76cfd20469161bbd096887d0de174cc82b1a72bfdbd623e8a9e825866
Instruction Fuzzy Hash: C2A28D74A00219CFCB14CF98CA90AFAB7B9FF59324F248469E9059B351D774ED82CB90

Function 009C09D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009C0A5B
timeGetTime.WINMM ref: 009C0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009C0E53
Sleep.KERNEL32(0000000A), ref: 009C0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 009C0EFA
DestroyWindow.USER32 ref: 009C0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 009C0F20
Sleep.KERNEL32(0000000A,?,?), ref: 009F4E83
TranslateMessage.USER32(?), ref: 009F5C60
DispatchMessageW.USER32(?), ref: 009F5C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 009F5C82

Strings

@GUI_CTRLID, xrefs: 009F4F3A
@GUI_CTRLHANDLE, xrefs: 009F4FE4
@COM_EVENTOBJ, xrefs: 009F54F0
@GUI_WINHANDLE, xrefs: 009F4F8F
@TRAY_ID, xrefs: 009F578F

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: 7dfe322aa0c03636e23b18e3eb2cdbbefd077c14269e255b28b6e7cb39a63ee2
Instruction ID: 2658f85b6436ad91baf94b67622d340de21eb20b8c39339decdbc35dd1c64993
Opcode Fuzzy Hash: 7dfe322aa0c03636e23b18e3eb2cdbbefd077c14269e255b28b6e7cb39a63ee2
Instruction Fuzzy Hash: 5DB2B170A08745DFD724DF24C884FAAB7E8BF85304F15891DF69A872A1C775E885CB82

Function 00A19155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A18F5F: __time64.LIBCMT ref: 00A18F69

Part of subcall function 009B4EE5: _fseek.LIBCMT ref: 009B4EFD

__wsplitpath.LIBCMT ref: 00A19234

Part of subcall function 009D40FB: __wsplitpath_helper.LIBCMT ref: 009D413B

_wcscpy.LIBCMT ref: 00A19247
_wcscat.LIBCMT ref: 00A1925A
__wsplitpath.LIBCMT ref: 00A1927F
_wcscat.LIBCMT ref: 00A19295
_wcscat.LIBCMT ref: 00A192A8

Part of subcall function 00A18FA5: _memmove.LIBCMT ref: 00A18FDE
Part of subcall function 00A18FA5: _memmove.LIBCMT ref: 00A18FED

_wcscmp.LIBCMT ref: 00A191EF

Part of subcall function 00A19734: _wcscmp.LIBCMT ref: 00A19824
Part of subcall function 00A19734: _wcscmp.LIBCMT ref: 00A19837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00A19452
_wcsncpy.LIBCMT ref: 00A194C5
DeleteFileW.KERNEL32(?,?), ref: 00A194FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A19511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A19522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A19534

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 9a1fe6fdfe91357fe281b7b8728ff274e1ce91da97d72fc12dc7756165061ebe
Instruction ID: 547106025dc63b651a04f8fbed1f7b9e42f66df1a53e07b17609071518de13a2
Opcode Fuzzy Hash: 9a1fe6fdfe91357fe281b7b8728ff274e1ce91da97d72fc12dc7756165061ebe
Instruction Fuzzy Hash: 7BC13AB1D00219AADF21DF95CD95ADFB7BDAF85310F0040AAF609E7241EB309A84CF65

Function 009B3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009B3074
RegisterClassExW.USER32(00000030), ref: 009B309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009B30AF
InitCommonControlsEx.COMCTL32(?), ref: 009B30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009B30DC
LoadIconW.USER32(000000A9), ref: 009B30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009B3101

Strings

TaskbarCreated, xrefs: 009B30A4
0, xrefs: 009B3056
+, xrefs: 009B305D
AutoIt v3 GUI, xrefs: 009B3090

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 2d0f66d7c5b07deca5f163a9770e249bfea3e0b4adfa26637868c892de08ebe7
Instruction ID: e48b23f097b6a5a8d6bcedd53a3bca47f62f36ff9b8eb632e0c6a29fc253148d
Opcode Fuzzy Hash: 2d0f66d7c5b07deca5f163a9770e249bfea3e0b4adfa26637868c892de08ebe7
Instruction Fuzzy Hash: 363122B1C50349AFDB10CFE4EC89A89BBF0FB09310F14852AF584A62A1E7B50586CF91

Function 009B3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009B3074
RegisterClassExW.USER32(00000030), ref: 009B309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009B30AF
InitCommonControlsEx.COMCTL32(?), ref: 009B30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009B30DC
LoadIconW.USER32(000000A9), ref: 009B30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009B3101

Strings

TaskbarCreated, xrefs: 009B30A4
0, xrefs: 009B3056
+, xrefs: 009B305D
AutoIt v3 GUI, xrefs: 009B3090

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 98b3a10a7eaa0dc5f178a3b80b90b40b55cf7b5b46ad01bdda1ec69c8095d167
Instruction ID: 83722e9e8e94db5928454fd2c45de34a807ed5a1b5570d91f0e1ed9b7b973444
Opcode Fuzzy Hash: 98b3a10a7eaa0dc5f178a3b80b90b40b55cf7b5b46ad01bdda1ec69c8095d167
Instruction Fuzzy Hash: DC21C3B1D11218AFDB00DFE8ED89BDDBBF4FB08710F00812AF915A62A0D7B145869F91

Function 009B708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009B4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A752F8,?,009B37AE,?), ref: 009B4724

Part of subcall function 009D050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,009B7165), ref: 009D052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 009B71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 009EE8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 009EE909
RegCloseKey.ADVAPI32(?), ref: 009EE947
_wcscat.LIBCMT ref: 009EE9A0

Strings

\, xrefs: 009EE9C3
Include, xrefs: 009EE8BF, 009EE900
\Include\, xrefs: 009B7165
Software\AutoIt v3\AutoIt, xrefs: 009B719E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 5c25ecc51782a2b6b9b3fb49e01fab62b048ab0af85f7e5e8f17eacb589afcbf
Instruction ID: 32bda201339ac83a050361370cebee9b03e0e599255b6aac6ffb57c23726cc05
Opcode Fuzzy Hash: 5c25ecc51782a2b6b9b3fb49e01fab62b048ab0af85f7e5e8f17eacb589afcbf
Instruction Fuzzy Hash: DA717F719087019EC344DFA5EC41BEBB7E8FF85310F40892EF449872A2EB719989CB91

Function 009B3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009B3A50
LoadCursorW.USER32(00000000,00007F00), ref: 009B3A5F
LoadIconW.USER32(00000063), ref: 009B3A76
LoadIconW.USER32(000000A4), ref: 009B3A88
LoadIconW.USER32(000000A2), ref: 009B3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009B3AC0
RegisterClassExW.USER32(?), ref: 009B3B16

Part of subcall function 009B3041: GetSysColorBrush.USER32(0000000F), ref: 009B3074
Part of subcall function 009B3041: RegisterClassExW.USER32(00000030), ref: 009B309E
Part of subcall function 009B3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009B30AF
Part of subcall function 009B3041: InitCommonControlsEx.COMCTL32(?), ref: 009B30CC
Part of subcall function 009B3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009B30DC
Part of subcall function 009B3041: LoadIconW.USER32(000000A9), ref: 009B30F2
Part of subcall function 009B3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009B3101

Strings

AutoIt v3, xrefs: 009B3B05
0, xrefs: 009B3AF4
#, xrefs: 009B3AFB

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 6ab2cf7fdc2350d579bb67f7e2456b5fc8162dd05a182c5769c51cb6c4ed25af
Instruction ID: 2e22f3b0a86538f526893acc60e6080732406f28d7cfd2da368a30c0de627a5d
Opcode Fuzzy Hash: 6ab2cf7fdc2350d579bb67f7e2456b5fc8162dd05a182c5769c51cb6c4ed25af
Instruction Fuzzy Hash: 86213CB1D10308AFEB10DFF4ED49BDD7BB5EB08711F10851AF608A62A2D7B555829F84

Function 009B3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 009B36D2
KillTimer.USER32(?,00000001), ref: 009B36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009B371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009B372A
CreatePopupMenu.USER32 ref: 009B373E
PostQuitMessage.USER32(00000000), ref: 009B374D

Strings

TaskbarCreated, xrefs: 009B3725

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: df2fe4c156ecf2b9863ed876e1b9f55069059fe5928008eb0c50bf6bf5f78d4c
Instruction ID: a060cabe0ade32376ab986fb2bba178bc5d37498218efaeb20515986a98a0686
Opcode Fuzzy Hash: df2fe4c156ecf2b9863ed876e1b9f55069059fe5928008eb0c50bf6bf5f78d4c
Instruction Fuzzy Hash: 3F4169B1A10905FFDB14DFB4DE4ABF93798EB00321F14C524F506C62A2DFA59D429362

Function 009B3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/ErrorStdOut, xrefs: 009B387D
CMDLINERAW, xrefs: 009B37FB
/AutoIt3OutputDebug, xrefs: 009B3892
/AutoIt3ExecuteLine, xrefs: 009B38A7
/AutoIt3ExecuteScript, xrefs: 009B38BC
CMDLINE, xrefs: 009B3822
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 009B37AE

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: ed5cbfad96879f8cbd2f5819d360bec9cedc889c60e217cfd0f41074934b11c7
Instruction ID: e88ce42554024a9e66ebb955edbadf0f005c7d108f1e035829fb57f5161ca0c4
Opcode Fuzzy Hash: ed5cbfad96879f8cbd2f5819d360bec9cedc889c60e217cfd0f41074934b11c7
Instruction Fuzzy Hash: 0BA16B71D1021DAADF04EBA0DD95BEEB778BF94320F44452AF415B7192DF74AA08CBA0

Function 013720D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 013721A1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 013723C7

Memory Dump Source

Source File: 00000000.00000002.1709342961.000000000136F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0136F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136f000_rDOC24INV0616.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: 0d57c04039a70a69084c4c5e6cfb5568320adaf55e0583cca8fbf1bf35238c10
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: 8AA10D74E00209EBEB24CF94C894BEEBBB5FF48308F208559E611BB281D7799A41CF55

Function 009B39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009B3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009B3A24
ShowWindow.USER32(00000000,?,?), ref: 009B3A38
ShowWindow.USER32(00000000,?,?), ref: 009B3A41

Strings

AutoIt v3, xrefs: 009B39FB, 009B3A00, 009B3A01
edit, xrefs: 009B3A1E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: d0b8bf6a97f81176580368f51fc5ea01663110e48a9e40133b2c7fbf378e1751
Instruction ID: a0a017630eec66ad8d5e66baeba6ec4d7f54772c4f6aad87249889d64eca76a8
Opcode Fuzzy Hash: d0b8bf6a97f81176580368f51fc5ea01663110e48a9e40133b2c7fbf378e1751
Instruction Fuzzy Hash: AFF03070D102907EEA3097A36C09EA72E7DD7C6F50F008029B908A2271C5A14882DAB0

Function 01371E90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01371D80: Sleep.KERNELBASE(000001F4), ref: 01371D91

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01371FBF

Strings

KL30SWNJURO61Z4QLYZKOC1Z, xrefs: 01372022, 01372025

Memory Dump Source

Source File: 00000000.00000002.1709342961.000000000136F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0136F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136f000_rDOC24INV0616.jbxd

Similarity

API ID: CreateFileSleep
String ID: KL30SWNJURO61Z4QLYZKOC1Z
API String ID: 2694422964-4013398681
Opcode ID: 29c2dd1e72b874585ad836fd7ed6580994e981bcc347afaf22c63fc70d105007
Instruction ID: bf8dcd322e6a27e1e99b2f0070995c1ba2479cf71007bdd876c23e83f93464c1
Opcode Fuzzy Hash: 29c2dd1e72b874585ad836fd7ed6580994e981bcc347afaf22c63fc70d105007
Instruction Fuzzy Hash: 6B51B431D0428DDAEF21DBA8C854BEFBBB9AF15304F004199E6487B2C1D7B91B44CBA5

Function 009B407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 009ED3D7

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

_memset.LIBCMT ref: 009B40FC
_wcscpy.LIBCMT ref: 009B4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009B4160

Strings

Line: , xrefs: 009ED400

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 3ae8a62451dbb5c800eba7bda41e837626d767b9f83ce413657e65373f97197d
Instruction ID: 87e11dfd9f79a552aa1907e78309630aa47f3bb3715faad838b4079d2f05add2
Opcode Fuzzy Hash: 3ae8a62451dbb5c800eba7bda41e837626d767b9f83ce413657e65373f97197d
Instruction Fuzzy Hash: 7631E9714087046FD321EBA0DD45FDB77ECAF94324F108A1EF58992192DB74A649CBD2

Function 009D541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 009D547B
_memcpy_s.LIBCMT ref: 009D54ED
__read_nolock.LIBCMT ref: 009D554B
__filbuf.LIBCMT ref: 009D556E
_memset.LIBCMT ref: 009D55B2

Part of subcall function 009D8B28: __getptd_noexit.LIBCMT ref: 009D8B28

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 1e304655db20178e813531fa884c9b6cf1b4d881bce4a40601e7d4db6ea3523a
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 3051E470A40B05DBCB259FA9E88066E77BAAF50320F25C72BF825963D0D775DD908B41

Function 009B686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 009B4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00A752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009B4E0F

_free.LIBCMT ref: 009EE263
_free.LIBCMT ref: 009EE2AA

Part of subcall function 009B6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 009B6BAD

Strings

Bad directive syntax error, xrefs: 009EE292
>>>AUTOIT SCRIPT<<<, xrefs: 009EE039

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: d35e0d0ffcb2fadc4ba492a730b04efac87ca960cb2fb10905d5cb8a71867df8
Instruction ID: 92438aad3b7a49862b5d15c2b6b3fcd90d72dd65ae352d08b62c757813629f53
Opcode Fuzzy Hash: d35e0d0ffcb2fadc4ba492a730b04efac87ca960cb2fb10905d5cb8a71867df8
Instruction Fuzzy Hash: 17919A71904259AFCF05EFA5CD81AEDB7B8FF48320F10452AF816AB2A1DB74AD45CB50

Function 009B35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,009B35A1,SwapMouseButtons,00000004,?), ref: 009B35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,009B35A1,SwapMouseButtons,00000004,?,?,?,?,009B2754), ref: 009B35F5
RegCloseKey.KERNELBASE(00000000,?,?,009B35A1,SwapMouseButtons,00000004,?,?,?,?,009B2754), ref: 009B3617

Strings

Control Panel\Mouse, xrefs: 009B35D2

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 3bc4b829df17d2285b8fee79aa5ea7c19f188e9821cdcd7d6da9d89f3e9a7a4f
Instruction ID: 5dab5b78789a16fd28bc43e721078a37f920cd7d0c8559713aa38644fea5c82f
Opcode Fuzzy Hash: 3bc4b829df17d2285b8fee79aa5ea7c19f188e9821cdcd7d6da9d89f3e9a7a4f
Instruction Fuzzy Hash: 531148B5910208FFDB20CFA9DD81AEEB7BCEF05750F009469F805D7210E2719E419B60

Function 01370D80 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 013715AD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 013715D1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 013715F3

Memory Dump Source

Source File: 00000000.00000002.1709342961.000000000136F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0136F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136f000_rDOC24INV0616.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction ID: 246b3726b48c83747090ba897d1c768368f1e2b2ea58536a5a96191d9b01eaa7
Opcode Fuzzy Hash: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction Fuzzy Hash: B3621C30A14258DBEB24CFA4C850BDEB776EF58704F1091A9D20DEB390E7799E81CB59

Function 00A1955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 009B4EE5: _fseek.LIBCMT ref: 009B4EFD

Part of subcall function 00A19734: _wcscmp.LIBCMT ref: 00A19824
Part of subcall function 00A19734: _wcscmp.LIBCMT ref: 00A19837

_free.LIBCMT ref: 00A196A2
_free.LIBCMT ref: 00A196A9
_free.LIBCMT ref: 00A19714

Part of subcall function 009D2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,009D9A24), ref: 009D2D69
Part of subcall function 009D2D55: GetLastError.KERNEL32(00000000,?,009D9A24), ref: 009D2D7B

_free.LIBCMT ref: 00A1971C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: f3f2c74d7dfddfa78f826e2996d6ec394af8066fa375cb63296466bbc5d898ca
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: 33512FB1904258ABDF259F64DC81BEEBBB9EF88310F10449EB509A7351DB715A80CF58

Function 009D470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009D47A0
__flush.LIBCMT ref: 009D47C0
__write.LIBCMT ref: 009D47F3
__flsbuf.LIBCMT ref: 009D4821

Part of subcall function 009D8B28: __getptd_noexit.LIBCMT ref: 009D8B28

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 15f3123a95a6e03101c46568db32c86a2890aa7109dfb0cc66d5d76127436667
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 2C41C475A807469BDF18CFA9C8849AE77AAEF813A0B24C53FE819C7780D770DD409B50

Function 009B7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009EEA39
GetOpenFileNameW.COMDLG32(?), ref: 009EEA83

Part of subcall function 009B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009B4743,?,?,009B37AE,?), ref: 009B4770

Part of subcall function 009D0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009D07B0

Strings

X, xrefs: 009EEA51

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 953843ce3a21589452443eff6993878b62f37a21049ceaec6fb39cac878a4220
Instruction ID: d34000bb09e081c6437669b9ddec72dfea67983bd3257e85695f4e3d448e2aa2
Opcode Fuzzy Hash: 953843ce3a21589452443eff6993878b62f37a21049ceaec6fb39cac878a4220
Instruction Fuzzy Hash: 0C219671A102989BCF41DFD4DC45BEEBBFDAF89714F00415AE408AB241DBB859898F91

Function 00A18D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A18DAC
__fread_nolock.LIBCMT ref: 00A18DC1

Strings

EA06, xrefs: 00A18DF3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 23d3398224cc8e4bc90f39529132ac92d2d4942d1cc934557b19af340062d930
Instruction ID: 36f71b2b3e9f6602915cf7c3c28c011e3caa3d6957ced7cf030ce59e8579d062
Opcode Fuzzy Hash: 23d3398224cc8e4bc90f39529132ac92d2d4942d1cc934557b19af340062d930
Instruction Fuzzy Hash: 5701F9718442187EDB18CBA8D816FEE7BF8DB11301F00459FF552D2281E978E6048B60

Function 00A198E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00A198F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00A1990F

Strings

aut, xrefs: 00A19909

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: eb290e1eb0b21efe74249b72bfed2974c2022c8ff142f0223e36a95737b8f73f
Instruction ID: ba3fef5d56d9f563cda6d144ef64dca5f96c5003745511d0b044e53305baa44c
Opcode Fuzzy Hash: eb290e1eb0b21efe74249b72bfed2974c2022c8ff142f0223e36a95737b8f73f
Instruction Fuzzy Hash: B5D05E7994030DBFDB60DBE0DC0EFDBB73CE704700F0006B1BA54920A1EAB095998B91

Function 00A2CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfb255e7c9305e90bbdefe84a202838946231705ce2b2e66f4a8ddb9cf332d9
Instruction ID: 622fdf5647225a91fb58c8b78e45547d2724906fe498c075b585f6c6b3f436e0
Opcode Fuzzy Hash: bcfb255e7c9305e90bbdefe84a202838946231705ce2b2e66f4a8ddb9cf332d9
Instruction Fuzzy Hash: ECF13771A083119FCB14DF28D580A6EBBE5FF89324F54892EF8999B251D730E945CF82

Function 009BF76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 009D0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 009D0193
Part of subcall function 009D0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 009D019B
Part of subcall function 009D0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 009D01A6
Part of subcall function 009D0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 009D01B1
Part of subcall function 009D0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 009D01B9
Part of subcall function 009D0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 009D01C1

Part of subcall function 009C60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,009BF930), ref: 009C6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 009BF9CD
OleInitialize.OLE32(00000000), ref: 009BFA4A
CloseHandle.KERNEL32(00000000), ref: 009F45C8

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 496d7e6bede4b614791697c014dcc48f87ee0147416c3e480bf1f5c36d826dfe
Instruction ID: 4740f759323e9afcbab4176c319d39d6ca4cfa6b1338fc750840a8d25f28143e
Opcode Fuzzy Hash: 496d7e6bede4b614791697c014dcc48f87ee0147416c3e480bf1f5c36d826dfe
Instruction Fuzzy Hash: 0281ABB0D11A40CFD398DFB9AD556597BE6EB88316B90C52AA01DCB271E7F044C68F11

Function 009B434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009B4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 009B4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 009B4432

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: f2004a9f26554872d98ae3cc58d1925e4b148216a645f53ced4c4b0ffe768d43
Instruction ID: 72a76bdf2f61a29ea7c807ca03eaf01283ee0a769f1c0e580ae1787610a399ac
Opcode Fuzzy Hash: f2004a9f26554872d98ae3cc58d1925e4b148216a645f53ced4c4b0ffe768d43
Instruction Fuzzy Hash: E931C3709047018FD720DF74D9846DBBBF8FB58318F00492EF58A82252E7B0A984CB92

Function 009D571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 009D5733

Part of subcall function 009DA16B: __NMSG_WRITE.LIBCMT ref: 009DA192
Part of subcall function 009DA16B: __NMSG_WRITE.LIBCMT ref: 009DA19C

__NMSG_WRITE.LIBCMT ref: 009D573A

Part of subcall function 009DA1C8: GetModuleFileNameW.KERNEL32(00000000,00A733BA,00000104,?,00000001,00000000), ref: 009DA25A
Part of subcall function 009DA1C8: ___crtMessageBoxW.LIBCMT ref: 009DA308

Part of subcall function 009D309F: ___crtCorExitProcess.LIBCMT ref: 009D30A5
Part of subcall function 009D309F: ExitProcess.KERNEL32 ref: 009D30AE

Part of subcall function 009D8B28: __getptd_noexit.LIBCMT ref: 009D8B28

RtlAllocateHeap.NTDLL(011B0000,00000000,00000001,00000000,?,?,?,009D0DD3,?), ref: 009D575F

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 10a792afec53346c2826473da45b6a7b69b4aa23e84972e37d4a78ff58508d57
Instruction ID: b25860852c0802b93a727d41278bc1916e77108bd28e6baedc2bac6494411197
Opcode Fuzzy Hash: 10a792afec53346c2826473da45b6a7b69b4aa23e84972e37d4a78ff58508d57
Instruction Fuzzy Hash: 9D01F5722C0B11DED6106B75EC82B6E774C8BD2362F62C527F509AA382DE748C418761

Function 00A198A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00A19548,?,?,?,?,?,00000004), ref: 00A198BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00A19548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00A198D1
CloseHandle.KERNEL32(00000000,?,00A19548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00A198D8

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: ed3989825cd98cdc3be120effd15f4f36201827db1c92afcdb7a8fadfb93fbb7
Instruction ID: f038c0e18ed4309e7d9c3dc7c24ac00186b09198fa41ce08f98dfdb9388a70cc
Opcode Fuzzy Hash: ed3989825cd98cdc3be120effd15f4f36201827db1c92afcdb7a8fadfb93fbb7
Instruction Fuzzy Hash: E1E08632541314BBD7215B94EC09FDA7B59AB06760F104220FB24690E087B125129798

Function 00A18D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A18D1B

Part of subcall function 009D2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,009D9A24), ref: 009D2D69
Part of subcall function 009D2D55: GetLastError.KERNEL32(00000000,?,009D9A24), ref: 009D2D7B

_free.LIBCMT ref: 00A18D2C
_free.LIBCMT ref: 00A18D3E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 4154adcba56432801be01d0846ba82f12a307507b44e4ba78cb01939c67f0b26
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: 97E017A1641B0146CB24A7B8B980BD323ED4FB9752B14491EB80DD72C6CE68F8828128

Function 009BA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 009EFC01

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 99fbaeb25e7bb48e8d27e6af13f3bda9f60022a805c2aa1dd5a354b1a17e635b
Instruction ID: 1c09d20b358ce8898fe91d370393286bab620656eff3a74db2b7f47759735b92
Opcode Fuzzy Hash: 99fbaeb25e7bb48e8d27e6af13f3bda9f60022a805c2aa1dd5a354b1a17e635b
Instruction Fuzzy Hash: 58227B70508305DFCB24DF14C690BAABBE5BF84324F14896DE89A8B362D775EC45CB82

Function 009B4C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009B4CBA

Strings

EA06, xrefs: 009ED8CC

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: af4152cdd219b33dd7ff693c4d9518f43be79a12e3873d6330a96da02d0337ea
Instruction ID: 2c2af00501608bc08dec9a9d5a974a7c279414170fbe8c074717234a3e235229
Opcode Fuzzy Hash: af4152cdd219b33dd7ff693c4d9518f43be79a12e3873d6330a96da02d0337ea
Instruction Fuzzy Hash: 1E4180219041586BDF215FA4CE517FE7FB6DBC5320F284475EC829B2C7D634AD44A3A1

Function 009B7A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009B7AAB
_memmove.LIBCMT ref: 009B7B16

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: dcaa55ca9a04723143b9e8694f613c9e7f590ea8bac40c6ab2e3bad66fc376f5
Instruction ID: b2a3201602c5cf639e1feb586c4481ab66020b7af8f63d2ac80f62581e116889
Opcode Fuzzy Hash: dcaa55ca9a04723143b9e8694f613c9e7f590ea8bac40c6ab2e3bad66fc376f5
Instruction Fuzzy Hash: 913189B1604606AFC744DFA8D9D1E69F3A9FF84320B15872AE519CB391DB34E950CB90

Function 009B47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 009B4834

Part of subcall function 009D336C: __lock.LIBCMT ref: 009D3372
Part of subcall function 009D336C: DecodePointer.KERNEL32(00000001,?,009B4849,00A07C74), ref: 009D337E
Part of subcall function 009D336C: EncodePointer.KERNEL32(?,?,009B4849,00A07C74), ref: 009D3389

Part of subcall function 009B48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 009B4915
Part of subcall function 009B48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 009B492A

Part of subcall function 009B3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009B3B68
Part of subcall function 009B3B3A: IsDebuggerPresent.KERNEL32 ref: 009B3B7A
Part of subcall function 009B3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,00A752F8,00A752E0,?,?), ref: 009B3BEB
Part of subcall function 009B3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 009B3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 009B4874

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 48bda1a2c0d0ff2572d2cf6e66311c1bafd7f131259f735ca34adbe17c6e2e07
Instruction ID: f3ee0ca0f53b448b199fd778788009a0e8c14815aeeefe9fb76c681b2557b3c4
Opcode Fuzzy Hash: 48bda1a2c0d0ff2572d2cf6e66311c1bafd7f131259f735ca34adbe17c6e2e07
Instruction Fuzzy Hash: 771193719147419FC700DF78DD45A4ABBE8EF85760F10891EF14483272DBB09546CB92

Function 009D0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009D571C: __FF_MSGBANNER.LIBCMT ref: 009D5733
Part of subcall function 009D571C: __NMSG_WRITE.LIBCMT ref: 009D573A
Part of subcall function 009D571C: RtlAllocateHeap.NTDLL(011B0000,00000000,00000001,00000000,?,?,?,009D0DD3,?), ref: 009D575F

std::exception::exception.LIBCMT ref: 009D0DEC
__CxxThrowException@8.LIBCMT ref: 009D0E01

Part of subcall function 009D859B: RaiseException.KERNEL32(?,?,?,00A69E78,00000000,?,?,?,?,009D0E06,?,00A69E78,?,00000001), ref: 009D85F0

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 146f92f5c19217f6225b00e8fde22a4548ded8f8fa298b730dc45ac5f485f6c6
Instruction ID: 7954a3f97568710f8976b47a10586b2eaf4d9a5b6b1c058a48a5d20c08772be6
Opcode Fuzzy Hash: 146f92f5c19217f6225b00e8fde22a4548ded8f8fa298b730dc45ac5f485f6c6
Instruction Fuzzy Hash: 54F0A43598031966CB10BAA4EC01BDFB7AC9F81311F50886BF908A6392EF719A50D6E1

Function 009D55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 009D562C
__lock_file.LIBCMT ref: 009D564D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 9eaf6ab2c8cff84407d49ab1fab6227c947fbf3b1601c06a184ff3cfa4531e76
Instruction ID: 55f501d1e00641428108929251718d26ce1ff1a0155746f7f30316782a8bffec
Opcode Fuzzy Hash: 9eaf6ab2c8cff84407d49ab1fab6227c947fbf3b1601c06a184ff3cfa4531e76
Instruction Fuzzy Hash: 8F01D471880A08ABCF12AF689C02A9F7B61EFD0321F86C117B8245B391DB35CA11DF91

Function 009D53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009D8B28: __getptd_noexit.LIBCMT ref: 009D8B28

__lock_file.LIBCMT ref: 009D53EB

Part of subcall function 009D6C11: __lock.LIBCMT ref: 009D6C34

__fclose_nolock.LIBCMT ref: 009D53F6

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 6143a55e187c8d406aba44e81cc0e3fbfd8ca6966abdce4dfcc4986be0e7c462
Instruction ID: efb7ba25e2085c3336f497ba211dad97cc6e053e391562b9158b44c38db114ba
Opcode Fuzzy Hash: 6143a55e187c8d406aba44e81cc0e3fbfd8ca6966abdce4dfcc4986be0e7c462
Instruction Fuzzy Hash: 30F09671880A04DAD7107B7598017AEB7A06F81374F22C607A464AB3C2CBBC49415B52

Function 01370D7D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 013715AD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 013715D1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 013715F3

Memory Dump Source

Source File: 00000000.00000002.1709342961.000000000136F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0136F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136f000_rDOC24INV0616.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: 2504a24e79805b6f5af22e7510e30e3980043a820dcd51af282ac805d6f6cf3a
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: 6212BD24E24658C6EB24DF64D8507DEB232EF68300F1094E9910DEB7A5E77A4F81CF5A

Function 009D0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 009D0CB7

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 9fe6374722302ebf52a05e9639aed76a6611cc87e881df583765d937c9941b9c
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: B331B370A501059BC718DF69C484A69FBAAFB99300F64C7A6E88ACB355D731EDC1DBC0

Function 009EFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 009EFCB7

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2c582acfb2e0b9bba0cfcf5d7b9d3db5c6e88cae4ff7aa5991a3289e764963e7
Instruction ID: d4d3cc62924bb77698792692d7d7933587894dc7fb9a246e9ef7d736bc657795
Opcode Fuzzy Hash: 2c582acfb2e0b9bba0cfcf5d7b9d3db5c6e88cae4ff7aa5991a3289e764963e7
Instruction Fuzzy Hash: 0D4116745043418FDB24DF24C544B6ABBE0BF85324F0988ACE9998B3A2C372EC45CF52

Function 009B4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009B4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 009B4BEF

Part of subcall function 009D525B: __wfsopen.LIBCMT ref: 009D5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00A752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009B4E0F

Part of subcall function 009B4B6A: FreeLibrary.KERNEL32(00000000), ref: 009B4BA4

Part of subcall function 009B4C70: _memmove.LIBCMT ref: 009B4CBA

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: f8bf58d6f53604d4a479b1fc6b6adc32cb77e779ef8367464706bbb331b40045
Instruction ID: 7ed2347022e4e6b3f22be19c32607622823d726436796c6971d6186b41e09c49
Opcode Fuzzy Hash: f8bf58d6f53604d4a479b1fc6b6adc32cb77e779ef8367464706bbb331b40045
Instruction Fuzzy Hash: 0C11E731640205ABCF11EF70CD12FEE77A9AF84720F10882DF645A7183DA71D905A791

Function 009EFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 009EFD91

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b3a06919dc050052b4eabb2e51a0df6f6256ecf835762856c5b6af0d4ad7d5e1
Instruction ID: c36f8043ad9d2a3f0e744aff00ea50dff8bb7a421368baf7bc221fe38164bbf7
Opcode Fuzzy Hash: b3a06919dc050052b4eabb2e51a0df6f6256ecf835762856c5b6af0d4ad7d5e1
Instruction Fuzzy Hash: CD21F4B4908341DFCB14DF64C544B6ABBE5BF88324F05896CF98A57762D731E809CB92

Function 009D4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 009D48A6

Part of subcall function 009D8B28: __getptd_noexit.LIBCMT ref: 009D8B28

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 6142f7802e2d720fe06c07dac16dc3e10d78a631208b59e82f0aec745257c974
Instruction ID: 1d17cd1842fbee5c181e6f78611ed25b51e80c010346e34b87b30bf43830095e
Opcode Fuzzy Hash: 6142f7802e2d720fe06c07dac16dc3e10d78a631208b59e82f0aec745257c974
Instruction Fuzzy Hash: 89F02231880648EBDF11AFB4CC063AF37A4AF40360F01C406F420AA3C2CBB88950EB41

Function 009B4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00A752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009B4E7E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: eea6dc1dd06de3fccd4d4f41137337e5ab54e0fc9e053adb63d2f20470761da8
Instruction ID: 8f5777189ae58d6cbde175d7ef5aab7094050a15ffbdb5ae2dbdca3bb083becb
Opcode Fuzzy Hash: eea6dc1dd06de3fccd4d4f41137337e5ab54e0fc9e053adb63d2f20470761da8
Instruction Fuzzy Hash: 96F03971501711CFCB349F64E994892BBE5BF543393208A3EE2D686622C772E850EF40

Function 009D0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009D07B0

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 25e0b7b07c69a2d50b443fcf2f9c32c1d6cb4a4f10a10014ca17e07da8059591
Instruction ID: 2784a23210320593e4c986e932ecf39fe53e6c7b6d59b3247f7f7daa36f5d366
Opcode Fuzzy Hash: 25e0b7b07c69a2d50b443fcf2f9c32c1d6cb4a4f10a10014ca17e07da8059591
Instruction Fuzzy Hash: E4E0CD369041285BC721D6E99C05FEAB7DDDFC87A0F0441B5FC0CD7245D9709C8086D0

Function 00A18E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00A18EC1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: f338bf30711ab6595317731abd4b018a1efa3875748d4ac8f68e1fe5ce86f176
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: E9E092B0104B005BD7398B24D800BE377E1AB05304F00091DF2AA83241EB62B8818759

Function 009D525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 009D5266

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 99cdf93734e6d06a25ee31b6b711407e6778faa005d40afbe8f1e2579486235c
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: FBB0927A48020C77CE012A82EC02B493B199B81764F408021FB1C18272E673A6689A89

Function 01371D80 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01371D91

Memory Dump Source

Source File: 00000000.00000002.1709342961.000000000136F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0136F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136f000_rDOC24INV0616.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 45f99b032915bc7a857405d40ff1804680226df6af0a444155518c496a4a9db6
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: B6E0E67594010DDFDB00EFB8D5496AE7FB4EF04301F100161FD01D2281D6309D508A62

Non-executed Functions

Function 00A3CABC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00A3CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A3CB95
GetWindowLongW.USER32(?,000000F0), ref: 00A3CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A3CC00
SendMessageW.USER32 ref: 00A3CC29
_wcsncpy.LIBCMT ref: 00A3CC95
GetKeyState.USER32(00000011), ref: 00A3CCB6
GetKeyState.USER32(00000009), ref: 00A3CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A3CCD9
GetKeyState.USER32(00000010), ref: 00A3CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A3CD0C
SendMessageW.USER32 ref: 00A3CD33
SendMessageW.USER32(?,00001030,?,00A3B348), ref: 00A3CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00A3CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A3CE60
SetCapture.USER32(?), ref: 00A3CE69
ClientToScreen.USER32(?,?), ref: 00A3CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A3CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A3CEF5
ReleaseCapture.USER32 ref: 00A3CF00
GetCursorPos.USER32(?), ref: 00A3CF3A
ScreenToClient.USER32(?,?), ref: 00A3CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A3CFA3
SendMessageW.USER32 ref: 00A3CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A3D00E
SendMessageW.USER32 ref: 00A3D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A3D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A3D06D
GetCursorPos.USER32(?), ref: 00A3D08D
ScreenToClient.USER32(?,?), ref: 00A3D09A
GetParent.USER32(?), ref: 00A3D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A3D123
SendMessageW.USER32 ref: 00A3D154
ClientToScreen.USER32(?,?), ref: 00A3D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A3D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A3D20C
SendMessageW.USER32 ref: 00A3D22F
ClientToScreen.USER32(?,?), ref: 00A3D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A3D2B5

Part of subcall function 009B25DB: GetWindowLongW.USER32(?,000000EB), ref: 009B25EC

GetWindowLongW.USER32(?,000000F0), ref: 00A3D351

Strings

F, xrefs: 00A3D235
@GUI_DRAGID, xrefs: 00A3CE9C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 00a9050e654b8b03aaa5cd88807a1af5d077bcb0e737b392b0e082fd088d101d
Instruction ID: af640772412dbb30a748dd502011e6585017826c01302e66401efc317e1a8daf
Opcode Fuzzy Hash: 00a9050e654b8b03aaa5cd88807a1af5d077bcb0e737b392b0e082fd088d101d
Instruction Fuzzy Hash: 5F42BB34A04240AFDB24CF68DC45FAABBE5FF49320F144A19F699AB2B0D771D841DB52

Function 009C6F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009C71C3
_memset.LIBCMT ref: 009C7539
_memmove.LIBCMT ref: 009C76AC

Strings

\b(?=\w), xrefs: 00A03769
[:>:]], xrefs: 009C7492
\b(?<=\w), xrefs: 00A03773
Q\E, xrefs: 009C7FCB
[:<:]], xrefs: 009C7479
DEFINE, xrefs: 00A02103

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 796dd3615d446e6139adc6d036f296db5a4e5f1e7f7357ae32037c3056f46064
Instruction ID: 0d1c217352b1a271655262714d3626090d1861de16a91941011dd27b04f5408d
Opcode Fuzzy Hash: 796dd3615d446e6139adc6d036f296db5a4e5f1e7f7357ae32037c3056f46064
Instruction Fuzzy Hash: DF939F75E04219DBDF24CF98E881BADB7B1FF48310F24856AE945AB2C1E7749E81CB50

Function 009B48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 009B48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009ED665
IsIconic.USER32(?), ref: 009ED66E
ShowWindow.USER32(?,00000009), ref: 009ED67B
SetForegroundWindow.USER32(?), ref: 009ED685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 009ED69B
GetCurrentThreadId.KERNEL32 ref: 009ED6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 009ED6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 009ED6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 009ED6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 009ED6CF
SetForegroundWindow.USER32(?), ref: 009ED6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 009ED6E7
keybd_event.USER32(00000012,00000000), ref: 009ED6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 009ED6FC
keybd_event.USER32(00000012,00000000), ref: 009ED701
MapVirtualKeyW.USER32(00000012,00000000), ref: 009ED70A
keybd_event.USER32(00000012,00000000), ref: 009ED70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 009ED719
keybd_event.USER32(00000012,00000000), ref: 009ED71E
SetForegroundWindow.USER32(?), ref: 009ED721
AttachThreadInput.USER32(?,?,00000000), ref: 009ED748

Strings

Shell_TrayWnd, xrefs: 009ED660

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 584bc8056fb4edf062e79eb25215732582ed79fa1f188a6f0a66b7fdcdc20286
Instruction ID: 45ceb5596ff057333ac45da98655fa20e797dfc4d837fe539b0eb942f095a712
Opcode Fuzzy Hash: 584bc8056fb4edf062e79eb25215732582ed79fa1f188a6f0a66b7fdcdc20286
Instruction Fuzzy Hash: C3318371E51358BFEB216FA29C4AF7F7F6CEB44B50F104025FA04EA1E1C6B15D01AAA0

Function 00A08310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00A087E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A0882B
Part of subcall function 00A087E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A08858
Part of subcall function 00A087E1: GetLastError.KERNEL32 ref: 00A08865

_memset.LIBCMT ref: 00A08353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00A083A5
CloseHandle.KERNEL32(?), ref: 00A083B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00A083CD
GetProcessWindowStation.USER32 ref: 00A083E6
SetProcessWindowStation.USER32(00000000), ref: 00A083F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00A0840A

Part of subcall function 00A081CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A08309), ref: 00A081E0
Part of subcall function 00A081CB: CloseHandle.KERNEL32(?,?,00A08309), ref: 00A081F2

Strings

winsta0, xrefs: 00A083C8
, xrefs: 00A08362
default, xrefs: 00A08405

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 9ce78612045a46d3da0fd822337c63da964357681ef1808ad8fb2622e8c877d9
Instruction ID: ee460dafd18efe1d3d62666f60abb83774aaca270e6d9c61e5413f63fae996f9
Opcode Fuzzy Hash: 9ce78612045a46d3da0fd822337c63da964357681ef1808ad8fb2622e8c877d9
Instruction Fuzzy Hash: 898189B180020DAFDF11DFA4ED45AEEBBB8FF04308F144169F954A62A1DB399E15DB24

Function 00A1C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A1C78D
FindClose.KERNEL32(00000000), ref: 00A1C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A1C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A1C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A1C844
__swprintf.LIBCMT ref: 00A1C890
__swprintf.LIBCMT ref: 00A1C8D3

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

__swprintf.LIBCMT ref: 00A1C927

Part of subcall function 009D3698: __woutput_l.LIBCMT ref: 009D36F1

__swprintf.LIBCMT ref: 00A1C975

Part of subcall function 009D3698: __flsbuf.LIBCMT ref: 009D3713
Part of subcall function 009D3698: __flsbuf.LIBCMT ref: 009D372B

__swprintf.LIBCMT ref: 00A1C9C4
__swprintf.LIBCMT ref: 00A1CA13
__swprintf.LIBCMT ref: 00A1CA62

Strings

%4d, xrefs: 00A1C8CD
%4d%02d%02d%02d%02d%02d, xrefs: 00A1C88A
%02d, xrefs: 00A1C91B, 00A1C925, 00A1C973, 00A1C9C2, 00A1CA11, 00A1CA60

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 8211fe76f663975d95a3c6edc8990e6bdac302f47a7b1657168b2ab609f52909
Instruction ID: fe609be31956ef05f2b6c6e9039a2e3fc4fa0b54576ff8d72585d0a734f2b728
Opcode Fuzzy Hash: 8211fe76f663975d95a3c6edc8990e6bdac302f47a7b1657168b2ab609f52909
Instruction Fuzzy Hash: 25A13EB1418304ABD700EFA4C986EEFB7ECFFD5710F40491AF59586191EA30EA48CB62

Function 00A1EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00A1EFB6
_wcscmp.LIBCMT ref: 00A1EFCB
_wcscmp.LIBCMT ref: 00A1EFE2
GetFileAttributesW.KERNEL32(?), ref: 00A1EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 00A1F00E
FindNextFileW.KERNEL32(00000000,?), ref: 00A1F026
FindClose.KERNEL32(00000000), ref: 00A1F031
FindFirstFileW.KERNEL32(*.*,?), ref: 00A1F04D
_wcscmp.LIBCMT ref: 00A1F074
_wcscmp.LIBCMT ref: 00A1F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 00A1F09D
SetCurrentDirectoryW.KERNEL32(00A68920), ref: 00A1F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A1F0C5
FindClose.KERNEL32(00000000), ref: 00A1F0D2
FindClose.KERNEL32(00000000), ref: 00A1F0E4

Strings

*.*, xrefs: 00A1F048

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 3f89b5f956eca667450d90915a1f38fd6844678daf04a5239cb5cf8f944035b7
Instruction ID: f594e7770c651a515b7992296290cdee1ef3bbf21ec4fcc7af2db86062623e2d
Opcode Fuzzy Hash: 3f89b5f956eca667450d90915a1f38fd6844678daf04a5239cb5cf8f944035b7
Instruction Fuzzy Hash: 9231B232901259BEDB14DBE4EC58AEEB7ACAF48360F104176F804D31A1EB74DA85CA61

Function 00A30857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A30953
RegCreateKeyExW.ADVAPI32(?,?,00000000,00A3F910,00000000,?,00000000,?,?), ref: 00A309C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00A30A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00A30A92
RegCloseKey.ADVAPI32(?), ref: 00A30DB2
RegCloseKey.ADVAPI32(00000000), ref: 00A30DBF

Strings

REG_QWORD, xrefs: 00A30D00
REG_BINARY, xrefs: 00A30D4D
REG_EXPAND_SZ, xrefs: 00A30A2F
REG_DWORD, xrefs: 00A30C83
REG_SZ, xrefs: 00A30AD0
REG_MULTI_SZ, xrefs: 00A30B7A

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 219078db6114248e38c3369781394358ccd56d59609dc7f1bcc4b6ba3cb50b61
Instruction ID: 496fd0e860e50ae509ea73bf797dff2a109ecfe0f4c0d810cf59eae1154bd57f
Opcode Fuzzy Hash: 219078db6114248e38c3369781394358ccd56d59609dc7f1bcc4b6ba3cb50b61
Instruction Fuzzy Hash: 280226756046019FCB14EF28C951E6AB7E5EF89724F04895DF98A9B3A2DB30EC41CB81

Function 00A1F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00A1F113
_wcscmp.LIBCMT ref: 00A1F128
_wcscmp.LIBCMT ref: 00A1F13F

Part of subcall function 00A14385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A143A0

FindNextFileW.KERNEL32(00000000,?), ref: 00A1F16E
FindClose.KERNEL32(00000000), ref: 00A1F179
FindFirstFileW.KERNEL32(*.*,?), ref: 00A1F195
_wcscmp.LIBCMT ref: 00A1F1BC
_wcscmp.LIBCMT ref: 00A1F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 00A1F1E5
SetCurrentDirectoryW.KERNEL32(00A68920), ref: 00A1F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A1F20D
FindClose.KERNEL32(00000000), ref: 00A1F21A
FindClose.KERNEL32(00000000), ref: 00A1F22C

Strings

*.*, xrefs: 00A1F190

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 6686300fd95cd4ca81ff6cc1c5ee3c132f822c893b5157c573d00963ab488f75
Instruction ID: ce13f297e334d4751a856b1200c87847c6c26aefe9aad31e3f5c03d0a68fbc73
Opcode Fuzzy Hash: 6686300fd95cd4ca81ff6cc1c5ee3c132f822c893b5157c573d00963ab488f75
Instruction Fuzzy Hash: 1331B336900259BEDF20DFA4EC59AEE77AC9F89360F144275F914A31A0EB30DE85CA54

Function 00A1A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A1A20F
__swprintf.LIBCMT ref: 00A1A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A1A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00A1A293
_memset.LIBCMT ref: 00A1A2B2
_wcsncpy.LIBCMT ref: 00A1A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00A1A323
CloseHandle.KERNEL32(00000000), ref: 00A1A32E
RemoveDirectoryW.KERNEL32(?), ref: 00A1A337
CloseHandle.KERNEL32(00000000), ref: 00A1A341

Strings

\, xrefs: 00A1A247
\??\%s, xrefs: 00A1A22B
:, xrefs: 00A1A252

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 275a30441c2917a6418856a4be2e29fdd084ea3eccd4c01589d7b2af4756a889
Instruction ID: 2dc592f4f704f7ea2e2447b6fc195bf0795a6243ab7885c0777c75e74a8faf3f
Opcode Fuzzy Hash: 275a30441c2917a6418856a4be2e29fdd084ea3eccd4c01589d7b2af4756a889
Instruction Fuzzy Hash: 6031C2B5900209ABDB21DFA0DC49FEF77BCEF99740F1041B6FA18D6160EB7096858B25

Function 00A07CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A08202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A0821E
Part of subcall function 00A08202: GetLastError.KERNEL32(?,00A07CE2,?,?,?), ref: 00A08228
Part of subcall function 00A08202: GetProcessHeap.KERNEL32(00000008,?,?,00A07CE2,?,?,?), ref: 00A08237
Part of subcall function 00A08202: HeapAlloc.KERNEL32(00000000,?,00A07CE2,?,?,?), ref: 00A0823E
Part of subcall function 00A08202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A08255

Part of subcall function 00A0829F: GetProcessHeap.KERNEL32(00000008,00A07CF8,00000000,00000000,?,00A07CF8,?), ref: 00A082AB
Part of subcall function 00A0829F: HeapAlloc.KERNEL32(00000000,?,00A07CF8,?), ref: 00A082B2
Part of subcall function 00A0829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00A07CF8,?), ref: 00A082C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A07D13
_memset.LIBCMT ref: 00A07D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A07D47
GetLengthSid.ADVAPI32(?), ref: 00A07D58
GetAce.ADVAPI32(?,00000000,?), ref: 00A07D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A07DB1
GetLengthSid.ADVAPI32(?), ref: 00A07DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00A07DDD
HeapAlloc.KERNEL32(00000000), ref: 00A07DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A07E05
CopySid.ADVAPI32(00000000), ref: 00A07E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A07E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A07E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A07E77

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 160554f8965bbdff0c0618dd7010e6dc8d9318857274fd4b58af97fe4426d1b3
Instruction ID: 69781ffece862ecd591f1989374b3806c7af1acb6a8939638cf90788f0d9597d
Opcode Fuzzy Hash: 160554f8965bbdff0c0618dd7010e6dc8d9318857274fd4b58af97fe4426d1b3
Instruction Fuzzy Hash: A2612B71D04209AFDF04DFA4EC85AEEBB79FF04710F048269F915A6291DB35AA16CB60

Function 009C66E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

BSR_ANYCRLF), xrefs: 00A0131E
CR), xrefs: 00A01287
LIMIT_RECURSION=, xrefs: 00A011FC
UTF), xrefs: 00A010FA
ANY), xrefs: 00A012DE
UTF16), xrefs: 00A010CF
LF), xrefs: 00A012A4
ANYCRLF), xrefs: 00A012FB
NO_AUTO_POSSESS), xrefs: 00A0112E
UCP), xrefs: 00A0110D
LIMIT_MATCH=, xrefs: 00A01170
NO_START_OPT), xrefs: 00A0114F
CRLF), xrefs: 00A012C1
BSR_UNICODE), xrefs: 00A01338

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: c31fa350ff8bbf018a144b4e08e2869b7f4848d1d044fa6d8e6c55c756134155
Instruction ID: d3ca4596b8d55674fe781994e85236c5c9ad825b256f3b74c094420bb5ff43e4
Opcode Fuzzy Hash: c31fa350ff8bbf018a144b4e08e2869b7f4848d1d044fa6d8e6c55c756134155
Instruction Fuzzy Hash: AF724C75E002199BDB14CF59D880BEEB7F5FF48310F14816AE949EB291EB349E81CB91

Function 00A1001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A10097
SetKeyboardState.USER32(?), ref: 00A10102
GetAsyncKeyState.USER32(000000A0), ref: 00A10122
GetKeyState.USER32(000000A0), ref: 00A10139
GetAsyncKeyState.USER32(000000A1), ref: 00A10168
GetKeyState.USER32(000000A1), ref: 00A10179
GetAsyncKeyState.USER32(00000011), ref: 00A101A5
GetKeyState.USER32(00000011), ref: 00A101B3
GetAsyncKeyState.USER32(00000012), ref: 00A101DC
GetKeyState.USER32(00000012), ref: 00A101EA
GetAsyncKeyState.USER32(0000005B), ref: 00A10213
GetKeyState.USER32(0000005B), ref: 00A10221

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: fa6af995cd2c849ca22f7a56594a1945183f27df48f00fc2de2bfffcdfb66647
Instruction ID: deb722c9b3e0940172c7879c8fbf0b2083d8f974586f714767c00be05fdb3d10
Opcode Fuzzy Hash: fa6af995cd2c849ca22f7a56594a1945183f27df48f00fc2de2bfffcdfb66647
Instruction Fuzzy Hash: 8B51E92090478869FB35DBB08954FEABFB49F11380F08469ED5C25A5C2DAE49BCCC761

Function 00A303DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A30E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A2FDAD,?,?), ref: 00A30E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A304AC

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00A3054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00A305E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00A30822
RegCloseKey.ADVAPI32(00000000), ref: 00A3082F

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 11ff8500bba3ad1f38999a6118b130143291f0bc50dc9baf5dda7b13f59248b1
Instruction ID: eb3a0de24a8f8b8321ac99d04b381a3173534df708b50968d88ca554af33306c
Opcode Fuzzy Hash: 11ff8500bba3ad1f38999a6118b130143291f0bc50dc9baf5dda7b13f59248b1
Instruction Fuzzy Hash: 60E14F31604204AFCB14DF68C995E6ABBF5EF89714F04896DF94ADB261D730ED01CB92

Function 00A283BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

CoInitialize.OLE32 ref: 00A28403
CoUninitialize.OLE32 ref: 00A2840E
CoCreateInstance.OLE32(?,00000000,00000017,00A42BEC,?), ref: 00A2846E
IIDFromString.OLE32(?,?), ref: 00A284E1
VariantInit.OLEAUT32(?), ref: 00A2857B
VariantClear.OLEAUT32(?), ref: 00A285DC

Strings

NULL Pointer assignment, xrefs: 00A284B3
Failed to create object, xrefs: 00A28479, 00A2852F
Invalid parameter, xrefs: 00A284FA

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 632232bbb203bdf2268b808ec8b53bb1c908aae7abaee4ca33b94b8f416d0cf4
Instruction ID: 09c836cdab385726328bf7304efa8143ac9970c98d35b056a3208d0109184910
Opcode Fuzzy Hash: 632232bbb203bdf2268b808ec8b53bb1c908aae7abaee4ca33b94b8f416d0cf4
Instruction Fuzzy Hash: 1E61B2706093219FC710EF58E944F5EB7E8AF49754F00492DF9859B291CB74ED44CB92

Function 00A24164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00A2418B
EmptyClipboard.USER32 ref: 00A24191
GlobalAlloc.KERNEL32(00000002,?), ref: 00A241A6
CloseClipboard.USER32 ref: 00A24245

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: a2f683ce05288ecc7d65cca483f31b6179545d382f88995a78f53a538a1ba16e
Instruction ID: e5000b45c2669eb59f594aed258e5d47706560b62b92119d440012cb1e9f6ad9
Opcode Fuzzy Hash: a2f683ce05288ecc7d65cca483f31b6179545d382f88995a78f53a538a1ba16e
Instruction Fuzzy Hash: F7219135610210DFDB10AFA4ED09BAA7BB8EF55720F108025F9469B2B1DB70AC41CB94

Function 00A137EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009B4743,?,?,009B37AE,?), ref: 009B4770

Part of subcall function 00A14A31: GetFileAttributesW.KERNEL32(?,00A1370B), ref: 00A14A32

FindFirstFileW.KERNEL32(?,?), ref: 00A138A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00A1394B
MoveFileW.KERNEL32(?,?), ref: 00A1395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00A1397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A1399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00A139B9

Strings

\*.*, xrefs: 00A1384E, 00A13857, 00A1386C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: ee0a9116be55176657fb9b9b60dd7c93988c7712887d90fbf3ecd34343a831c7
Instruction ID: 5ab84f6893f4d639edab4fe19e76d0236c14e916bd16566efc2374923887c967
Opcode Fuzzy Hash: ee0a9116be55176657fb9b9b60dd7c93988c7712887d90fbf3ecd34343a831c7
Instruction Fuzzy Hash: 75518C3280514CAACF05EFE0DA92AEDB779AF94310F600169E44277192EF216F49CB61

Function 00A1F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00A1F440
Sleep.KERNEL32(0000000A), ref: 00A1F470
_wcscmp.LIBCMT ref: 00A1F484
_wcscmp.LIBCMT ref: 00A1F49F
FindNextFileW.KERNEL32(?,?), ref: 00A1F53D
FindClose.KERNEL32(00000000), ref: 00A1F553

Strings

*.*, xrefs: 00A1F425

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 2eee43c548421fdb3fb20697f1d82c797336dc7e21a7e1000b837d784da7cfeb
Instruction ID: 2b6ec66c0f595d22682acddfd6f6700bcfb5b546130f6f39e3deb61c30610f9f
Opcode Fuzzy Hash: 2eee43c548421fdb3fb20697f1d82c797336dc7e21a7e1000b837d784da7cfeb
Instruction Fuzzy Hash: 26417F7194424AAFCF14DFA4DC45AEEBBB4FF44320F144566F815A7291EB309A85CB50

Function 009C5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009C58A5
_memmove.LIBCMT ref: 009C58F5
_memmove.LIBCMT ref: 009C595B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8158461129a538b127b7d86cdd74327f477db02cc6c2ca9ec138d7cf9c8c5c5f
Instruction ID: 1858175b71c5751ed9c2194e4e412401b50537f4843df63fb4d402103f5d75e5
Opcode Fuzzy Hash: 8158461129a538b127b7d86cdd74327f477db02cc6c2ca9ec138d7cf9c8c5c5f
Instruction Fuzzy Hash: 62127A70E00609DFDF04DFA5D981BEEB7B9FF88310F108569E406A7290EB36A955CB61

Function 00A13B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009B4743,?,?,009B37AE,?), ref: 009B4770

Part of subcall function 00A14A31: GetFileAttributesW.KERNEL32(?,00A1370B), ref: 00A14A32

FindFirstFileW.KERNEL32(?,?), ref: 00A13B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A13BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A13BEA
FindClose.KERNEL32(00000000), ref: 00A13C01
FindClose.KERNEL32(00000000), ref: 00A13C0A

Strings

\*.*, xrefs: 00A13B5B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 36aa7ad0d2708835a88e5ba885943d9c6e9c82336bd9cf69bd5b653cae1bff18
Instruction ID: 1bcc2367644b691bfec3dcfa976fe89d4a19f00148fb8f6c3b56b8690408dc02
Opcode Fuzzy Hash: 36aa7ad0d2708835a88e5ba885943d9c6e9c82336bd9cf69bd5b653cae1bff18
Instruction Fuzzy Hash: DC317E3600C3859FC701EFA4D9919EFB7A8AED5314F444E2DF4D592191EB21DA09C7A3

Function 00A151BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00A087E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A0882B
Part of subcall function 00A087E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A08858
Part of subcall function 00A087E1: GetLastError.KERNEL32 ref: 00A08865

ExitWindowsEx.USER32(?,00000000), ref: 00A151F9

Strings

SeShutdownPrivilege, xrefs: 00A151C9
, xrefs: 00A151E7
@, xrefs: 00A151EC

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: a2988cbc16efb47028a384b54fa856bea8f4ebedb75d85cc706d5ba35562e6f0
Instruction ID: 974fc45a44a3363f5aa1b2e31f6562bd06c1f3327bb30bbfc472bbb08a5d2e1f
Opcode Fuzzy Hash: a2988cbc16efb47028a384b54fa856bea8f4ebedb75d85cc706d5ba35562e6f0
Instruction Fuzzy Hash: C001FC37F91615EFE7286778AC9AFF7726CDB49750F240520F943D20D1DA711C818594

Function 00A26283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00A262DC
WSAGetLastError.WSOCK32(00000000), ref: 00A262EB
bind.WSOCK32(00000000,?,00000010), ref: 00A26307
listen.WSOCK32(00000000,00000005), ref: 00A26316
WSAGetLastError.WSOCK32(00000000), ref: 00A26330
closesocket.WSOCK32(00000000,00000000), ref: 00A26344

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 5399b14479b739428eb7729cdff26017580eb092307dfbff610762ddf921106b
Instruction ID: 4ebc3079629ecf1852aefb5b1453e252dac4e379bc8d62e37b5650c85c777354
Opcode Fuzzy Hash: 5399b14479b739428eb7729cdff26017580eb092307dfbff610762ddf921106b
Instruction Fuzzy Hash: 1321A031600215AFCB10EF68DD45B6EB7B9EF49720F144169F916AB3D1C770AD01CB51

Function 009C5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 009D0DB6: std::exception::exception.LIBCMT ref: 009D0DEC
Part of subcall function 009D0DB6: __CxxThrowException@8.LIBCMT ref: 009D0E01

_memmove.LIBCMT ref: 00A00258
_memmove.LIBCMT ref: 00A0036D
_memmove.LIBCMT ref: 00A00414

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: c5bbdb4bec40a4218ebcc1a4d37f25190e61270d0c50e5b0f626c82cf8faed57
Instruction ID: 08fdc44a2ca07304932244ee0d3c527c9cad26360b94fd8c1559f09449060fa6
Opcode Fuzzy Hash: c5bbdb4bec40a4218ebcc1a4d37f25190e61270d0c50e5b0f626c82cf8faed57
Instruction Fuzzy Hash: 48029170E00209DBCF04DF64D981BAEBBB5EF88310F558469E80ADB395EB35E951CB91

Function 009B1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 009B19FA
GetSysColor.USER32(0000000F), ref: 009B1A4E
SetBkColor.GDI32(?,00000000), ref: 009B1A61

Part of subcall function 009B1290: DefDlgProcW.USER32(?,00000020,?), ref: 009B12D8

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 55767b1299813a94b018409b9b7fe4f83f7e99eb3b4349399e4861b7bf6d3fb8
Instruction ID: cfb6c4e1abe0d4589c97827deb13a882cb68b949b1c72c8e95b60b5b2d2a1dd4
Opcode Fuzzy Hash: 55767b1299813a94b018409b9b7fe4f83f7e99eb3b4349399e4861b7bf6d3fb8
Instruction Fuzzy Hash: 8AA19C701025C4BFE729AB299F78EFF369CDF41775F94091AF106D11A2CB18AD0192B1

Function 00A1BCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A1BCE6
_wcscmp.LIBCMT ref: 00A1BD16
_wcscmp.LIBCMT ref: 00A1BD2B
FindNextFileW.KERNEL32(00000000,?), ref: 00A1BD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00A1BD6C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: def24c479f2c50a5e1246b6044ae065a74f2aa8479a2bcf9d4f522b16edd04ea
Instruction ID: 237afd986f51f7c68965f25331c33c66d7ee5f1a1fa7cfb3adc5b1b0659b2edd
Opcode Fuzzy Hash: def24c479f2c50a5e1246b6044ae065a74f2aa8479a2bcf9d4f522b16edd04ea
Instruction Fuzzy Hash: 76517A35A146029FC718DF68E490EEAB3E4EF89324F10461DF9568B3A1DB30ED44CBA1

Function 00A26747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A27D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A27DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00A2679E
WSAGetLastError.WSOCK32(00000000), ref: 00A267C7
bind.WSOCK32(00000000,?,00000010), ref: 00A26800
WSAGetLastError.WSOCK32(00000000), ref: 00A2680D
closesocket.WSOCK32(00000000,00000000), ref: 00A26821

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 5a66925d1122c493b7505fef2462c0d4e82fdc2284e7cdfcdcf276d61e73eb77
Instruction ID: 51f814bfee2c6596c78171e316748c1b14e6b5d44c2f0ede64e88233f742bf80
Opcode Fuzzy Hash: 5a66925d1122c493b7505fef2462c0d4e82fdc2284e7cdfcdcf276d61e73eb77
Instruction Fuzzy Hash: A141A475A00214AFDB10BF689D86FAE77B8DF89724F04846DFA15AB3D2CA709D018791

Function 00A35376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00A353C5
IsWindowEnabled.USER32 ref: 00A353D3
GetForegroundWindow.USER32(?,?,00000001), ref: 00A353E0
IsIconic.USER32 ref: 00A353EE
IsZoomed.USER32 ref: 00A353FC

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 7414e37c493091b6e76ab9ba82098e03b17e104e7db094a8ed70f2a1d9317b49
Instruction ID: 024a9f03bab999c69d084fe5b1ee5d136be383088e843c9544fc8f4e5cf2d357
Opcode Fuzzy Hash: 7414e37c493091b6e76ab9ba82098e03b17e104e7db094a8ed70f2a1d9317b49
Instruction Fuzzy Hash: 6411E731B109116FEB215F7ADC54B6EBBA9FF857A1F404039F845D7241CBB0DD028AA0

Function 00A080A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A080C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A080CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A080D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A080E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A080F6

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 938321be9cbc094240b37bc9b87aea948833568c3b8afff4a76a08459a4585ac
Instruction ID: d2f8dcd910bf46e8c0fa57e8f69d306f80a8851dda0a4ae35ccbbf71a2234be6
Opcode Fuzzy Hash: 938321be9cbc094240b37bc9b87aea948833568c3b8afff4a76a08459a4585ac
Instruction Fuzzy Hash: 69F06231650208AFEB104FA5FC8DE673BACEF4A755B000135F985C62A0DBA5DC46DE60

Function 009B4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009B4AD0), ref: 009B4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 009B4B57

Strings

GetNativeSystemInfo, xrefs: 009B4B51
kernel32.dll, xrefs: 009B4B40

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: e3c4f5e095eabc66381b05637ff19d926b4ee22661c597fcdea73fbc60e52bd7
Instruction ID: 7fd5341b2b41eb62f8c8ff7a0c21b29db843bb417adb9a0c26739a1591c2f748
Opcode Fuzzy Hash: e3c4f5e095eabc66381b05637ff19d926b4ee22661c597fcdea73fbc60e52bd7
Instruction Fuzzy Hash: C7D0EC74E20723DFDB209F71ED18B46B6D8AF05351B11883AA585D6160D670D480C654

Function 009C3030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 0baa0911fe6a6aaddaae6322c12a82aa4776746c8bac553d3198209d9b64ffb1
Instruction ID: 0efdea35acc8acc02a22ba0f441d4c909013d53b72768961851d1cef0e81b3a9
Opcode Fuzzy Hash: 0baa0911fe6a6aaddaae6322c12a82aa4776746c8bac553d3198209d9b64ffb1
Instruction Fuzzy Hash: C7229C71A083019FC724DF24C981BAEB7E8AFC5714F04891DF99A97291DB75EA04CB93

Function 00A2EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A2EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 00A2EE4B

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Process32NextW.KERNEL32(00000000,?), ref: 00A2EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00A2EF1A

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 290549d7bb6992ffea701bac6d407942d988a05b3c3446cb53c8cb89cd4e626d
Instruction ID: 3e7b29bb81dede1c062de8df8e3c4f910cafa05fe068f172c737433c5ae37237
Opcode Fuzzy Hash: 290549d7bb6992ffea701bac6d407942d988a05b3c3446cb53c8cb89cd4e626d
Instruction Fuzzy Hash: 8B517C71508310AFD310EF24DD85FABB7E8EFD8720F40492DF595962A1EB70A908CB92

Function 009BFCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: e332db0ad15744bb2291eac9327b42c16edcfb0346c824a83cd08f24c2a889f8
Instruction ID: 86ac12193f09c7422607922a387b1d0d14f55f41597ed1fa8e63525a8fe743e6
Opcode Fuzzy Hash: e332db0ad15744bb2291eac9327b42c16edcfb0346c824a83cd08f24c2a889f8
Instruction Fuzzy Hash: 22924670A08341CFD720DF28C580B6BB7E5BB89314F14896DE99A8B362D775EC45CB92

Function 00A0E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00A0E628

Strings

|, xrefs: 00A0E658
(, xrefs: 00A0E66E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: f3c661c12dc8dc1b22e78da622141d883fe9da4a4cccf3c5a5cc66d514c6ff88
Instruction ID: 98560abdf685c0a2deaf0e9d84bbd4232af047e4daaab2d5b7cf12a65efb751e
Opcode Fuzzy Hash: f3c661c12dc8dc1b22e78da622141d883fe9da4a4cccf3c5a5cc66d514c6ff88
Instruction Fuzzy Hash: 96322475A007059FDB28CF59D481A6AB7F1FF48320B15C96EE89ADB3A1E770E941CB40

Function 00A222EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00A2180A,00000000), ref: 00A223E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00A22418

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 9ec6f07db4abbd213518664e489cb77da919335c881c52312f004bebf094de25
Instruction ID: 0e1495cca68f2eeb665ade0f0ab1f4fa25562cb1faab5cc4b3b3488a43af2a89
Opcode Fuzzy Hash: 9ec6f07db4abbd213518664e489cb77da919335c881c52312f004bebf094de25
Instruction Fuzzy Hash: 1A41D671904219BFEB20DF99EC85FBBB7BCEB40314F10407AFA05AA241DA759E419760

Function 00A1B3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A1B40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00A1B465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00A1B4B2

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 9bacd93dc76dd57a4540c32089063751ffa89b025f3d643556f302679ed784db
Instruction ID: 92091241d7ef79494202664c3ec323c866aed6fbbbb85c03d66948bf3068e23a
Opcode Fuzzy Hash: 9bacd93dc76dd57a4540c32089063751ffa89b025f3d643556f302679ed784db
Instruction Fuzzy Hash: 2A213135A10108DFCB00EFA5D984AEDBBB8FF49314F1480A9E905AB351DB319956CB51

Function 00A087E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 009D0DB6: std::exception::exception.LIBCMT ref: 009D0DEC
Part of subcall function 009D0DB6: __CxxThrowException@8.LIBCMT ref: 009D0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A0882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A08858
GetLastError.KERNEL32 ref: 00A08865

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: e34538f41e7261b4702437370117ce134681d80922ea4a4c5b12071917761eb0
Instruction ID: 6fe58c2ff5717dcc3f5cbfbe53218c3e11490735abeab26ee3291584724116a7
Opcode Fuzzy Hash: e34538f41e7261b4702437370117ce134681d80922ea4a4c5b12071917761eb0
Instruction Fuzzy Hash: 50119DB2814308AFE718DFA4EC85E6BB7B9EB44750B20C52EF49587251EA30AC018B60

Function 00A0874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00A08774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A0878B
FreeSid.ADVAPI32(?), ref: 00A0879B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 855f03c7f1dd2e3723d4b0c18e969cf046c71be0d7877ed3bb30b71b2e7f271c
Instruction ID: 36a6870915ddf0c21db89e370fb16ab22e95b4e5a3145b45f22b94850258bd89
Opcode Fuzzy Hash: 855f03c7f1dd2e3723d4b0c18e969cf046c71be0d7877ed3bb30b71b2e7f271c
Instruction Fuzzy Hash: FFF04975E1130CBFDF04DFF4DD89AAEBBBCEF08201F1044A9A905E2181E6756A048B50

Function 00A1C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A1C6FB
FindClose.KERNEL32(00000000), ref: 00A1C72B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 56094f8db2c2980509a0e4774af37457fa8929eb804ad828301a78ae936bacc8
Instruction ID: ee44bf71a84d57eae5a57b497d8e286c1979186d3e21906de34b697e5123e8de
Opcode Fuzzy Hash: 56094f8db2c2980509a0e4774af37457fa8929eb804ad828301a78ae936bacc8
Instruction Fuzzy Hash: 3B115E726106049FDB10EF69D845A6AF7E9EF85334F00851DF9A9972A1DB70A805CB81

Function 00A1A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00A29468,?,00A3FB84,?), ref: 00A1A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00A29468,?,00A3FB84,?), ref: 00A1A0A9

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a4214f9b933bd22429f686f138ee917483e8e7d55dc34adb381dcb196cc0c77c
Instruction ID: a03ed7533166a231ecfb0d8fdf403f57127e57ace5d2a2fd6fd0a394578adeb3
Opcode Fuzzy Hash: a4214f9b933bd22429f686f138ee917483e8e7d55dc34adb381dcb196cc0c77c
Instruction Fuzzy Hash: 72F0EC3550522DABDB21AFE4CC88FEA736CBF08361F008266F808D6181CA309A40CBA1

Function 00A081CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A08309), ref: 00A081E0
CloseHandle.KERNEL32(?,?,00A08309), ref: 00A081F2

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 28b9e6208f797b6c82db7ff5e6d6fb7aa7aadac47d329673fcbbfe7d1d9e0e42
Instruction ID: 4653518de880e789c27f7d593b371be18487081fff159968cc01cc5d237841e8
Opcode Fuzzy Hash: 28b9e6208f797b6c82db7ff5e6d6fb7aa7aadac47d329673fcbbfe7d1d9e0e42
Instruction Fuzzy Hash: 09E0E671011510AFE7256B74FC09E7777E9EF44310B14C92EF8A984470DB615C91DB10

Function 009DA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,009D8D57,?,?,?,00000001), ref: 009DA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 009DA163

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4be9ed23268be40550ed716458d95e169a4f247d8e789fd9da81a00483dd448f
Instruction ID: 3342e2b437df919e0ca42f60253dc325be5519f3aa6af7355a6a53e9b14dbcbb
Opcode Fuzzy Hash: 4be9ed23268be40550ed716458d95e169a4f247d8e789fd9da81a00483dd448f
Instruction Fuzzy Hash: 04B09231464208AFCA006BD1EC09B8A3F68EB45AA2F404020F61D89060CB6254528A91

Function 009DF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037cc085b1ddebac83667bca16ac70253f5d5788bd42e356848a7d80ffa09d6f
Instruction ID: 1f557e23ad647eb8ed42a2cc0fdd39252838b0599e0cb0fc82a679f7e429c300
Opcode Fuzzy Hash: 037cc085b1ddebac83667bca16ac70253f5d5788bd42e356848a7d80ffa09d6f
Instruction Fuzzy Hash: D332E229D69F414DD7239634D83233AA24DEFB73C5F15DB37E81AB5AA6EB29C4834100

Function 009E242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8182948f65930765e9eb60c0d70736424ca3cfcc4061c34392b645f7d608cce
Instruction ID: 3d0fdd975484fcd62b60343d0a0436dc1bec30d88acc757de6f46b4a6def1e36
Opcode Fuzzy Hash: c8182948f65930765e9eb60c0d70736424ca3cfcc4061c34392b645f7d608cce
Instruction Fuzzy Hash: 06B1FF28E6AF414DD3239A798831336BA5CAFFB2C5F51D71BFC2674D22EB2295834141

Function 00A18889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00A1889B

Part of subcall function 009D520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00A18F6E,00000000,?,?,?,?,00A1911F,00000000,?), ref: 009D5213
Part of subcall function 009D520A: __aulldiv.LIBCMT ref: 009D5233

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 00d11c9ffe83bfda81d7884b19ef7a05a477383a794bba145972d6eca873b18f
Instruction ID: ba97f3faa1ab4a8285b3cf97f854a316229a40482851354fa30df48a0f72938a
Opcode Fuzzy Hash: 00d11c9ffe83bfda81d7884b19ef7a05a477383a794bba145972d6eca873b18f
Instruction Fuzzy Hash: 1A21B4326355108BC729CF69D841B92B3E5EFA5311B688E6CD1F9CB2C0CA34B945DB54

Function 00A14C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00A14C4A

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 1be36f479845cdf1fefea48fb1fd124f8b86f03b9e5616dac572518a6f116352
Instruction ID: a094024ee5e93f1267fbd6fcb4eabc6526cf7cc591c4983f45cf164adb9dac46
Opcode Fuzzy Hash: 1be36f479845cdf1fefea48fb1fd124f8b86f03b9e5616dac572518a6f116352
Instruction Fuzzy Hash: FFD05EA116920938FC1C07289E0FFFB0109E308792FD8814971018A0C1EC805CC05070

Function 00A087B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00A08389), ref: 00A087D1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 296af1ffe6995b3728f6196d3cf0b52766568662262870bfc8de3964bf1b1248
Instruction ID: 68520abe057499dd384be755fb59010ee109d5f0036ac16b4547b875929b8cc8
Opcode Fuzzy Hash: 296af1ffe6995b3728f6196d3cf0b52766568662262870bfc8de3964bf1b1248
Instruction Fuzzy Hash: 40D05E3226450EAFEF018EA8DC01EAE3B69EB04B01F408111FE15C50A1C775D835AB60

Function 009DA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 009DA12A

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7a113486c320d47c30a90f379ffbf774a111299e9f866eb0703d3f8d350a796c
Instruction ID: 5a4ffc0e57a5153687b778e7698dd06d5191cc264199b1bd22e6822855d6f4bd
Opcode Fuzzy Hash: 7a113486c320d47c30a90f379ffbf774a111299e9f866eb0703d3f8d350a796c
Instruction Fuzzy Hash: 5AA0123001010CAB8A001B81EC044457F5CD6011907004020F40C45021873254114580

Function 009C8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a1ee13acf2d0b79e1e6ddd0c20c93fabc018be6f971c5f51b6dfb47d418bcb
Instruction ID: 9e7d86b5958532f908cfcfd186ee4fe0351795e148b08ed351a63e3b2c17524c
Opcode Fuzzy Hash: a9a1ee13acf2d0b79e1e6ddd0c20c93fabc018be6f971c5f51b6dfb47d418bcb
Instruction Fuzzy Hash: C1222030E0450ACBDF288B68D494BBFB7B5BF45344F28886ED9428A5D2DB749D91CA43

Function 009D21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 4863d1208c16926c0194425a54b099042843454bd16949b6613e96625b1c7e21
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 31C174332491930ADB2D4739843453EFAA55EB27B131A875FE8B2CB2D4EF24C965D620

Function 009D25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: f420f46914f4a7c44aa3d45463d9bffaf897d2faabe5447617f95d7f807e7d47
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: E4C173332451930ADF2D473AC47413EBAA55EA27B132A876FD4B2DB2D4EF20D925D620

Function 009D1D90 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: d59d0fd00650900daac649e94598bd9c8b9318059ea01b4b5b7d2036496e785f
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: B8C183332491930ADF2D463AC43403EBBA55EA27B131A876FD4B3DB2D4EF20C965D620

Function 009D1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 1e4567dfa3f5025ce71a97d577d040d8b5ce18ca877fccb689923c60a4e46ee7
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 1AC1823338919319DF2D4639C43413EBAA65EA27B131A876FD4B3CB2D4EF24C965D620

Function 00A27806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A2785B
DeleteObject.GDI32(00000000), ref: 00A2786D
DestroyWindow.USER32 ref: 00A2787B
GetDesktopWindow.USER32 ref: 00A27895
GetWindowRect.USER32(00000000), ref: 00A2789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00A279DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00A279ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27A35
GetClientRect.USER32(00000000,?), ref: 00A27A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A27A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27ABB
GlobalLock.KERNEL32(00000000), ref: 00A27AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27AD3
GlobalUnlock.KERNEL32(00000000), ref: 00A27ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27AE3
GlobalFree.KERNEL32(00000000), ref: 00A27AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00A42CAC,00000000), ref: 00A27B16
GlobalFree.KERNEL32(00000000), ref: 00A27B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00A27B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00A27B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A27D7A

Strings

static, xrefs: 00A27A75, 00A27BCC
AutoIt v3, xrefs: 00A27A2D
, xrefs: 00A27D00
DISPLAY, xrefs: 00A27BDD

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 4ae817467f0caa2177ec434867ea56adf197a3d67656d65c2693ab3b1f745ee1
Instruction ID: e033f6b6a3ef072032fe192b88d0332cac1826f646ca7ff89228e9174f3fabc4
Opcode Fuzzy Hash: 4ae817467f0caa2177ec434867ea56adf197a3d67656d65c2693ab3b1f745ee1
Instruction Fuzzy Hash: 45028C71910215EFDB14DFA8DD89EAE7BB9FF48310F008169F915AB2A1C770AD42CB60

Function 00A3356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00A3F910), ref: 00A33627
IsWindowVisible.USER32(?), ref: 00A3364B

Strings

TABLEFT, xrefs: 00A33687
CURRENTTAB, xrefs: 00A336BD
SHOWDROPDOWN, xrefs: 00A336E0
DELSTRING, xrefs: 00A33749
ADDSTRING, xrefs: 00A33716
ISCHECKED, xrefs: 00A33839
GETCURRENTSELECTION, xrefs: 00A337E3
GETCURRENTCOL, xrefs: 00A33928
ISENABLED, xrefs: 00A3366B
SETCURRENTSELECTION, xrefs: 00A337B6
HIDEDROPDOWN, xrefs: 00A33700
EDITPASTE, xrefs: 00A3395F
UNCHECK, xrefs: 00A33883
GETLINE, xrefs: 00A3399B
ISVISIBLE, xrefs: 00A33637
TABRIGHT, xrefs: 00A3369D
SELECTSTRING, xrefs: 00A33806
FINDSTRING, xrefs: 00A33776
CHECK, xrefs: 00A3386D
GETSELECTED, xrefs: 00A338A3
GETCURRENTLINE, xrefs: 00A338ED
GETLINECOUNT, xrefs: 00A338C6
SENDCOMMANDID, xrefs: 00A339DA

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 4237969bd9dcca7eb2330fcc1f66376ca1bbe8839174d11128bf476c947dc731
Instruction ID: 79496ce69b1107f9fba803adc3050627f690b7c6f50b02567ef6091e69b25f75
Opcode Fuzzy Hash: 4237969bd9dcca7eb2330fcc1f66376ca1bbe8839174d11128bf476c947dc731
Instruction Fuzzy Hash: 7DD16E316183019FCF04EF10C956BAEBBA5AFD5394F148459F8865B3A2DB31EE0ACB41

Function 00A3A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00A3A630
GetSysColorBrush.USER32(0000000F), ref: 00A3A661
GetSysColor.USER32(0000000F), ref: 00A3A66D
SetBkColor.GDI32(?,000000FF), ref: 00A3A687
SelectObject.GDI32(?,00000000), ref: 00A3A696
InflateRect.USER32(?,000000FF,000000FF), ref: 00A3A6C1
GetSysColor.USER32(00000010), ref: 00A3A6C9
CreateSolidBrush.GDI32(00000000), ref: 00A3A6D0
FrameRect.USER32(?,?,00000000), ref: 00A3A6DF
DeleteObject.GDI32(00000000), ref: 00A3A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 00A3A731
FillRect.USER32(?,?,00000000), ref: 00A3A763
GetWindowLongW.USER32(?,000000F0), ref: 00A3A78E

Part of subcall function 00A3A8CA: GetSysColor.USER32(00000012), ref: 00A3A903
Part of subcall function 00A3A8CA: SetTextColor.GDI32(?,?), ref: 00A3A907
Part of subcall function 00A3A8CA: GetSysColorBrush.USER32(0000000F), ref: 00A3A91D
Part of subcall function 00A3A8CA: GetSysColor.USER32(0000000F), ref: 00A3A928
Part of subcall function 00A3A8CA: GetSysColor.USER32(00000011), ref: 00A3A945
Part of subcall function 00A3A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A3A953
Part of subcall function 00A3A8CA: SelectObject.GDI32(?,00000000), ref: 00A3A964
Part of subcall function 00A3A8CA: SetBkColor.GDI32(?,00000000), ref: 00A3A96D
Part of subcall function 00A3A8CA: SelectObject.GDI32(?,?), ref: 00A3A97A
Part of subcall function 00A3A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 00A3A999
Part of subcall function 00A3A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A3A9B0
Part of subcall function 00A3A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 00A3A9C5
Part of subcall function 00A3A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A3A9ED

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: d878c8cee31e51999ca75b340d25c6df038daea6f6160ab9c244d3b11e7d11ad
Instruction ID: f72f82bdc1cab8451b09f6ee3b2936e6212296125f77aa535d158b71246f7109
Opcode Fuzzy Hash: d878c8cee31e51999ca75b340d25c6df038daea6f6160ab9c244d3b11e7d11ad
Instruction Fuzzy Hash: DA916D72818311BFC710DFA4EC48A5B7BB9FB89321F104B29F9A2961A0D771D946CB52

Function 009B2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 009B2CA2
DeleteObject.GDI32(00000000), ref: 009B2CE8
DeleteObject.GDI32(00000000), ref: 009B2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 009B2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 009B2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 009EC43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 009EC474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 009EC89D

Part of subcall function 009B1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009B2036,?,00000000,?,?,?,?,009B16CB,00000000,?), ref: 009B1B9A

SendMessageW.USER32(?,00001053), ref: 009EC8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 009EC8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 009EC907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 009EC912

Strings

0, xrefs: 009EC731

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: fdd9d0086decd20c14ed8bbf568c90465bbab4cb5ff5e44513c2592243ee09db
Instruction ID: e1250d8539c5d1b7f8fc08bed8d410fa67bd6b87722560ee45153e1ee2a98d71
Opcode Fuzzy Hash: fdd9d0086decd20c14ed8bbf568c90465bbab4cb5ff5e44513c2592243ee09db
Instruction Fuzzy Hash: 41126A70604241AFDB26CF25C984BA9BBE9FF45310F5445A9F8D9DB262CB31EC42CB91

Function 00A274AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00A274DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A2759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00A275DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00A275ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00A27633
GetClientRect.USER32(00000000,?), ref: 00A2763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00A27683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A27692
GetStockObject.GDI32(00000011), ref: 00A276A2
SelectObject.GDI32(00000000,00000000), ref: 00A276A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00A276B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A276BF
DeleteDC.GDI32(00000000), ref: 00A276C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A276F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 00A2770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00A27746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A2775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 00A2776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00A2779B
GetStockObject.GDI32(00000011), ref: 00A277A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A277B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00A277BB

Strings

static, xrefs: 00A2767D, 00A27795
AutoIt v3, xrefs: 00A2762B
DISPLAY, xrefs: 00A27688
msctls_progress32, xrefs: 00A2773C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: b97a77329d256c20a7c5558ad15979a3fb31f35d65877c60970a08ac7a394d95
Instruction ID: 33723dad560aa9c9744d613ca5eb1f3932dc59e89e3358cec680af7c74081867
Opcode Fuzzy Hash: b97a77329d256c20a7c5558ad15979a3fb31f35d65877c60970a08ac7a394d95
Instruction Fuzzy Hash: 71A18471A50615BFEB14DBA8DD4AFEEBB79EB44710F008114FA15A72E1C7B0AD01CBA0

Function 00A1AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A1AD1E
GetDriveTypeW.KERNEL32(?,00A3FAC0,?,\\.\,00A3F910), ref: 00A1ADFB
SetErrorMode.KERNEL32(00000000,00A3FAC0,?,\\.\,00A3F910), ref: 00A1AF59

Strings

Unknown, xrefs: 00A1AE1B, 00A1AEBF
Fibre, xrefs: 00A1AEE9
SCSI, xrefs: 00A1AEC6
FileBackedVirtual, xrefs: 00A1AF28
Removable, xrefs: 00A1AE4D
SAS, xrefs: 00A1AF05
Fixed, xrefs: 00A1AE43
Virtual, xrefs: 00A1AF21
SATA, xrefs: 00A1AF0C
CDROM, xrefs: 00A1AE2F
SSD, xrefs: 00A1AE86
USB, xrefs: 00A1AEF0
\\.\, xrefs: 00A1AD70
1394, xrefs: 00A1AEDB
iSCSI, xrefs: 00A1AEFE
RAID, xrefs: 00A1AEF7
Network, xrefs: 00A1AE39
RAMDisk, xrefs: 00A1AE25
ATAPI, xrefs: 00A1AECD
ATA, xrefs: 00A1AED4
MMC, xrefs: 00A1AF1A
SSA, xrefs: 00A1AEE2
PhysicalDrive, xrefs: 00A1ADA7

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 483f83e123ffc6617acae34b7ba6293516e72a0f7b4824980f9e728251c5e0c3
Instruction ID: d8863ee9ce73b57cae5a215823da07ed46eefe8029866e2c6468ec112605286d
Opcode Fuzzy Hash: 483f83e123ffc6617acae34b7ba6293516e72a0f7b4824980f9e728251c5e0c3
Instruction Fuzzy Hash: F051A4B064A205AB8B10DB50CA52DFD73B9FB68750B208957F807A72D0CA35DD86DB43

Function 009B68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 009B6931
__wcsnicmp.LIBCMT ref: 009B6949
__wcsnicmp.LIBCMT ref: 009B6961
__wcsnicmp.LIBCMT ref: 009B6979
__wcsnicmp.LIBCMT ref: 009B6991
__wcsnicmp.LIBCMT ref: 009B69A9
__wcsnicmp.LIBCMT ref: 009B69C1
__wcsnicmp.LIBCMT ref: 009B69D5
__wcsnicmp.LIBCMT ref: 009B6A16
__wcsnicmp.LIBCMT ref: 009B6A2A
__wcsnicmp.LIBCMT ref: 009B6A3E
__wcsnicmp.LIBCMT ref: 009B6A52

Strings

#ce, xrefs: 009B6A4C
#comments-end, xrefs: 009B6A38
#cs, xrefs: 009B69CF, 009B6A24
#OnAutoItStartRegister, xrefs: 009B6973
#include, xrefs: 009B69A3
Bad directive syntax error, xrefs: 009EE31A
#pragma compile, xrefs: 009B692B
#include-once, xrefs: 009B698B
#comments-start, xrefs: 009B69BB, 009B6A10
Unterminated group of comments, xrefs: 009EE403
#requireadmin, xrefs: 009B695B
Cannot parse #include, xrefs: 009EE3F0
#notrayicon, xrefs: 009B6943

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 1232a8f9888132b331769fe24c712d4ecce84d02a766b52fbb87f0f733181c2c
Instruction ID: 949806d38b8c233dba4da18ae1e6c2b866ab776f4e18d8aebbd89229274b4bd4
Opcode Fuzzy Hash: 1232a8f9888132b331769fe24c712d4ecce84d02a766b52fbb87f0f733181c2c
Instruction Fuzzy Hash: 978126B0640205BACF21AF71DD42FFA776CBF85720F048425F905AA2D2EB68EE15D261

Function 00A3A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00A3A903
SetTextColor.GDI32(?,?), ref: 00A3A907
GetSysColorBrush.USER32(0000000F), ref: 00A3A91D
GetSysColor.USER32(0000000F), ref: 00A3A928
CreateSolidBrush.GDI32(?), ref: 00A3A92D
GetSysColor.USER32(00000011), ref: 00A3A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A3A953
SelectObject.GDI32(?,00000000), ref: 00A3A964
SetBkColor.GDI32(?,00000000), ref: 00A3A96D
SelectObject.GDI32(?,?), ref: 00A3A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 00A3A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A3A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00A3A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A3A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00A3AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 00A3AA32
DrawFocusRect.USER32(?,?), ref: 00A3AA3D
GetSysColor.USER32(00000011), ref: 00A3AA4B
SetTextColor.GDI32(?,00000000), ref: 00A3AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00A3AA67
SelectObject.GDI32(?,00A3A5FA), ref: 00A3AA7E
DeleteObject.GDI32(?), ref: 00A3AA89
SelectObject.GDI32(?,?), ref: 00A3AA8F
DeleteObject.GDI32(?), ref: 00A3AA94
SetTextColor.GDI32(?,?), ref: 00A3AA9A
SetBkColor.GDI32(?,?), ref: 00A3AAA4

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 0c4ac92e55808a5f8e62298990b75db36bb0290e47db70efec7175e59b724120
Instruction ID: 4023371beeb8c239b0ce327f4097e03d30194b6ea0d64616a8b4df38e2529d4f
Opcode Fuzzy Hash: 0c4ac92e55808a5f8e62298990b75db36bb0290e47db70efec7175e59b724120
Instruction Fuzzy Hash: 2D513B71D10218FFDB10DFA4EC49EAEBBB9EB48320F114225FA11AB2A1D7719941DB90

Function 00A389D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A38AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A38AD2
CharNextW.USER32(0000014E), ref: 00A38B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A38B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A38B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A38B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00A38B86
SetWindowTextW.USER32(?,0000014E), ref: 00A38BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00A38BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A38C1F
_memset.LIBCMT ref: 00A38C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00A38C8D
_memset.LIBCMT ref: 00A38CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00A38D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00A38D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00A38E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00A38E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A38E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A38EB4
DrawMenuBar.USER32(?), ref: 00A38EC3
SetWindowTextW.USER32(?,0000014E), ref: 00A38EEB

Strings

0, xrefs: 00A38E55

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 14e859962fb0cb2ba3efecbcee54a53cd15471bfc842bc5b77a97432dfae19cc
Instruction ID: c0ba17c6476b086bb8b175ce4493eafdd80bacd5e781bf949e3e9ab9e74e8725
Opcode Fuzzy Hash: 14e859962fb0cb2ba3efecbcee54a53cd15471bfc842bc5b77a97432dfae19cc
Instruction Fuzzy Hash: 0BE160B1900319AFDF21DFA0CC85EEEBB79EF05750F108156F915AA290DB788A85DF60

Function 00A3488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A349CA
GetDesktopWindow.USER32 ref: 00A349DF
GetWindowRect.USER32(00000000), ref: 00A349E6
GetWindowLongW.USER32(?,000000F0), ref: 00A34A48
DestroyWindow.USER32(?), ref: 00A34A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A34A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A34ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00A34AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00A34AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00A34B09
IsWindowVisible.USER32(?), ref: 00A34B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00A34B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00A34B58
GetWindowRect.USER32(?,?), ref: 00A34B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00A34B96
GetMonitorInfoW.USER32(00000000,?), ref: 00A34BB0
CopyRect.USER32(?,?), ref: 00A34BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00A34C32

Strings

0, xrefs: 00A34975
tooltips_class32, xrefs: 00A34A96
(, xrefs: 00A34BA3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: b1db13f23cf2336b0aebda331451d71ae952268b47f8fd81d0c43998bbeeaea7
Instruction ID: 3243ad4b3de0944f33a1c28c9e37ba7f2695df880a0987b396cc1846f8b4298f
Opcode Fuzzy Hash: b1db13f23cf2336b0aebda331451d71ae952268b47f8fd81d0c43998bbeeaea7
Instruction Fuzzy Hash: 3CB18A71A18340AFDB04DF64C945B6ABBE4FF88350F008A1DF9999B2A1D771EC05CB95

Function 009B27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009B28BC
GetSystemMetrics.USER32(00000007), ref: 009B28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009B28EF
GetSystemMetrics.USER32(00000008), ref: 009B28F7
GetSystemMetrics.USER32(00000004), ref: 009B291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009B2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009B2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009B297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009B2990
GetClientRect.USER32(00000000,000000FF), ref: 009B29AE
GetStockObject.GDI32(00000011), ref: 009B29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 009B29D5

Part of subcall function 009B2344: GetCursorPos.USER32(?), ref: 009B2357
Part of subcall function 009B2344: ScreenToClient.USER32(00A757B0,?), ref: 009B2374
Part of subcall function 009B2344: GetAsyncKeyState.USER32(00000001), ref: 009B2399
Part of subcall function 009B2344: GetAsyncKeyState.USER32(00000002), ref: 009B23A7

SetTimer.USER32(00000000,00000000,00000028,009B1256), ref: 009B29FC

Strings

AutoIt v3 GUI, xrefs: 009B2974

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: f02b747fdbd3f57575d45b1b4f603c322441faa88f5837b0cbf82bfbc8734a22
Instruction ID: 0746e1f57e67c9e0e38cc5bb5e1c1063cba1b931f940289fb3117c6814ead1ee
Opcode Fuzzy Hash: f02b747fdbd3f57575d45b1b4f603c322441faa88f5837b0cbf82bfbc8734a22
Instruction Fuzzy Hash: 56B16071A0024AEFDB15DFA8DD45BED7BB4FB48321F108129FA19E72A0DB749842CB51

Function 00A33DE2 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A33E6F
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00A33F2F

Strings

GETSUBITEMCOUNT, xrefs: 00A33EBA
DESELECT, xrefs: 00A3401D
VIEWCHANGE, xrefs: 00A340EE
ISSELECTED, xrefs: 00A33F3A
GETITEMCOUNT, xrefs: 00A33EA1
GETTEXT, xrefs: 00A33ED8
FINDITEM, xrefs: 00A340A2
SELECTCLEAR, xrefs: 00A33FAE
SELECTINVERT, xrefs: 00A33FFF
SELECTALL, xrefs: 00A33F96
SELECT, xrefs: 00A33FC9
GETSELECTED, xrefs: 00A3405D
GETSELECTEDCOUNT, xrefs: 00A33F12

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 3abf1305af821bfa3dc22aa3c1123c8acdd6f8cce47c7cc1587d9794a92cc7a9
Instruction ID: 8e2556682f26b797e4ab5475b0a6db5c6b695c29ff23d5de3c61e417d55b1392
Opcode Fuzzy Hash: 3abf1305af821bfa3dc22aa3c1123c8acdd6f8cce47c7cc1587d9794a92cc7a9
Instruction Fuzzy Hash: 12A16C312183019FCB14EF20C956BAAB7B5AF85324F14896DF9A69B3D2DB30ED05CB41

Function 00A0A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A0A47A
__swprintf.LIBCMT ref: 00A0A51B
_wcscmp.LIBCMT ref: 00A0A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00A0A583
_wcscmp.LIBCMT ref: 00A0A5BF
GetClassNameW.USER32(?,?,00000400), ref: 00A0A5F6
GetDlgCtrlID.USER32(?), ref: 00A0A648
GetWindowRect.USER32(?,?), ref: 00A0A67E
GetParent.USER32(?), ref: 00A0A69C
ScreenToClient.USER32(00000000), ref: 00A0A6A3
GetClassNameW.USER32(?,?,00000100), ref: 00A0A71D
_wcscmp.LIBCMT ref: 00A0A731
GetWindowTextW.USER32(?,?,00000400), ref: 00A0A757
_wcscmp.LIBCMT ref: 00A0A76B

Part of subcall function 009D362C: _iswctype.LIBCMT ref: 009D3634

Strings

%s%u, xrefs: 00A0A515

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 37d7be275e52191db782759e4239a4e1355f9c41bbd7d656b66f35aa1056958f
Instruction ID: d9ee5c1965a4a04cfde341cea5c0d5d8f5f5df5059ff6c56990d5a3c0d28e6aa
Opcode Fuzzy Hash: 37d7be275e52191db782759e4239a4e1355f9c41bbd7d656b66f35aa1056958f
Instruction Fuzzy Hash: DFA1E13120470AAFD715DF60D884FAAB7F8FFA4354F008629F999D2190DB30E946CB92

Function 00A0AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00A0AF18
_wcscmp.LIBCMT ref: 00A0AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 00A0AF51
CharUpperBuffW.USER32(?,00000000), ref: 00A0AF6E
_wcscmp.LIBCMT ref: 00A0AF8C
_wcsstr.LIBCMT ref: 00A0AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00A0AFD5
_wcscmp.LIBCMT ref: 00A0AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 00A0B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 00A0B055
_wcscmp.LIBCMT ref: 00A0B065
GetClassNameW.USER32(00000010,?,00000400), ref: 00A0B08D
GetWindowRect.USER32(00000004,?), ref: 00A0B0F6

Strings

@, xrefs: 00A0AEF9
ThumbnailClass, xrefs: 00A0AFE0, 00A0B060

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 8b40195b76f9f229c3532ec485a1bf7e3fdfb02bfc8464fa632b55436d4a523e
Instruction ID: e497beef3a91661b48f84052e6ee923f90d4d21e25d6952e1827ce5c684484a3
Opcode Fuzzy Hash: 8b40195b76f9f229c3532ec485a1bf7e3fdfb02bfc8464fa632b55436d4a523e
Instruction Fuzzy Hash: 7381C17111830A9FDB04DF10EA81FAA7BE8EF94314F04856AFD859A0D1DB30DD45CBA2

Function 00A0ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00A0AC33

Strings

[ALL, xrefs: 00A0ACD9
LAST, xrefs: 00A0ABF8
[HANDLE:, xrefs: 00A0AC3F
REGEXP=, xrefs: 00A0AC48
[CLASS:, xrefs: 00A0AC83
[LAST, xrefs: 00A0ACE0
CLASSNAME=, xrefs: 00A0AC70
[REGEXPTITLE:, xrefs: 00A0AC5B
ACTIVE, xrefs: 00A0AC0E
ALL, xrefs: 00A0ACC7
[ACTIVE, xrefs: 00A0AC20
HANDLE=, xrefs: 00A0AC2C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 42e7ec779c7c229ba41381bb6490cc385494b6b1c03c659728a201a6fe69962e
Instruction ID: 0f03bf37b7070b682af0c9a348e3eb0e29e6632a63fec580bb108968cb76eb3d
Opcode Fuzzy Hash: 42e7ec779c7c229ba41381bb6490cc385494b6b1c03c659728a201a6fe69962e
Instruction Fuzzy Hash: 51318F31A58309ABEA14FBE0EE13FEEB774AB707A4F600919F402711D1EA516F048652

Function 00A24FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00A25013
LoadCursorW.USER32(00000000,00007F00), ref: 00A2501E
LoadCursorW.USER32(00000000,00007F03), ref: 00A25029
LoadCursorW.USER32(00000000,00007F8B), ref: 00A25034
LoadCursorW.USER32(00000000,00007F01), ref: 00A2503F
LoadCursorW.USER32(00000000,00007F81), ref: 00A2504A
LoadCursorW.USER32(00000000,00007F88), ref: 00A25055
LoadCursorW.USER32(00000000,00007F80), ref: 00A25060
LoadCursorW.USER32(00000000,00007F86), ref: 00A2506B
LoadCursorW.USER32(00000000,00007F83), ref: 00A25076
LoadCursorW.USER32(00000000,00007F85), ref: 00A25081
LoadCursorW.USER32(00000000,00007F82), ref: 00A2508C
LoadCursorW.USER32(00000000,00007F84), ref: 00A25097
LoadCursorW.USER32(00000000,00007F04), ref: 00A250A2
LoadCursorW.USER32(00000000,00007F02), ref: 00A250AD
LoadCursorW.USER32(00000000,00007F89), ref: 00A250B8
GetCursorInfo.USER32(?), ref: 00A250C8

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 0b2e76834374e770c90cdec4cc6e6bf24a78d0d6ad90d4017e5c96c85e4a37c3
Instruction ID: a247d47dfba7ce0b2203d10a556b5c50bda7d2320c18be764356e9d1e072a33e
Opcode Fuzzy Hash: 0b2e76834374e770c90cdec4cc6e6bf24a78d0d6ad90d4017e5c96c85e4a37c3
Instruction Fuzzy Hash: 4B31D4B1D483196ADF109FBA9C8999EBFF8FF04750F50453AE50DE7280DA7865018F91

Function 00A3A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A3A259
DestroyWindow.USER32(?,?), ref: 00A3A2D3

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A3A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A3A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A3A382
DestroyWindow.USER32(00000000), ref: 00A3A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,009B0000,00000000), ref: 00A3A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A3A3F4
GetDesktopWindow.USER32 ref: 00A3A40D
GetWindowRect.USER32(00000000), ref: 00A3A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A3A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A3A444

Part of subcall function 009B25DB: GetWindowLongW.USER32(?,000000EB), ref: 009B25EC

Strings

tooltips_class32, xrefs: 00A3A346, 00A3A3D4
0, xrefs: 00A3A26F

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: b274a374250e066a6b8684d68bbfd07a54281efdc1b320431c5f85d0d539618e
Instruction ID: 492514f00f5255855a2ac1f7f55b68319747f0ab9b489f4bd6746acc0f5c97ea
Opcode Fuzzy Hash: b274a374250e066a6b8684d68bbfd07a54281efdc1b320431c5f85d0d539618e
Instruction Fuzzy Hash: B371BF70540245AFD725CF68CC4AFAA7BF5FB98300F04452DF9868B2A0D7B1E942DB52

Function 00A3C5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

DragQueryPoint.SHELL32(?,?), ref: 00A3C627

Part of subcall function 00A3AB37: ClientToScreen.USER32(?,?), ref: 00A3AB60
Part of subcall function 00A3AB37: GetWindowRect.USER32(?,?), ref: 00A3ABD6
Part of subcall function 00A3AB37: PtInRect.USER32(?,?,00A3C014), ref: 00A3ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 00A3C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A3C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A3C6BE
_wcscat.LIBCMT ref: 00A3C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A3C705
SendMessageW.USER32(?,000000B0,?,?), ref: 00A3C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 00A3C735
SendMessageW.USER32(?,000000B1,?,?), ref: 00A3C757
DragFinish.SHELL32(?), ref: 00A3C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00A3C851

Strings

@GUI_DRAGID, xrefs: 00A3C7C9
@GUI_DROPID, xrefs: 00A3C77E
@GUI_DRAGFILE, xrefs: 00A3C800

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: bbc8f457bef6c8cd8fca4c52ea0c59a84a34869e38e9ed5271ae3fe584557043
Instruction ID: b8bf00b63c5a51a8ac990c0e8b8ef814eadf16f56a9075f1f9a4a486d28d5329
Opcode Fuzzy Hash: bbc8f457bef6c8cd8fca4c52ea0c59a84a34869e38e9ed5271ae3fe584557043
Instruction Fuzzy Hash: 07614971508300AFC701EFA4DD85EABBBF8EFC9760F00492EF595921A1DB709A49CB52

Function 00A34392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A34424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A3446F

Strings

UNCHECK, xrefs: 00A3464B
GETTOTALCOUNT, xrefs: 00A34456
COLLAPSE, xrefs: 00A344B5
GETITEMCOUNT, xrefs: 00A34551
ISCHECKED, xrefs: 00A345F2
CHECK, xrefs: 00A3448F
EXISTS, xrefs: 00A344D8
GETTEXT, xrefs: 00A345C2
SELECT, xrefs: 00A34620
GETSELECTED, xrefs: 00A3457F
EXPAND, xrefs: 00A34521

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 5bc423b51a3e513d831803ce5c88be325ec9234a473ba1651dee41e028724dbe
Instruction ID: caddcbfe4fc3df4f2193bd79c3f34d540545817a4b041f900267ed592c77cb57
Opcode Fuzzy Hash: 5bc423b51a3e513d831803ce5c88be325ec9234a473ba1651dee41e028724dbe
Instruction Fuzzy Hash: E9913B716147019FCB04EF10C552BAEB7E5AF99364F058869F8965B3A2CB31ED0ACB81

Function 00A3B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00A3B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00A36B11,?), ref: 00A3B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A3B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00A3B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A3B9C3
FreeLibrary.KERNEL32(?), ref: 00A3B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A3B9DF
DestroyIcon.USER32(?), ref: 00A3B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00A3BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00A3BA17

Part of subcall function 009D2EFD: __wcsicmp_l.LIBCMT ref: 009D2F86

Strings

.exe, xrefs: 00A3B84A
.icl, xrefs: 00A3B82A
.dll, xrefs: 00A3B86D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: b444800af9d3aa6a6321ec95ce41a81d8ad03a7222a895f6a2e6473aff938a64
Instruction ID: f0cab74fe4e57da839a4467fa3c8d733bafb35c0d725edbad9946490e72ad067
Opcode Fuzzy Hash: b444800af9d3aa6a6321ec95ce41a81d8ad03a7222a895f6a2e6473aff938a64
Instruction Fuzzy Hash: EE61CC71960219BEEB14DFA4CC42FBA7BACEB08720F10851AFA15D61D0DB749981DBA0

Function 00A1DC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A1DCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A1DCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A1DCF8
__wsplitpath.LIBCMT ref: 00A1DD56
_wcscat.LIBCMT ref: 00A1DD6E
_wcscat.LIBCMT ref: 00A1DD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A1DD95
SetCurrentDirectoryW.KERNEL32(?), ref: 00A1DDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 00A1DDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 00A1DDFC
_wcscpy.LIBCMT ref: 00A1DE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A1DE47

Strings

*.*, xrefs: 00A1DE02

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 4e6310b958e65751e7707c89fc5bfcbc9ee2c76c01999a8d9b4f92d58c06db04
Instruction ID: 2323ed041f77bea70bd5797a68f4f9000c13b3be06624a0b159f70079cb9e997
Opcode Fuzzy Hash: 4e6310b958e65751e7707c89fc5bfcbc9ee2c76c01999a8d9b4f92d58c06db04
Instruction Fuzzy Hash: 86616B725042459FCB10EF64C984AEEB3E9FF89324F04492EF98997251EB31E945CB92

Function 00A19C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00A19C7F

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00A19CA0
__swprintf.LIBCMT ref: 00A19CF9
__swprintf.LIBCMT ref: 00A19D12
_wprintf.LIBCMT ref: 00A19DB9
_wprintf.LIBCMT ref: 00A19DD7

Strings

^ ERROR , xrefs: 00A19D4E
Incorrect parameters to object property !, xrefs: 00A19D5B
Line %d (File "%s"):, xrefs: 00A19CF3, 00A19D0C
Error: , xrefs: 00A19D81
"%s" (%d) : ==> %s:%s%s, xrefs: 00A19DB4
"%s" (%d) : ==> %s:, xrefs: 00A19DD2

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 2341cf0f4d1d1d835493a48c5a1f114e44ee21d1df88f022607fa2e2ca1cc99f
Instruction ID: fc005fb7cc4c17c26a0b7a6ea338bc320871508dffe68ac76fbc160ed1444823
Opcode Fuzzy Hash: 2341cf0f4d1d1d835493a48c5a1f114e44ee21d1df88f022607fa2e2ca1cc99f
Instruction Fuzzy Hash: 77518D31900609BBCF14EBE0DE46FEEBB78AF84310F504565B509721A2EB356F99CB61

Function 00A1A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

CharLowerBuffW.USER32(?,?), ref: 00A1A3CB
GetDriveTypeW.KERNEL32 ref: 00A1A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A1A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A1A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A1A4C5

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

Strings

set cd door , xrefs: 00A1A466
closed, xrefs: 00A1A3DF, 00A1A3E8
wait, xrefs: 00A1A482
open, xrefs: 00A1A3F2
close, xrefs: 00A1A3D1
type cdaudio alias cd wait, xrefs: 00A1A443
open , xrefs: 00A1A427
close cd wait, xrefs: 00A1A4B0

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 1d3a7bf81d9194d01f71b25662ac4de85e260c1f8d2d8eb454dcef8fee107a7d
Instruction ID: 3973b8a82efea118eff5ebf9bdce2b80ccc41b85d19b0676f4f009305cb5ebc4
Opcode Fuzzy Hash: 1d3a7bf81d9194d01f71b25662ac4de85e260c1f8d2d8eb454dcef8fee107a7d
Instruction Fuzzy Hash: 9B514C711142059FC700EF60C991AAAB7F8FFD4768F00896DF895572A1DB31AD0ACB52

Function 00A0F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,009EE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00A0F8DF
LoadStringW.USER32(00000000,?,009EE029,00000001), ref: 00A0F8E8

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

GetModuleHandleW.KERNEL32(00000000,00A75310,?,00000FFF,?,?,009EE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00A0F90A
LoadStringW.USER32(00000000,?,009EE029,00000001), ref: 00A0F90D
__swprintf.LIBCMT ref: 00A0F95D
__swprintf.LIBCMT ref: 00A0F96E
_wprintf.LIBCMT ref: 00A0FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A0FA2E

Strings

Line %d:, xrefs: 00A0F968
Line %d (File "%s"):, xrefs: 00A0F957
Error: , xrefs: 00A0F9E5
%s (%d) : ==> %s: %s %s, xrefs: 00A0FA12
^ ERROR, xrefs: 00A0F9C3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 15ce1aaac1430cd890342ec4bda111565199272b10c2bfbcc3f6a19507285588
Instruction ID: 490dd52943dafc4746b20fbdfdd23d2d5b39af690afb1ba0a38105a11b6b3e04
Opcode Fuzzy Hash: 15ce1aaac1430cd890342ec4bda111565199272b10c2bfbcc3f6a19507285588
Instruction Fuzzy Hash: BA417C7290020DABCF14FBE0DE86FEEB778AF98750F500165B505B2092EA356F09CB61

Function 009EA8CB Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 009EA92B
___wtomb_environ.LIBCMT ref: 009EA94D

Part of subcall function 009D8B28: __getptd_noexit.LIBCMT ref: 009D8B28

__malloc_crt.LIBCMT ref: 009EA975
__malloc_crt.LIBCMT ref: 009EA992
_free.LIBCMT ref: 009EA9C9
__recalloc_crt.LIBCMT ref: 009EAA02
__recalloc_crt.LIBCMT ref: 009EAA47
_strlen.LIBCMT ref: 009EAA73
__calloc_crt.LIBCMT ref: 009EAA7D
_strlen.LIBCMT ref: 009EAA8C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 009EAABA
_free.LIBCMT ref: 009EAAD4
_free.LIBCMT ref: 009EAAE1
_free.LIBCMT ref: 009EAAF3
__invoke_watson.LIBCMT ref: 009EAB0D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 3744f9d5cf7029ff9c7824e3286e9f417a5d83f734da0d2a71a956cb1c449d3c
Instruction ID: bee93a68c4a63395fa293866af5e10b442a05c8d00c2f68e38ec9f17f82c4c3c
Opcode Fuzzy Hash: 3744f9d5cf7029ff9c7824e3286e9f417a5d83f734da0d2a71a956cb1c449d3c
Instruction Fuzzy Hash: ED613B72900341AFDB129F66DD0176E77A9EF91361F218226E805A72E2DB34ED41C763

Function 00A3BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00A3BA56
GetFileSize.KERNEL32(00000000,00000000), ref: 00A3BA6D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00A3BA78
CloseHandle.KERNEL32(00000000), ref: 00A3BA85
GlobalLock.KERNEL32(00000000), ref: 00A3BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00A3BA9D
GlobalUnlock.KERNEL32(00000000), ref: 00A3BAA6
CloseHandle.KERNEL32(00000000), ref: 00A3BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00A3BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00A42CAC,?), ref: 00A3BAD7
GlobalFree.KERNEL32(00000000), ref: 00A3BAE7
GetObjectW.GDI32(?,00000018,000000FF), ref: 00A3BB0B
CopyImage.USER32(?,00000000,?,?,00002000), ref: 00A3BB36
DeleteObject.GDI32(00000000), ref: 00A3BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00A3BB74

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 9bf55e9f2a44a6cd7dbe3057da42ccb5f5e567d88e06f4c5b0f8b6047d3a1fd0
Instruction ID: b7b5646ff99d03eb3cad37003496b0cb4a14c5ec7654fd08bde00bad0407e079
Opcode Fuzzy Hash: 9bf55e9f2a44a6cd7dbe3057da42ccb5f5e567d88e06f4c5b0f8b6047d3a1fd0
Instruction Fuzzy Hash: 38411975A10204EFDB11DFA5DC88EABBBB9EB89711F104069FA05D7260D7309A02DB60

Function 00A1D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00A1DA10
_wcscat.LIBCMT ref: 00A1DA28
_wcscat.LIBCMT ref: 00A1DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A1DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 00A1DA63
GetFileAttributesW.KERNEL32(?), ref: 00A1DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00A1DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 00A1DAA7

Strings

*.*, xrefs: 00A1DAE6

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 635de36762ccedb44c4523076328d66b39240e4d52694740ef98fef3b2e8e56f
Instruction ID: 6576e6638464001fe65a3867b0c396e34d1f78838de78fbda4e52170b8a554ae
Opcode Fuzzy Hash: 635de36762ccedb44c4523076328d66b39240e4d52694740ef98fef3b2e8e56f
Instruction Fuzzy Hash: D181A1715083459FCB24DF64C844AEEB7E9BF89350F18882EF889DB251E630ED85CB52

Function 00A3C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A3C1FC
GetFocus.USER32 ref: 00A3C20C
GetDlgCtrlID.USER32(00000000), ref: 00A3C217
_memset.LIBCMT ref: 00A3C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00A3C36D
GetMenuItemCount.USER32(?), ref: 00A3C38D
GetMenuItemID.USER32(?,00000000), ref: 00A3C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00A3C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00A3C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A3C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00A3C489

Strings

0, xrefs: 00A3C33A

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 720dac45e45b75a3ffd1c212a680b452fc9ef7ccf3a959a149a8381e43c7aa3f
Instruction ID: 596c1caeba6b66bdd452f5d64f1b775b81a2500705c19326a37ec202d2ec264e
Opcode Fuzzy Hash: 720dac45e45b75a3ffd1c212a680b452fc9ef7ccf3a959a149a8381e43c7aa3f
Instruction Fuzzy Hash: F28190706083019FD710DF64CC94ABBBBE4FB88724F00892EF995A7291D770D905CB62

Function 00A2731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A2738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00A2739B
CreateCompatibleDC.GDI32(?), ref: 00A273A7
SelectObject.GDI32(00000000,?), ref: 00A273B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00A27408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00A27444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00A27468
SelectObject.GDI32(00000006,?), ref: 00A27470
DeleteObject.GDI32(?), ref: 00A27479
DeleteDC.GDI32(00000006), ref: 00A27480
ReleaseDC.USER32(00000000,?), ref: 00A2748B

Strings

(, xrefs: 00A27410

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 0f8d57e1e56eb705f07b5304b097a822e5c63ae9881a9b6179901644b662d82e
Instruction ID: 469ca29c762d5d924a3a75b122eac7afa0b37eae23cc421d2e878f33c603aead
Opcode Fuzzy Hash: 0f8d57e1e56eb705f07b5304b097a822e5c63ae9881a9b6179901644b662d82e
Instruction Fuzzy Hash: FE516A71904319EFCB14CFA8DC85EAEBBB9EF49310F14842EF95A9B210D731A941CB60

Function 009B6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 009D0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,009B6B0C,?,00008000), ref: 009D0973

Part of subcall function 009B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009B4743,?,?,009B37AE,?), ref: 009B4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 009B6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 009B6CFA

Part of subcall function 009B586D: _wcscpy.LIBCMT ref: 009B58A5

Part of subcall function 009D363D: _iswctype.LIBCMT ref: 009D3645

Strings

Unterminated string, xrefs: 009EE7E4
Error opening the file, xrefs: 009EE43D, 009EE4B8
EA06, xrefs: 009EE452
#include depth exceeded. Make sure there are no recursive includes, xrefs: 009EE421
Bad directive syntax error, xrefs: 009EE79D
>>>AUTOIT SCRIPT<<<, xrefs: 009EE496
AU3!, xrefs: 009B6B61

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 0f67b278523bea950b86590a1ecba96b32ac74511463a88a47be9fb7ff9614e0
Instruction ID: 5c4721ec82e4ab6f52b083b9e5b4f672a990fe308d2475c1b969839b9ab8bece
Opcode Fuzzy Hash: 0f67b278523bea950b86590a1ecba96b32ac74511463a88a47be9fb7ff9614e0
Instruction Fuzzy Hash: 2602AC301083419FC725EF20CA81AAFBBE5BFD9324F14491EF499972A1DB35E949CB52

Function 00A12D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A12D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00A12DDD
GetMenuItemCount.USER32(00A75890), ref: 00A12E66
DeleteMenu.USER32(00A75890,00000005,00000000,000000F5,?,?), ref: 00A12EF6
DeleteMenu.USER32(00A75890,00000004,00000000), ref: 00A12EFE
DeleteMenu.USER32(00A75890,00000006,00000000), ref: 00A12F06
DeleteMenu.USER32(00A75890,00000003,00000000), ref: 00A12F0E
GetMenuItemCount.USER32(00A75890), ref: 00A12F16
SetMenuItemInfoW.USER32(00A75890,00000004,00000000,00000030), ref: 00A12F4C
GetCursorPos.USER32(?), ref: 00A12F56
SetForegroundWindow.USER32(00000000), ref: 00A12F5F
TrackPopupMenuEx.USER32(00A75890,00000000,?,00000000,00000000,00000000), ref: 00A12F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A12F7E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 7f70c9b79de0ed9ec37402c95c77b9085c72d9da79f71b3e8617852e7e0be87c
Instruction ID: 962f65fadae03f7b47658ca5f24d58be992e94b4d524eb4c2b1644c77c262ca0
Opcode Fuzzy Hash: 7f70c9b79de0ed9ec37402c95c77b9085c72d9da79f71b3e8617852e7e0be87c
Instruction Fuzzy Hash: 1971C170640205BFEB218F54DC85FEABF68FB04764F144226F615AA1E1C7B1ACB0DB94

Function 00A077DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

_memset.LIBCMT ref: 00A0786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00A078A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00A078BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00A078D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00A07902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00A0792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A07935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A0793A

Strings

\CLSID, xrefs: 00A07822
\IPC$, xrefs: 00A07882
SOFTWARE\Classes\, xrefs: 00A0780C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: e12015728d974325d546c8c34e12a1c79e3857647cc7768ff5f30e982494bcf3
Instruction ID: fe84749f84164e7bfc1148a70ebc5be04b58b66403507ca40f9461976475ab55
Opcode Fuzzy Hash: e12015728d974325d546c8c34e12a1c79e3857647cc7768ff5f30e982494bcf3
Instruction Fuzzy Hash: E341F772C1422DABCF15EBA4ED85EEEB778BF44750F444529F905A22A1EA309D05CB90

Function 00A30E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A2FDAD,?,?), ref: 00A30E31

Strings

HKCU, xrefs: 00A30F21
HKEY_CURRENT_CONFIG, xrefs: 00A30EEE
HKEY_USERS, xrefs: 00A30F32
HKCR, xrefs: 00A30ED9
HKEY_CURRENT_USER, xrefs: 00A30F10
HKLM, xrefs: 00A30EAF
HKU, xrefs: 00A30F43
HKEY_LOCAL_MACHINE, xrefs: 00A30E9A
HKCC, xrefs: 00A30EFF
HKEY_CLASSES_ROOT, xrefs: 00A30EC4

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 621632918f0d7d3b0f8e278c18892c560ca442e9a16562679313785fc373b49d
Instruction ID: 2642eb02ebabe40f3e3f578d5251030b3388b127f63c75f34f20f6e9056167a7
Opcode Fuzzy Hash: 621632918f0d7d3b0f8e278c18892c560ca442e9a16562679313785fc373b49d
Instruction Fuzzy Hash: 6B417B3224024A8BCF10EF50D9A9BEF3B74BF91354F544415FC561B292DB309D1ACBA0

Function 00A0F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,009EE2A0,00000010,?,Bad directive syntax error,00A3F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00A0F7C2
LoadStringW.USER32(00000000,?,009EE2A0,00000010), ref: 00A0F7C9

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

_wprintf.LIBCMT ref: 00A0F7FC
__swprintf.LIBCMT ref: 00A0F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00A0F88D

Strings

Line %d:, xrefs: 00A0F818
Line %d (File "%s"):, xrefs: 00A0F833
Error: , xrefs: 00A0F85B
%s (%d) : ==> %s.: %s %s, xrefs: 00A0F7F7
., xrefs: 00A0F873

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 50366dc34af4c362d05a133ada3436780b1955a7b651f75384965cd35bdd7e64
Instruction ID: 05a5b8faa2709dc0bf7a6c9dee5a9a365e318bd69140c639792bc2ddd6ddc210
Opcode Fuzzy Hash: 50366dc34af4c362d05a133ada3436780b1955a7b651f75384965cd35bdd7e64
Instruction Fuzzy Hash: 07218F3194021EBFCF11EFA0CC1AFED7738BF54310F044966F515661A2DA319A18CB51

Function 00A152C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

Part of subcall function 009B7924: _memmove.LIBCMT ref: 009B79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A15330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A15346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A15357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A15369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A1537A

Strings

play PlayMe, xrefs: 00A15375
play PlayMe wait, xrefs: 00A15364
alias PlayMe, xrefs: 00A15309
close PlayMe, xrefs: 00A15341, 00A1536E
status PlayMe mode, xrefs: 00A1532B
open , xrefs: 00A152DF

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: b5fca425b0853953ba0a8443ee3655b63ae070b9b822bfc725116e63587a5d4a
Instruction ID: 8baf6a214510ff758ce78b322a34f9b277cc4521513d89c0d98717f36b5e0933
Opcode Fuzzy Hash: b5fca425b0853953ba0a8443ee3655b63ae070b9b822bfc725116e63587a5d4a
Instruction Fuzzy Hash: 15118F31E50169BAD724B7B1CC5AEFFBBBCFBD1B50F400A29B411A60D1EEA00D45C5A0

Function 00A146B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A146D2
gethostname.WSOCK32(?,00000100), ref: 00A146EC
gethostbyname.WSOCK32(?), ref: 00A146F9
_wcscpy.LIBCMT ref: 00A14721
_memmove.LIBCMT ref: 00A14734
inet_ntoa.WSOCK32(?), ref: 00A1473F
_strcat.LIBCMT ref: 00A1474D
_wcscpy.LIBCMT ref: 00A14764
WSACleanup.WSOCK32 ref: 00A14772
_wcscpy.LIBCMT ref: 00A14780

Strings

0.0.0.0, xrefs: 00A1471B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 95c7d00aebfb543fe4e521d07c3392c6df8d530d1ec85d0a773eeefce2980e62
Instruction ID: 18a316acde8db5dd7619c07416695afd82a688bbcb807a464c38b8316b3235c9
Opcode Fuzzy Hash: 95c7d00aebfb543fe4e521d07c3392c6df8d530d1ec85d0a773eeefce2980e62
Instruction Fuzzy Hash: 8911D231900114AFCB24AB74DC4AFEA77BCEB96711F0441B6F449961E1EF708AC28AA0

Function 00A14F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A14F7A

Part of subcall function 009D049F: timeGetTime.WINMM(?,75C0B400,009C0E7B), ref: 009D04A3

Sleep.KERNEL32(0000000A), ref: 00A14FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00A14FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A14FEC
SetActiveWindow.USER32 ref: 00A1500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A15019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00A15038
Sleep.KERNEL32(000000FA), ref: 00A15043
IsWindow.USER32 ref: 00A1504F
EndDialog.USER32(00000000), ref: 00A15060

Strings

BUTTON, xrefs: 00A14FDE

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 16b40721557c6dae52a06ec0031684ebef308d7ee5b62047e9242b11b845d6ea
Instruction ID: 1334b5cec856527b5e3a1f866beb2f51e0146121d46b828cd7beb2e30f74acf0
Opcode Fuzzy Hash: 16b40721557c6dae52a06ec0031684ebef308d7ee5b62047e9242b11b845d6ea
Instruction Fuzzy Hash: 8421C370A00A04FFEB11DFF0ED89FA63B69EB48745F045038F10A812B1EB718DC69661

Function 00A1D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

CoInitialize.OLE32(00000000), ref: 00A1D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A1D67D
SHGetDesktopFolder.SHELL32(?), ref: 00A1D691
CoCreateInstance.OLE32(00A42D7C,00000000,00000001,00A68C1C,?), ref: 00A1D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A1D74C
CoTaskMemFree.OLE32(?,?), ref: 00A1D7A4
_memset.LIBCMT ref: 00A1D7E1
SHBrowseForFolderW.SHELL32(?), ref: 00A1D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A1D840
CoTaskMemFree.OLE32(00000000), ref: 00A1D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00A1D87E
CoUninitialize.OLE32(00000001,00000000), ref: 00A1D880

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: b635707e45f490e845fe99244fe331938188be9cfa628f64b0145c1c8b7557a5
Instruction ID: 5607509679e9f469961ccd87571a73357af940682ae60d334c8ea26e959b6f37
Opcode Fuzzy Hash: b635707e45f490e845fe99244fe331938188be9cfa628f64b0145c1c8b7557a5
Instruction Fuzzy Hash: 87B1FD75A10109AFDB04DFA8C984EAEBBB9FF88314F148469F919DB261DB30ED41CB50

Function 00A0C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00A0C283
GetWindowRect.USER32(00000000,?), ref: 00A0C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00A0C2F3
GetDlgItem.USER32(?,00000002), ref: 00A0C2FE
GetWindowRect.USER32(00000000,?), ref: 00A0C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00A0C364
GetDlgItem.USER32(?,000003E9), ref: 00A0C372
GetWindowRect.USER32(00000000,?), ref: 00A0C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00A0C3C6
GetDlgItem.USER32(?,000003EA), ref: 00A0C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00A0C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00A0C3FE

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6dc504709f643d9baaa34341bf965725999a0b82e9c23753b407b122f6157262
Instruction ID: ea58cabc9182afc89699eb3981becdf0cf15d8472c1d49b213118ae16d72e7b2
Opcode Fuzzy Hash: 6dc504709f643d9baaa34341bf965725999a0b82e9c23753b407b122f6157262
Instruction Fuzzy Hash: 67514171B10209AFDF18CFA9DD9AAAEBBB6EB88710F14822DF515D72D0D7709D418B10

Function 009B201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 009B1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009B2036,?,00000000,?,?,?,?,009B16CB,00000000,?), ref: 009B1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 009B20D3
KillTimer.USER32(-00000001,?,?,?,?,009B16CB,00000000,?,?,009B1AE2,?,?), ref: 009B216E
DestroyAcceleratorTable.USER32(00000000), ref: 009EBCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009B16CB,00000000,?,?,009B1AE2,?,?), ref: 009EBCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009B16CB,00000000,?,?,009B1AE2,?,?), ref: 009EBCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009B16CB,00000000,?,?,009B1AE2,?,?), ref: 009EBD0A
DeleteObject.GDI32(00000000), ref: 009EBD1C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 3246da1cced653c0f1cfb61da81282012bfbef1cdf1548aa9f365236f4f2cbaf
Instruction ID: 389ef823f16bbc7ed3747dd60df7763763257d3dccd5ac27e7c8049af3678e09
Opcode Fuzzy Hash: 3246da1cced653c0f1cfb61da81282012bfbef1cdf1548aa9f365236f4f2cbaf
Instruction Fuzzy Hash: 72619F30914A40DFC726EF69CE48B6A77F5FB40322F10882DE4465A970C7B4AC82DB81

Function 009B21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 009B25DB: GetWindowLongW.USER32(?,000000EB), ref: 009B25EC

GetSysColor.USER32(0000000F), ref: 009B21D3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: e287d48651786adb7d8b9262982b061767f21ccdff446ed08fcf69fe4c1eba66
Instruction ID: ba8acff2b2c460e85203430d7efe4b8bd33d4709d7d9462586f68f121ee2e3b0
Opcode Fuzzy Hash: e287d48651786adb7d8b9262982b061767f21ccdff446ed08fcf69fe4c1eba66
Instruction Fuzzy Hash: FD417C31400144AFDB299FA8ED89BF93B69EB06331F284365FE65CA1E5C7318C42DB61

Function 00A1A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00A3F910), ref: 00A1A90B
GetDriveTypeW.KERNEL32(00000061,00A689A0,00000061), ref: 00A1A9D5
_wcscpy.LIBCMT ref: 00A1A9FF

Strings

ramdisk, xrefs: 00A1A97F
removable, xrefs: 00A1A93D
all, xrefs: 00A1A911
fixed, xrefs: 00A1A953
network, xrefs: 00A1A969
unknown, xrefs: 00A1A996
cdrom, xrefs: 00A1A927

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 47960ab8d0bc11bb93743646f7c2bd3a090e37b1c447cef9af95e20d127a4914
Instruction ID: 50b37da20b14fbbda08e49a816dcb4551ee912ad9e9e2a2f25913693114a1d51
Opcode Fuzzy Hash: 47960ab8d0bc11bb93743646f7c2bd3a090e37b1c447cef9af95e20d127a4914
Instruction Fuzzy Hash: FD51BD311183019FC700EF14C992BEFB7A9EFD4350F14492DF595572A2DB319989CA53

Function 009B9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 009B9862
__swprintf.LIBCMT ref: 009B98AC
__i64tow.LIBCMT ref: 009EF5E6

Strings

%.15g, xrefs: 009B98A6
False, xrefs: 009EF5AE
0x%p, xrefs: 009EF5C8
True, xrefs: 009EF5A7

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 3805afac70a5b707b24f5a47df2d7818201c60aa0f735d40132086c595dea3a5
Instruction ID: 22499514b7cf8d7a250299b46c87941856116fc360aaa6e7e0daae8f1c63b4d2
Opcode Fuzzy Hash: 3805afac70a5b707b24f5a47df2d7818201c60aa0f735d40132086c595dea3a5
Instruction Fuzzy Hash: AD41D171610205AAEB259F35D942BBA73F9FF85310F20886FE549DB292EE359D018B20

Function 00A37152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A3716A
CreateMenu.USER32 ref: 00A37185
SetMenu.USER32(?,00000000), ref: 00A37194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A37221
IsMenu.USER32(?), ref: 00A37237
CreatePopupMenu.USER32 ref: 00A37241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A3726E
DrawMenuBar.USER32 ref: 00A37276

Strings

F, xrefs: 00A37262
0, xrefs: 00A37160

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 80e24370ed4699f709f78549acd9565790f04f9f91e73648fd0d313b31479c8b
Instruction ID: d2b26246418d22c5bc809bd6e902c717baa7c0cf3edb5d7c51b0ab82ed9b398a
Opcode Fuzzy Hash: 80e24370ed4699f709f78549acd9565790f04f9f91e73648fd0d313b31479c8b
Instruction Fuzzy Hash: 224132B5A01209EFDB20DFA4D984FDABBB5FF48310F144029F949A7361D771A910CBA0

Function 00A374BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00A3755E
CreateCompatibleDC.GDI32(00000000), ref: 00A37565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00A37578
SelectObject.GDI32(00000000,00000000), ref: 00A37580
GetPixel.GDI32(00000000,00000000,00000000), ref: 00A3758B
DeleteDC.GDI32(00000000), ref: 00A37594
GetWindowLongW.USER32(?,000000EC), ref: 00A3759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00A375B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00A375BE

Strings

static, xrefs: 00A374F6

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 69d0b240e659494bcbaa6445ee105cfa041ad24118493dff4fdc6c4976c6e20c
Instruction ID: aee1f91624667356f230c5466a3ae0d7e9657f003219cf64128bd7e260b06ae8
Opcode Fuzzy Hash: 69d0b240e659494bcbaa6445ee105cfa041ad24118493dff4fdc6c4976c6e20c
Instruction Fuzzy Hash: 03319C72514215BFDF269FA4DC09FDB3B69FF09320F110224FA15A20A0C731D812DBA0

Function 009D6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009D6E3E

Part of subcall function 009D8B28: __getptd_noexit.LIBCMT ref: 009D8B28

__gmtime64_s.LIBCMT ref: 009D6ED7
__gmtime64_s.LIBCMT ref: 009D6F0D
__gmtime64_s.LIBCMT ref: 009D6F2A
__allrem.LIBCMT ref: 009D6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D6F9C
__allrem.LIBCMT ref: 009D6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D6FD1
__allrem.LIBCMT ref: 009D6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D7006
__invoke_watson.LIBCMT ref: 009D7077

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: d81f1e50e27a4167e011f58cc51d85bb8dcc054e103adcd2c3bb6bc659867ac8
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: EF71F476A80B16ABD714AFA9DC81B5AB7A8AF44320F14C62BF414E73C1F770DD508B90

Function 00A12527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A12542
GetMenuItemInfoW.USER32(00A75890,000000FF,00000000,00000030), ref: 00A125A3
SetMenuItemInfoW.USER32(00A75890,00000004,00000000,00000030), ref: 00A125D9
Sleep.KERNEL32(000001F4), ref: 00A125EB
GetMenuItemCount.USER32(?), ref: 00A1262F
GetMenuItemID.USER32(?,00000000), ref: 00A1264B
GetMenuItemID.USER32(?,-00000001), ref: 00A12675
GetMenuItemID.USER32(?,?), ref: 00A126BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A12700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A12714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A12735

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 3f6f301d807249483263fab89896f7dd91c353aed9797cff15728a5269c70c81
Instruction ID: ee786de6b7c090aacf64bd826ed6d9150f18b70bff90a2f182df14dc8183ebb4
Opcode Fuzzy Hash: 3f6f301d807249483263fab89896f7dd91c353aed9797cff15728a5269c70c81
Instruction Fuzzy Hash: 3E618AB0900249AFDB21CFA4CD88AEF7BB9EB41344F144159F852A7291D731EDA6DB20

Function 00A36F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A36FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A36FA8
GetWindowLongW.USER32(?,000000F0), ref: 00A36FCC
_memset.LIBCMT ref: 00A36FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A36FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A37067

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 75f3a6b75c6eda096977b35430ae58e1f54ad77507fa769a65828ea3c35a8b41
Instruction ID: b4837a8c90c239098c8c66e8848ae456eb1411737c5776b333c82c565152ac00
Opcode Fuzzy Hash: 75f3a6b75c6eda096977b35430ae58e1f54ad77507fa769a65828ea3c35a8b41
Instruction Fuzzy Hash: 07617BB5900208AFDB21DFA4CD81EEEB7F8EF09710F144159FA14AB2A1C771AD41DBA0

Function 00A06B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00A06BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00A06C18
VariantInit.OLEAUT32(?), ref: 00A06C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00A06C4A
VariantCopy.OLEAUT32(?,?), ref: 00A06C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00A06CB1
VariantClear.OLEAUT32(?), ref: 00A06CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00A06CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A06CDC
VariantClear.OLEAUT32(?), ref: 00A06CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A06CF9

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: bed1123956a5ad1144e0abac2999a2e3dd7d5f7256b4e878044e144a0ad961d5
Instruction ID: edf5bd71b16f6f53c1f4fc2bba1b94d33204a1fc12bcd739e5120c3062427f0a
Opcode Fuzzy Hash: bed1123956a5ad1144e0abac2999a2e3dd7d5f7256b4e878044e144a0ad961d5
Instruction Fuzzy Hash: FC415075E1011DAFDF00DFA8ED449AEBBB9EF48354F008069F955E72A1CB30A956CB90

Function 00A25732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A25793
inet_addr.WSOCK32(?,?,?), ref: 00A257D8
gethostbyname.WSOCK32(?), ref: 00A257E4
IcmpCreateFile.IPHLPAPI ref: 00A257F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A25862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A25878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00A258ED
WSACleanup.WSOCK32 ref: 00A258F3

Strings

Ping, xrefs: 00A25816

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: bc671863af644adc9d2b19aa9e45f1c15f33222f6f1b3d3eca0a44aa0f3357d9
Instruction ID: 6ddd116db14475ca8a4a7fbfa45644bf4a639c020faabd392985d60ce0ed6bf4
Opcode Fuzzy Hash: bc671863af644adc9d2b19aa9e45f1c15f33222f6f1b3d3eca0a44aa0f3357d9
Instruction Fuzzy Hash: 60518C31A046109FDB10EF69ED49B6AB7F4FF89720F044929F956DB2A1DB70E801DB42

Function 00A1B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A1B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A1B546
GetLastError.KERNEL32 ref: 00A1B550
SetErrorMode.KERNEL32(00000000,READY), ref: 00A1B5BD

Strings

NOTREADY, xrefs: 00A1B57C
READONLY, xrefs: 00A1B588
INVALID, xrefs: 00A1B58F
READY, xrefs: 00A1B596
UNKNOWN, xrefs: 00A1B575

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 88aaccd0743c3aa4adcc05288ec20201fb25f3b8df6d5533b7d8f114fe03a90d
Instruction ID: a830ab8cac2bfadcd44471d76ad29b3ad96a13364f22c8c2b816614e7b3a1f06
Opcode Fuzzy Hash: 88aaccd0743c3aa4adcc05288ec20201fb25f3b8df6d5533b7d8f114fe03a90d
Instruction Fuzzy Hash: D6318335A10205EFCB10EFA8C945EEDBBB5FF45320F144125F5069B291DB719A82CB61

Function 00A08F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 00A0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00A0AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00A09014
GetDlgCtrlID.USER32 ref: 00A0901F
GetParent.USER32 ref: 00A0903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A0903E
GetDlgCtrlID.USER32(?), ref: 00A09047
GetParent.USER32(?), ref: 00A09063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00A09066

Strings

ComboBox, xrefs: 00A08F9C
ListBox, xrefs: 00A08FD1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 8a1832166c640a289800e37e535ff140490d47530d819f13bb8e41263fb85e98
Instruction ID: d5949eff3399dee1f11f2eee688ed0477b6d60104f6a691500fef0defc655da2
Opcode Fuzzy Hash: 8a1832166c640a289800e37e535ff140490d47530d819f13bb8e41263fb85e98
Instruction Fuzzy Hash: 3121AC70E00208BFDF04ABA0DC86EFEBB75EB89320F104119F961972E2DB755819DA20

Function 00A0907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 00A0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00A0AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00A090FD
GetDlgCtrlID.USER32 ref: 00A09108
GetParent.USER32 ref: 00A09124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A09127
GetDlgCtrlID.USER32(?), ref: 00A09130
GetParent.USER32(?), ref: 00A0914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 00A0914F

Strings

ComboBox, xrefs: 00A09087
ListBox, xrefs: 00A090BC

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 0f9a663c6695c8086a24dfe02de4ce552f3ebfb95fe912dcc1bfe330b7ac8dd3
Instruction ID: 08add85da78b16c28ab20b4bfa226a73ba3a4a9f7f486000cd14d553bd6b0419
Opcode Fuzzy Hash: 0f9a663c6695c8086a24dfe02de4ce552f3ebfb95fe912dcc1bfe330b7ac8dd3
Instruction Fuzzy Hash: D321A174E00208BFDF01ABA4DC85EFEBB74EF84310F104115F951972E2DB755855DA20

Function 00A09163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00A0916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00A09184
_wcscmp.LIBCMT ref: 00A09196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00A09211

Strings

largeicons, xrefs: 00A091A5
smallicons, xrefs: 00A091D9
details, xrefs: 00A091BF
list, xrefs: 00A091F3
SHELLDLL_DefView, xrefs: 00A09190

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 119e1a0a66d75610b14061ac6ee65461590159a83cb8ecd3f5ae4343a427856f
Instruction ID: fb17dc72bf437da86cfea016215598fbccd1d46d3139b645c694e001acbabcc2
Opcode Fuzzy Hash: 119e1a0a66d75610b14061ac6ee65461590159a83cb8ecd3f5ae4343a427856f
Instruction Fuzzy Hash: E2110A3729830BB9FA152724FC07DE737ACAB65720F200526F910A51D3FF6258515594

Function 00A288AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A288D7
CoInitialize.OLE32(00000000), ref: 00A28904
CoUninitialize.OLE32 ref: 00A2890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00A28A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00A28B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00A42C0C), ref: 00A28B6F
CoGetObject.OLE32(?,00000000,00A42C0C,?), ref: 00A28B92
SetErrorMode.KERNEL32(00000000), ref: 00A28BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A28C25
VariantClear.OLEAUT32(?), ref: 00A28C35

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 474d4bc3f14a4e0f7b56ac27b8febbd9ea1d3cb0bb676fb010bdeca1b4ecd7e0
Instruction ID: a242c4c78447414c472a53435ed022fe8609dafe68bdba5c25e920172772197b
Opcode Fuzzy Hash: 474d4bc3f14a4e0f7b56ac27b8febbd9ea1d3cb0bb676fb010bdeca1b4ecd7e0
Instruction Fuzzy Hash: F3C158B1608315AFC700DF68D884A6BB7E9FF89348F00492DF5899B261DB75ED06CB52

Function 00A17990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00A17A6C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 40f1a45670996874cb5c82c55d7f401fa3c869b08818c1597e04a8323ddb4e26
Instruction ID: eb329da4734ce72ec24c345df278b05e1cb881e56fe4b2f9862892838da16dbf
Opcode Fuzzy Hash: 40f1a45670996874cb5c82c55d7f401fa3c869b08818c1597e04a8323ddb4e26
Instruction Fuzzy Hash: 78B19E7590821A9FDB00DFA4D884BFEB7B5FF49321F245429E641EB281D734E981CBA0

Function 00A111CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A111F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A10268,?,00000001), ref: 00A11204
GetWindowThreadProcessId.USER32(00000000), ref: 00A1120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A10268,?,00000001), ref: 00A1121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A1122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A10268,?,00000001), ref: 00A11245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A10268,?,00000001), ref: 00A11257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A10268,?,00000001), ref: 00A1129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00A10268,?,00000001), ref: 00A112B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00A10268,?,00000001), ref: 00A112BC

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d0c92f0f3f22b2b7490643167b121b882c9d9cc2b5b2e1ac0c7ee71fa15e5123
Instruction ID: 8a0cc4aaefd1add16803827dff7c391488ed574c00ca514eecaf2560bac8f172
Opcode Fuzzy Hash: d0c92f0f3f22b2b7490643167b121b882c9d9cc2b5b2e1ac0c7ee71fa15e5123
Instruction Fuzzy Hash: B231AD75A00604BFDB20DF94ED89FE977A9EB55311F108129FE08D62A0D7B49DC28B64

Function 009EBDA2 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009B2231
SetTextColor.GDI32(?,000000FF), ref: 009B223B
SetBkMode.GDI32(?,00000001), ref: 009B2250
GetStockObject.GDI32(00000005), ref: 009B2258
GetClientRect.USER32(?), ref: 009EBDBB
SendMessageW.USER32(?,00001328,00000000,?), ref: 009EBDD2
GetWindowDC.USER32(?), ref: 009EBDDE
GetPixel.GDI32(00000000,?,?), ref: 009EBDED
ReleaseDC.USER32(?,00000000), ref: 009EBDFF
GetSysColor.USER32(00000005), ref: 009EBE1D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 2b8ef622ea7b3c9be497f5d7281746c24a2c0333646b7c6cd6342745f2716b62
Instruction ID: a29471158d0c71fb80a8d98af2ea2c37bb8c0d84cbab138c201fc9490ac26e00
Opcode Fuzzy Hash: 2b8ef622ea7b3c9be497f5d7281746c24a2c0333646b7c6cd6342745f2716b62
Instruction Fuzzy Hash: 4C212631910245FFDB21AFA4ED09BE97B65EB08332F104265FA2A950F1CB714952EF11

Function 009BFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 009BFAA6
OleUninitialize.OLE32(?,00000000), ref: 009BFB45
UnregisterHotKey.USER32(?), ref: 009BFC9C
DestroyWindow.USER32(?), ref: 009F45D6
FreeLibrary.KERNEL32(?), ref: 009F463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 009F4668

Strings

close all, xrefs: 009BFAA1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 5782f2d1226d3d959a0dc7f4338b855168e83026de0ccc9b9364431f28283463
Instruction ID: 5f50139001a5ccf243661f510875a301182a2c591f8ccc3bb094d8a82794be5d
Opcode Fuzzy Hash: 5782f2d1226d3d959a0dc7f4338b855168e83026de0ccc9b9364431f28283463
Instruction Fuzzy Hash: EDA18F30701216CFCB18EF14CAA4BBAF764BF45720F5442ADE90AAB261DB30AD52CF50

Function 00A0A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00A0A439), ref: 00A0A377

Strings

INSTANCE, xrefs: 00A0A285
CLASSNN, xrefs: 00A0A119
CLASS, xrefs: 00A0A0F6
TEXT, xrefs: 00A0A2AE
REGEXPCLASS, xrefs: 00A0A13C
NAME, xrefs: 00A0A1A9

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 0ea33c75a1f1d20f6031412c85bbe0023fad12d51b2776510a6bbef8b7619463
Instruction ID: 10883f0c8250b8f74ca1de7d2b91bbfcfeb2bef858aa8ab4c3c9e20cc3cda5cc
Opcode Fuzzy Hash: 0ea33c75a1f1d20f6031412c85bbe0023fad12d51b2776510a6bbef8b7619463
Instruction Fuzzy Hash: B991C831600709EBCB08DFA0D456BEEFBB4BF54310F54C12AE459A7291DF316999CB92

Function 009B2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 009B2EAE

Part of subcall function 009B1DB3: GetClientRect.USER32(?,?), ref: 009B1DDC
Part of subcall function 009B1DB3: GetWindowRect.USER32(?,?), ref: 009B1E1D
Part of subcall function 009B1DB3: ScreenToClient.USER32(?,?), ref: 009B1E45

GetDC.USER32 ref: 009ECD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 009ECD45
SelectObject.GDI32(00000000,00000000), ref: 009ECD53
SelectObject.GDI32(00000000,00000000), ref: 009ECD68
ReleaseDC.USER32(?,00000000), ref: 009ECD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 009ECDFB

Strings

U, xrefs: 009ECCD0

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 1cc7f83c6f1a5302aee6da66129fd6812a80b3cf4bab68e6cbc61a6f8af67d8c
Instruction ID: bcc7d45ee5000309a01ff158a49e58b23e782d0eb55baaee9e7850297d679750
Opcode Fuzzy Hash: 1cc7f83c6f1a5302aee6da66129fd6812a80b3cf4bab68e6cbc61a6f8af67d8c
Instruction Fuzzy Hash: 8271E271900245DFCF26CF65CD84AEA7BB9FF48320F14466AFD955A2A6C7318C82DB60

Function 00A21A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A21A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00A21A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00A21ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00A21AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A21AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00A21B10
InternetCloseHandle.WININET(00000000), ref: 00A21B57

Part of subcall function 00A22483: GetLastError.KERNEL32(?,?,00A21817,00000000,00000000,00000001), ref: 00A22498
Part of subcall function 00A22483: SetEvent.KERNEL32(?,?,00A21817,00000000,00000000,00000001), ref: 00A224AD

Strings

, xrefs: 00A21B01

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 9cdb6f103fb49da02107ed3d39834441b76eab45922063f7c1e7f7f4b86f81d4
Instruction ID: bb5eebc23344a9364c7bac30d1a585bc23130dff011efc1242ede56709ff2120
Opcode Fuzzy Hash: 9cdb6f103fb49da02107ed3d39834441b76eab45922063f7c1e7f7f4b86f81d4
Instruction Fuzzy Hash: 7E417EB1901228BFEB119F54DC89FFB7BACEF18354F00812AFE059A151E7749E459BA0

Function 00A28C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00A3F910), ref: 00A28D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00A3F910), ref: 00A28D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00A28ED6
SysFreeString.OLEAUT32(?), ref: 00A28F00

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: ecc4c3add50d86c0ea401f208e7769c728995c8505c76ad557d7a3c9069ef023
Instruction ID: bca9f4da57211c558b410beaa417f09a341258423b3907cc96aece96a48bde00
Opcode Fuzzy Hash: ecc4c3add50d86c0ea401f208e7769c728995c8505c76ad557d7a3c9069ef023
Instruction Fuzzy Hash: 42F14A71A00219EFCF04DF98D984EAEB7B9FF49714F108468F905AB251DB35AE46CB50

Function 00A2F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A2F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A2F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A2F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A2F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A2FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00A2FA7C
CloseHandle.KERNEL32(?), ref: 00A2FAAB
CloseHandle.KERNEL32(?), ref: 00A2FB22

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 4b7a34dc006483265c3a8711ce2ae910f0d793dab3a37166b542ec5e67bd2c6b
Instruction ID: 20c670b6daf8427f8957c87f5871f7513eb0d87c1de00955aa4177a5aac5f620
Opcode Fuzzy Hash: 4b7a34dc006483265c3a8711ce2ae910f0d793dab3a37166b542ec5e67bd2c6b
Instruction Fuzzy Hash: 8FE19F316043109FCB14EF28D991B6ABBF1AF85354F14897EF8999B2A2CB31DC45CB52

Function 00A14CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A13697,?), ref: 00A1468B

Part of subcall function 00A1466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A13697,?), ref: 00A146A4

Part of subcall function 00A14A31: GetFileAttributesW.KERNEL32(?,00A1370B), ref: 00A14A32

lstrcmpiW.KERNEL32(?,?), ref: 00A14D40
_wcscmp.LIBCMT ref: 00A14D5A
MoveFileW.KERNEL32(?,?), ref: 00A14D75

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: b5bd43e4db76422cd741f4964c03db0021ca9a7ccb7ecb3f91cc470b52b30106
Instruction ID: 6e0e292db99fce1fe22b2bd254396677482922e52774a77865270e54165a05e4
Opcode Fuzzy Hash: b5bd43e4db76422cd741f4964c03db0021ca9a7ccb7ecb3f91cc470b52b30106
Instruction Fuzzy Hash: 3C5162B24083459BC724EBA4D881ADFB3ECAF88750F40492FF289D3151EE35A589C766

Function 00A38645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00A386FF

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: d0911b9e5a63dcd220aa4c9f7e6af7ae0054c49b187e623ee664f61c11ddbd6b
Instruction ID: ea1e868d1d793d5804b2b4e1ef460779e984f34f5f41fd1a1fa752e4188d1b85
Opcode Fuzzy Hash: d0911b9e5a63dcd220aa4c9f7e6af7ae0054c49b187e623ee664f61c11ddbd6b
Instruction Fuzzy Hash: 5151A030A00344BFEF249B68CC8AFAD7BA5EB05760F604215F955E61A1CFB9A980DB51

Function 009B2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 009EC2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 009EC319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 009EC331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 009EC34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 009EC370
DestroyIcon.USER32(00000000), ref: 009EC37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 009EC39C
DestroyIcon.USER32(?), ref: 009EC3AB

Part of subcall function 00A3A4AF: DeleteObject.GDI32(00000000), ref: 00A3A4E8

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 5968ce337d9a3b3fc4d664c8c300def417399ae3c6cefa127dcd7103d9bb5bb7
Instruction ID: 45323f3f743b0a568aa4cf97a148370dacf0df89af77f276af45a26a4ee4b758
Opcode Fuzzy Hash: 5968ce337d9a3b3fc4d664c8c300def417399ae3c6cefa127dcd7103d9bb5bb7
Instruction Fuzzy Hash: 0E518C70A10249EFDB24DF65CD45FAA3BB9EB48320F104528F956E7290DBB0EC92DB50

Function 00A0966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A0A84C
Part of subcall function 00A0A82C: GetCurrentThreadId.KERNEL32 ref: 00A0A853
Part of subcall function 00A0A82C: AttachThreadInput.USER32(00000000,?,00A09683,?,00000001), ref: 00A0A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 00A0968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00A096AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00A096AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A096B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00A096D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00A096D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A096E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00A096F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00A096FB

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: aa349e220e1f8a6e15af5ae991bcfe3ad5e800ab185f66c2b08398faaa7a2f42
Instruction ID: 06a8c78a6373b7d1f0c47c4583a52f8d65cc0b135d27aa52a4bdc98b931d1d9d
Opcode Fuzzy Hash: aa349e220e1f8a6e15af5ae991bcfe3ad5e800ab185f66c2b08398faaa7a2f42
Instruction Fuzzy Hash: A511A5B1960618BEF610AFA0EC4AF6B7B2DDB4C751F110425F344AB0E1CAF35C51DAA4

Function 00A08921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00A0853C,00000B00,?,?), ref: 00A0892A
HeapAlloc.KERNEL32(00000000,?,00A0853C,00000B00,?,?), ref: 00A08931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A0853C,00000B00,?,?), ref: 00A08946
GetCurrentProcess.KERNEL32(?,00000000,?,00A0853C,00000B00,?,?), ref: 00A0894E
DuplicateHandle.KERNEL32(00000000,?,00A0853C,00000B00,?,?), ref: 00A08951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00A0853C,00000B00,?,?), ref: 00A08961
GetCurrentProcess.KERNEL32(00A0853C,00000000,?,00A0853C,00000B00,?,?), ref: 00A08969
DuplicateHandle.KERNEL32(00000000,?,00A0853C,00000B00,?,?), ref: 00A0896C
CreateThread.KERNEL32(00000000,00000000,00A08992,00000000,00000000,00000000), ref: 00A08986

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 8d6907bf65a7cc4050498de79e16c2a6ed23db99d387ee5797f5fa11b73f38bb
Instruction ID: ce2b07c36e03fd7c169bec5b8269b4626dd91d7ea8e84043846afb087665ce4d
Opcode Fuzzy Hash: 8d6907bf65a7cc4050498de79e16c2a6ed23db99d387ee5797f5fa11b73f38bb
Instruction Fuzzy Hash: A201A8B5650308FFE650EBA5EC49F6B3BACEB89711F408521FB05DB1A1CA7498059A20

Function 00A29B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00A29BA4, 00A29EC8
Not an Object type, xrefs: 00A29B7B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 61328e6810bc034c381ec7f11fb76138eda572251a5245817ffb549d6abb7ce9
Instruction ID: 5ffac7bc9515d6e3c6a6a5dabb3c6dbf57b63db4d236109fbdc09bb2f34417b5
Opcode Fuzzy Hash: 61328e6810bc034c381ec7f11fb76138eda572251a5245817ffb549d6abb7ce9
Instruction Fuzzy Hash: F3C19171A0022A9FDF14DFACE984AAFB7F5BF48714F158439E905AB280E770AD45CB50

Function 00A29113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A29167
VariantInit.OLEAUT32(?), ref: 00A29238
VariantInit.OLEAUT32(?), ref: 00A29339
VariantClear.OLEAUT32(?), ref: 00A29343
VariantClear.OLEAUT32(?), ref: 00A293A0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00A291C8, 00A292F6, 00A293AE
Incorrect Object type in FOR..IN loop, xrefs: 00A2931C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: e8fe8d6cff49bde58558abacb52e26ed5aee98190ee10ac236b0929fe3477dfe
Instruction ID: 52cce8d27aef2b301afec1fffd66ab86291f4eaf40dc234586ac84a55e230dc0
Opcode Fuzzy Hash: e8fe8d6cff49bde58558abacb52e26ed5aee98190ee10ac236b0929fe3477dfe
Instruction Fuzzy Hash: 55916D71A00225EBDF24CFA9D848FAFB7B8EF85B10F10856DF515AB280D7709945CBA0

Function 00A2975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00A0710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?,?,?,00A07455), ref: 00A07127
Part of subcall function 00A0710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?,?), ref: 00A07142
Part of subcall function 00A0710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?,?), ref: 00A07150
Part of subcall function 00A0710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?), ref: 00A07160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00A29806
_memset.LIBCMT ref: 00A29813
_memset.LIBCMT ref: 00A29956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00A29982
CoTaskMemFree.OLE32(?), ref: 00A2998D

Strings

NULL Pointer assignment, xrefs: 00A299DB

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 50c1e73dc4ae5944485e15659f06a4a0668de3173ce4cc89630b97f647c7b76e
Instruction ID: 56f76524741c56b0adea94e4b5679e9d5bd0ae4fa2eeac0ebe21936b181cb4e3
Opcode Fuzzy Hash: 50c1e73dc4ae5944485e15659f06a4a0668de3173ce4cc89630b97f647c7b76e
Instruction Fuzzy Hash: C2913771D00228EBDB10DFA4DD81EDEBBB9AF48760F10416AF419A7291DB719A44CFA0

Function 00A36D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00A36E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00A36E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00A36E52
_wcscat.LIBCMT ref: 00A36EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00A36EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00A36EF2

Strings

SysListView32, xrefs: 00A36DF6

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 5eac57b7abda512f62583e97ef21c36f4fd7fedd672739c7564a6f8b9a3dea0d
Instruction ID: 514cb75601b6bad21bbf115260003d2d0991b31d6a6cac4f2f6bd0a67e19509c
Opcode Fuzzy Hash: 5eac57b7abda512f62583e97ef21c36f4fd7fedd672739c7564a6f8b9a3dea0d
Instruction Fuzzy Hash: A8419371A00348BFDB21DFA4CC85BEEB7B9EF08350F10452AF544A7191D7719D858B60

Function 00A2E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00A13C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00A13C7A
Part of subcall function 00A13C55: Process32FirstW.KERNEL32(00000000,?), ref: 00A13C88
Part of subcall function 00A13C55: CloseHandle.KERNEL32(00000000), ref: 00A13D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A2E9A4
GetLastError.KERNEL32 ref: 00A2E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A2E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 00A2EA63
GetLastError.KERNEL32(00000000), ref: 00A2EA6E
CloseHandle.KERNEL32(00000000), ref: 00A2EAA3

Strings

SeDebugPrivilege, xrefs: 00A2E9C2

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 51fcbe0805f755fbeff6fe146db10f2a86d60e26f751025426f66f1bfef00915
Instruction ID: 9a106e5d122ecb31dc65f5dbe6d1762987374824f580db17c963d0c6c342f792
Opcode Fuzzy Hash: 51fcbe0805f755fbeff6fe146db10f2a86d60e26f751025426f66f1bfef00915
Instruction Fuzzy Hash: AD41CD716002119FDB14EF58EDA5FAEB7A5AF81354F04842CF9029F2D2CB74AC85CB91

Function 00A12F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00A13033

Strings

warning, xrefs: 00A1301C
blank, xrefs: 00A12FB5
question, xrefs: 00A12FEC
info, xrefs: 00A12FD4
stop, xrefs: 00A13004

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 66214994b251d3eaae55896de4a8c2df8399fdc21986fe599cc3f7f61e53ca7b
Instruction ID: badd13691c01e04a1e802a5dbe5de438e1c5584a305bec0923471f08645ca4d0
Opcode Fuzzy Hash: 66214994b251d3eaae55896de4a8c2df8399fdc21986fe599cc3f7f61e53ca7b
Instruction Fuzzy Hash: 17112B32788346BEEF149F54DC42DEB7BFCDF29360B10402AF90166281DB759F8056A5

Function 00A142F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A14312
LoadStringW.USER32(00000000), ref: 00A14319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A1432F
LoadStringW.USER32(00000000), ref: 00A14336
_wprintf.LIBCMT ref: 00A1435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A1437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A14357

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: f1df7e381c5cc1e1361ee2fb51b65d9548b23934f35d39d4da3bec9f7f1d9ab6
Instruction ID: 08ea8d09976e2361cc2f551e669b2b3d383dae4fd07a8fec25e3f6b488e01883
Opcode Fuzzy Hash: f1df7e381c5cc1e1361ee2fb51b65d9548b23934f35d39d4da3bec9f7f1d9ab6
Instruction Fuzzy Hash: 64014FF6910208BFE711DBE4DD89EE6776CEB08301F0005A1BB49E6051EA745E854B71

Function 00A3D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

GetSystemMetrics.USER32(0000000F), ref: 00A3D47C
GetSystemMetrics.USER32(0000000F), ref: 00A3D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00A3D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00A3D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00A3D716
ShowWindow.USER32(00000003,00000000), ref: 00A3D735
InvalidateRect.USER32(?,00000000,00000001), ref: 00A3D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 00A3D77D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: d1268117edd8436c6eb0c261e0763478022ce7a4fbefaeef76fa530692076ca6
Instruction ID: 59e6c407a09e856c8fe28ef0693858c8768ad1a0c1d7887c491b72bbdbeaf311
Opcode Fuzzy Hash: d1268117edd8436c6eb0c261e0763478022ce7a4fbefaeef76fa530692076ca6
Instruction Fuzzy Hash: 4AB17971A00229EFDF14CF69D986BAD7BB1BF04711F088069FC58AB295D774A990CB90

Function 009B2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,009EC1C7,00000004,00000000,00000000,00000000), ref: 009B2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,009EC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 009B2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,009EC1C7,00000004,00000000,00000000,00000000), ref: 009EC21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,009EC1C7,00000004,00000000,00000000,00000000), ref: 009EC286

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: dd10e3cb5130bb0f34b6006a03c4e7d5bb857cd2110d6bda2188673ca4a15e8c
Instruction ID: 048c4a10511fa4d1be7bbdd3fbdb4b6c2aff81ea11b29b59837428303d2a288c
Opcode Fuzzy Hash: dd10e3cb5130bb0f34b6006a03c4e7d5bb857cd2110d6bda2188673ca4a15e8c
Instruction Fuzzy Hash: BC411D316186C09FCB359BA98E8CBEB7B99EB45320F248C1DF197865E1C674EC42D711

Function 00A170C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00A170DD

Part of subcall function 009D0DB6: std::exception::exception.LIBCMT ref: 009D0DEC
Part of subcall function 009D0DB6: __CxxThrowException@8.LIBCMT ref: 009D0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00A17114
EnterCriticalSection.KERNEL32(?), ref: 00A17130
_memmove.LIBCMT ref: 00A1717E
_memmove.LIBCMT ref: 00A1719B
LeaveCriticalSection.KERNEL32(?), ref: 00A171AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00A171BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 00A171DE

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 21a367bc024249443e1a75e63a317c85cfeb4956f267b32475d95e0f17167ec3
Instruction ID: d4f247d53a56ed07d3931f370cd51219fd13601beecb14c730fe4711b3cf376c
Opcode Fuzzy Hash: 21a367bc024249443e1a75e63a317c85cfeb4956f267b32475d95e0f17167ec3
Instruction Fuzzy Hash: 61315E71900205EFCB00DFA5DC85AAFB779EF85710F1481A6F904AB256DB70DE55CBA0

Function 00A361D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A361EB
GetDC.USER32(00000000), ref: 00A361F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A361FE
ReleaseDC.USER32(00000000,00000000), ref: 00A3620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A36246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A36257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A3902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00A36291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A362B1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 723aef89f5875c75c5207c70bd16caa85e3bbd45ba49478482c069edbb60e26f
Instruction ID: c2fefb62ba245f9884a5a85eb5f391562d00a512a05c19df21062db302cabc6b
Opcode Fuzzy Hash: 723aef89f5875c75c5207c70bd16caa85e3bbd45ba49478482c069edbb60e26f
Instruction Fuzzy Hash: 7A318D72511210BFEB108F90DC8AFEB3BA9EF49761F054065FE089A291C7B59842CB60

Function 00A0BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00A0BBC4
_memcmp.LIBCMT ref: 00A0BBE6
_memcmp.LIBCMT ref: 00A0BBFE
_memcmp.LIBCMT ref: 00A0BC11
_memcmp.LIBCMT ref: 00A0BC2B
_memcmp.LIBCMT ref: 00A0BC3E
_memcmp.LIBCMT ref: 00A0BC56
_memcmp.LIBCMT ref: 00A0BC71

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 64d4f47556424dbb68769fb25731ec4b77c851a4e6a120c11fbdbade89f7dda3
Instruction ID: 7d074480abc12aa9daf722f2d9e3a87cdb2bd4947092dd63c2fc5137e9310ef5
Opcode Fuzzy Hash: 64d4f47556424dbb68769fb25731ec4b77c851a4e6a120c11fbdbade89f7dda3
Instruction Fuzzy Hash: 6D21D47265120D7BF2046711AE42FFB736CAE99388F048422FD049A6C3FB24DE1182B1

Function 00A1EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

Part of subcall function 009CFC86: _wcscpy.LIBCMT ref: 009CFCA9

_wcstok.LIBCMT ref: 00A1EC94
_wcscpy.LIBCMT ref: 00A1ED23
_memset.LIBCMT ref: 00A1ED56

Strings

X, xrefs: 00A1ED93

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 89a7e3707642cf512daf298169a35f6bd2410d22c99d982dff37848a9408931b
Instruction ID: 3860d8a7b1568d77b73e8406561c195d323794fffd234abc6f29f69bca12842c
Opcode Fuzzy Hash: 89a7e3707642cf512daf298169a35f6bd2410d22c99d982dff37848a9408931b
Instruction Fuzzy Hash: 73C14A316083019FC754EF64D985BAAB7F4AF85320F04492DF9999B2A2DB30EC45CB82

Function 009B1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d36be955e8941a164a820767706b5f1752f539e492d6f0dc78487c98c8524c
Instruction ID: 4b90744a2934fa63c3ffeee779c4e288b2820731ab699915df62186bb9ac8cee
Opcode Fuzzy Hash: 49d36be955e8941a164a820767706b5f1752f539e492d6f0dc78487c98c8524c
Instruction Fuzzy Hash: 8D717A30900109EFCB15CF98CD98AFFBB79FF86320F548159F915AA261D734AA51CBA0

Function 00A26B76 Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdaebffd45730f237a93291ee736a4bf8c95cda842419522dafb7e5d06874d4
Instruction ID: ac53d4ac202d1b21ef22840dec22233b145c0cc59357f2a24be649e5b43ae11a
Opcode Fuzzy Hash: dcdaebffd45730f237a93291ee736a4bf8c95cda842419522dafb7e5d06874d4
Instruction Fuzzy Hash: A261BE71208714ABC710EF68DD81FAFB7A8AFD4724F44492DF9559B292DA30ED01CB92

Function 00A3B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(011C5C00), ref: 00A3B3EB
IsWindowEnabled.USER32(011C5C00), ref: 00A3B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00A3B4DB
SendMessageW.USER32(011C5C00,000000B0,?,?), ref: 00A3B512
IsDlgButtonChecked.USER32(?,?), ref: 00A3B54F
GetWindowLongW.USER32(011C5C00,000000EC), ref: 00A3B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00A3B589

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 47e9147da7dbb2c90b990f678b3186d24ebc0c86ca483e2c591f4b69c89ef350
Instruction ID: 19fa5a67b0ecd1f49dc7de513572daea3cbd0891534b25a2a60f2683969327dd
Opcode Fuzzy Hash: 47e9147da7dbb2c90b990f678b3186d24ebc0c86ca483e2c591f4b69c89ef350
Instruction Fuzzy Hash: 9471A134A14304EFDB24DF64CC95FBABBB6EF09300F148459FA46972A2C771A941DB64

Function 00A2F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2F448
_memset.LIBCMT ref: 00A2F511
ShellExecuteExW.SHELL32(?), ref: 00A2F556

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

Part of subcall function 009CFC86: _wcscpy.LIBCMT ref: 009CFCA9

GetProcessId.KERNEL32(00000000), ref: 00A2F5CD
CloseHandle.KERNEL32(00000000), ref: 00A2F5FC

Strings

@, xrefs: 00A2F525

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 681d4c7121de23176e4b0741647903549892d59c234a36c70cf3573b90112cc8
Instruction ID: 2f9496ef61de563cda4684c90d163c4a7f80c901a72b421ea50ba7c8f0e47c05
Opcode Fuzzy Hash: 681d4c7121de23176e4b0741647903549892d59c234a36c70cf3573b90112cc8
Instruction Fuzzy Hash: 87618475A00629DFCB14EF58D981AAEB7F5FF89320F148179E855AB351CB30AD41CB90

Function 00A10F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A10F8C
GetKeyboardState.USER32(?), ref: 00A10FA1
SetKeyboardState.USER32(?), ref: 00A11002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00A11030
PostMessageW.USER32(?,00000101,00000011,?), ref: 00A1104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00A11095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A110B8

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 713648269e49812da4f14754098e2a8e7f64e95286f56ea6b11c085d494ebd9c
Instruction ID: c15a593d7d99c47177037cd48eb824a1a97c2ae46ad04f0a48396eedc35a3379
Opcode Fuzzy Hash: 713648269e49812da4f14754098e2a8e7f64e95286f56ea6b11c085d494ebd9c
Instruction Fuzzy Hash: E151F3A09147D53DFB3647348C06BFABEA95B0A304F088589E2D4868D3C2E9ECD9D751

Function 00A10D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A10DA5
GetKeyboardState.USER32(?), ref: 00A10DBA
SetKeyboardState.USER32(?), ref: 00A10E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A10E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A10E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A10EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A10EC9

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 29d06caf46a54f353dbffabd4aaa305f9b7c479ac8f5f217a8c5b2ad048225e8
Instruction ID: 412c8edd163db41ca7f15b257ee400e6ea5c163de7f64290ff8d245f3fe239ca
Opcode Fuzzy Hash: 29d06caf46a54f353dbffabd4aaa305f9b7c479ac8f5f217a8c5b2ad048225e8
Instruction Fuzzy Hash: AE51D3A05447D57DFB3683758C45FFABEA96B06300F088889F1D48A8C2D3E5ACD9D750

Function 00A155FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00A1560A
_wcsncpy.LIBCMT ref: 00A1563F
_wcsncpy.LIBCMT ref: 00A15671
_wcsncpy.LIBCMT ref: 00A156A4
_wcsncpy.LIBCMT ref: 00A156E6
_wcsncpy.LIBCMT ref: 00A15720
_wcsncpy.LIBCMT ref: 00A1574F

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: a050ed1e214295c639d40a1ec4c44d883d56ffd8d5def36ce701053632d0db17
Instruction ID: 2f789c5ed15144eea7d268ea2ac954be4e00a44717f23f22bb3dd037380e1b2d
Opcode Fuzzy Hash: a050ed1e214295c639d40a1ec4c44d883d56ffd8d5def36ce701053632d0db17
Instruction Fuzzy Hash: 48418365C50614B6CB11EBB4CC46ACFB3B89F85310F50C957F518E3221EA35A295C7E6

Function 00A13671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A13697,?), ref: 00A1468B

Part of subcall function 00A1466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A13697,?), ref: 00A146A4

lstrcmpiW.KERNEL32(?,?), ref: 00A136B7
_wcscmp.LIBCMT ref: 00A136D3
MoveFileW.KERNEL32(?,?), ref: 00A136EB
_wcscat.LIBCMT ref: 00A13733
SHFileOperationW.SHELL32(?), ref: 00A1379F

Strings

\*.*, xrefs: 00A1372D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 6acc71e412cfe307e4f1ba3ee63ba452b012fc0b620e5704bd8fa42387976ca4
Instruction ID: cf13eba2a44bde111e46a3f7c930792c4a092b932bf4c2b02341be01209ff45d
Opcode Fuzzy Hash: 6acc71e412cfe307e4f1ba3ee63ba452b012fc0b620e5704bd8fa42387976ca4
Instruction Fuzzy Hash: 8841A272508344AECB51EF64D851ADFB7ECAF89380F000D2EF499C7291EA34D689C756

Function 00A37291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A372AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A37351
IsMenu.USER32(?), ref: 00A37369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A373B1
DrawMenuBar.USER32 ref: 00A373C4

Strings

0, xrefs: 00A3729E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 1526c8741dabe1114576ee8e30e448c27ebd1cec546ddfe52101c1c647cb704d
Instruction ID: 47169360b41224759c8fff2d7bc2a37d7f95ffceda44a637862e195e93148b6e
Opcode Fuzzy Hash: 1526c8741dabe1114576ee8e30e448c27ebd1cec546ddfe52101c1c647cb704d
Instruction Fuzzy Hash: 724116B5A05209AFDB20DFA0D884E9EBBB9FB09310F148529FD559B260D730AD50EB50

Function 00A30FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00A30FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A30FFE
FreeLibrary.KERNEL32(00000000), ref: 00A310B5

Part of subcall function 00A30FA5: RegCloseKey.ADVAPI32(?), ref: 00A3101B
Part of subcall function 00A30FA5: FreeLibrary.KERNEL32(?), ref: 00A3106D
Part of subcall function 00A30FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00A31090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00A31058

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: b067dabb77e56606e0b453c27dc773fefd868911f5d81222e61f816215e4dc48
Instruction ID: 6b24f7dacbaba76d88854cac1103821ed2a65412640af27e8f50501d66bea55a
Opcode Fuzzy Hash: b067dabb77e56606e0b453c27dc773fefd868911f5d81222e61f816215e4dc48
Instruction Fuzzy Hash: 2E310B71D11109BFDB19DFA4DD89EFFB7BCEF09340F00016AF501A2151EA749E859AA0

Function 00A362CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00A362EC
GetWindowLongW.USER32(011C5C00,000000F0), ref: 00A3631F
GetWindowLongW.USER32(011C5C00,000000F0), ref: 00A36354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00A36386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00A363B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00A363C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00A363DB

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2065e8fb70c0f38e573b786a788d3551c3e4adf82de27f09729c037260ab6f8d
Instruction ID: 6bbad2bfa18e3a720320caf068ed717ce1a1d5981db70630e54d03053622290b
Opcode Fuzzy Hash: 2065e8fb70c0f38e573b786a788d3551c3e4adf82de27f09729c037260ab6f8d
Instruction Fuzzy Hash: 69311331A44250AFDB20CFA8DC85F593BE1FB5A714F2981A4F5058F2B2CBB1A881DB51

Function 00A0DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A0DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A0DB54
SysAllocString.OLEAUT32(00000000), ref: 00A0DB57
SysAllocString.OLEAUT32(?), ref: 00A0DB75
SysFreeString.OLEAUT32(?), ref: 00A0DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 00A0DBA3
SysAllocString.OLEAUT32(?), ref: 00A0DBB1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 8304f8db72daae753d9a44a3770648d30969d7bb948b6f1f351efe51281e9e8d
Instruction ID: aa9d54cea043f020d99bd7ee1c9094f74374ed234b43177f173543d26d6f7f8f
Opcode Fuzzy Hash: 8304f8db72daae753d9a44a3770648d30969d7bb948b6f1f351efe51281e9e8d
Instruction Fuzzy Hash: 8E21627660021DAFDF10DFE8EC88DBB77ACEB09360B058565FA14DB2A0D6749C458B64

Function 00A26173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A27D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A27DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00A261C6
WSAGetLastError.WSOCK32(00000000), ref: 00A261D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00A2620E
connect.WSOCK32(00000000,?,00000010), ref: 00A26217
WSAGetLastError.WSOCK32 ref: 00A26221
closesocket.WSOCK32(00000000), ref: 00A2624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00A26263

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: fdee8861b64634aeba40f3729418dd958eaf0732cc4f4ecd23bad7b180ff56cf
Instruction ID: e2c5c6ba74110f845bc0b1b691952c9e7071d072359902b95dc44ad847b4fcc9
Opcode Fuzzy Hash: fdee8861b64634aeba40f3729418dd958eaf0732cc4f4ecd23bad7b180ff56cf
Instruction Fuzzy Hash: EB319E31A10128AFDF14AF68DC85BBE7BBCEB45720F044029F905A7291CB70AD058BA1

Function 00A0F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00A0F671
__wcsnicmp.LIBCMT ref: 00A0F692
__wcsnicmp.LIBCMT ref: 00A0F6AC

Strings

#OnAutoItStartRegister, xrefs: 00A0F6A6
#requireadmin, xrefs: 00A0F68C
#notrayicon, xrefs: 00A0F669

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 31054864ca3fd26019e9f7d804e13d2274ec437856fb60beaf1d1ac096bb0958
Instruction ID: f440efe173e574535c07231517759940c375ec29a54d7d07ea8c74d899871c6a
Opcode Fuzzy Hash: 31054864ca3fd26019e9f7d804e13d2274ec437856fb60beaf1d1ac096bb0958
Instruction Fuzzy Hash: 212179722445556EC230A734BC02FB773A8EFD5310F10843AF845A69D1EB919D42D3A6

Function 00A0DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A0DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A0DC2F
SysAllocString.OLEAUT32(00000000), ref: 00A0DC32
SysAllocString.OLEAUT32 ref: 00A0DC53
SysFreeString.OLEAUT32 ref: 00A0DC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 00A0DC76
SysAllocString.OLEAUT32(?), ref: 00A0DC84

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 61504b804e978680931c10a6ac49d63208e180e0e2ecf5abfeefc1ea01e9b464
Instruction ID: 67bbd4987ce30c518f897e958383ebbfbdb83eee7b09e8c19da440a07d8e6360
Opcode Fuzzy Hash: 61504b804e978680931c10a6ac49d63208e180e0e2ecf5abfeefc1ea01e9b464
Instruction Fuzzy Hash: 5D216536604208AFEB14DFF8ED88DAB77ECEB49360B108125F914DB2A1DAB4DC45C764

Function 00A375CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009B1D73
Part of subcall function 009B1D35: GetStockObject.GDI32(00000011), ref: 009B1D87
Part of subcall function 009B1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009B1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A37632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A3763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A3764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A37659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A37665

Strings

Msctls_Progress32, xrefs: 00A37603

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 42f5c7d958133f860a11eef780c4ec6108cbd802e0dd32783d22028573bad07e
Instruction ID: 1f4bc126db5c5b5d79b7d453ea9216a0f488499651d826fa7e0ef0032d886e62
Opcode Fuzzy Hash: 42f5c7d958133f860a11eef780c4ec6108cbd802e0dd32783d22028573bad07e
Instruction Fuzzy Hash: F21186B1550119BFEF159F64CC86EEB7F6DEF08798F114115B604A6090C7729C21DBA4

Function 009D9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 009D9AE6

Part of subcall function 009D3187: EncodePointer.KERNEL32(00000000), ref: 009D318A
Part of subcall function 009D3187: __initp_misc_winsig.LIBCMT ref: 009D31A5
Part of subcall function 009D3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 009D9EA0
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 009D9EB4
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 009D9EC7
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 009D9EDA
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 009D9EED
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 009D9F00
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 009D9F13
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 009D9F26
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 009D9F39
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 009D9F4C
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 009D9F5F
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 009D9F72
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 009D9F85
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 009D9F98
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 009D9FAB
Part of subcall function 009D3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 009D9FBE

__mtinitlocks.LIBCMT ref: 009D9AEB
__mtterm.LIBCMT ref: 009D9AF4

Part of subcall function 009D9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,009D9AF9,009D7CD0,00A6A0B8,00000014), ref: 009D9C56
Part of subcall function 009D9B5C: _free.LIBCMT ref: 009D9C5D
Part of subcall function 009D9B5C: DeleteCriticalSection.KERNEL32(00A6EC00,?,?,009D9AF9,009D7CD0,00A6A0B8,00000014), ref: 009D9C7F

__calloc_crt.LIBCMT ref: 009D9B19
__initptd.LIBCMT ref: 009D9B3B
GetCurrentThreadId.KERNEL32 ref: 009D9B42

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: cb5555722eaf54af135b89dcb99e78ba90fa63ff582ea8ece1034ea1aa72ab05
Instruction ID: 9ff85ed884c5439fcbc5fa788644c40e4eccbcbde6229471b3e8c82c2b1710f7
Opcode Fuzzy Hash: cb5555722eaf54af135b89dcb99e78ba90fa63ff582ea8ece1034ea1aa72ab05
Instruction Fuzzy Hash: 48F090335D97126AE774BBB4BC0375A26959F82734F21CA1BF460CA3D2FF60844141A0

Function 009D406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,009D3F85), ref: 009D4085
GetProcAddress.KERNEL32(00000000), ref: 009D408C
EncodePointer.KERNEL32(00000000), ref: 009D4097
DecodePointer.KERNEL32(009D3F85), ref: 009D40B2

Strings

RoUninitialize, xrefs: 009D4074
combase.dll, xrefs: 009D4080

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 33ac8be7efa3bde89bf66bf3482101162bd4bd2c7aa950620629ea3fe2a22698
Instruction ID: ef1418338fa15c5406f1a03b7857f2dcef53e8292b8a1590018b6e6a9a2e23a2
Opcode Fuzzy Hash: 33ac8be7efa3bde89bf66bf3482101162bd4bd2c7aa950620629ea3fe2a22698
Instruction Fuzzy Hash: BAE01271AD0200EFEF10EFE0EC09B013BA8BB00743F818626F115E61A0CBB24242AB01

Function 009B1DB3 Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 009B1DDC
GetWindowRect.USER32(?,?), ref: 009B1E1D
ScreenToClient.USER32(?,?), ref: 009B1E45
GetClientRect.USER32(?,?), ref: 009B1F74
GetWindowRect.USER32(?,?), ref: 009B1F8D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: e2ae90d9437c7e3669b6b3df1cc70909a39be45054b4093b683f89653b51e223
Instruction ID: 85557a1208e5b6bb70af0d50210989826ae968d5c4dce80d369a76dae91c0e90
Opcode Fuzzy Hash: e2ae90d9437c7e3669b6b3df1cc70909a39be45054b4093b683f89653b51e223
Instruction Fuzzy Hash: 27B1697990024ADBCF10CFA9C6907EEB7B5FF08320F548529EC99AB254DB34AA40CB54

Function 00A164B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A1660B
_memmove.LIBCMT ref: 00A16546

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

_memmove.LIBCMT ref: 00A165B9
_memmove.LIBCMT ref: 00A166A0
_memmove.LIBCMT ref: 00A166B9
_memmove.LIBCMT ref: 00A166D5

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 21c363d6d5c09a7a42dfc03ef52fd438f6cd54c5821b196d12bfcbf1ca2abfab
Instruction ID: 59f009030dcc478edb6fa172e9bb13a9a33e235771290a044b7a53ae3f0e3c16
Opcode Fuzzy Hash: 21c363d6d5c09a7a42dfc03ef52fd438f6cd54c5821b196d12bfcbf1ca2abfab
Instruction Fuzzy Hash: C761AB3090025A9BCF05EF60CD82FFE77B5AF85318F044519F9699B2A2DB34E945CB60

Function 00A301E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 00A30E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A2FDAD,?,?), ref: 00A30E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A302BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A302FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00A30320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A30349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A3038C
RegCloseKey.ADVAPI32(00000000), ref: 00A30399

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 3df65bcd2474f70608d472f9bda2fbf6e5f0b7663d4e6353a58f176287aa0b02
Instruction ID: 38632f3858c5881ce7325ab054e75e9b8b6d71fceaad64875f1369c37ea266d6
Opcode Fuzzy Hash: 3df65bcd2474f70608d472f9bda2fbf6e5f0b7663d4e6353a58f176287aa0b02
Instruction Fuzzy Hash: D2512631608204AFCB14EFA4C995EAFBBE9FF85314F04491DF5958B2A2DB31E905CB52

Function 00A35799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00A357FB
GetMenuItemCount.USER32(00000000), ref: 00A35832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00A3585A
GetMenuItemID.USER32(?,?), ref: 00A358C9
GetSubMenu.USER32(?,?), ref: 00A358D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00A35928

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 7481b739237d01e5ca61f5a8d69d23e9c0330bf3a68191a833a4370bdcb74de6
Instruction ID: ae3aea076240213d29d624fa1f74b03ba18ea85f62cd07601bfde08e870fc24f
Opcode Fuzzy Hash: 7481b739237d01e5ca61f5a8d69d23e9c0330bf3a68191a833a4370bdcb74de6
Instruction Fuzzy Hash: 64515B31E00615EFCF11EFA8C945AAEBBB5EF48320F10406AF811BB351CB70AE419B90

Function 00A0EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A0EF06
VariantClear.OLEAUT32(00000013), ref: 00A0EF78
VariantClear.OLEAUT32(00000000), ref: 00A0EFD3
_memmove.LIBCMT ref: 00A0EFFD
VariantClear.OLEAUT32(?), ref: 00A0F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00A0F078

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: de8d0db342fd7ffa2cc1005bd5e1936989327d86a2f6df5de43f26a97197aac0
Instruction ID: 9adfd83a6ad99f1114634fbca022262aa1aa47827280943ebfe8ace856909355
Opcode Fuzzy Hash: de8d0db342fd7ffa2cc1005bd5e1936989327d86a2f6df5de43f26a97197aac0
Instruction Fuzzy Hash: 48514CB5A00209DFDB24CF58D884AAAB7B8FF4C314B158569F959EB341E335E911CBA0

Function 00A1220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A12258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A122A3
IsMenu.USER32(00000000), ref: 00A122C3
CreatePopupMenu.USER32 ref: 00A122F7
GetMenuItemCount.USER32(000000FF), ref: 00A12355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00A12386

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: d425564743f48b54904d3f8b8e6dfc1eafedfded423f0373498b50fd89e18dbe
Instruction ID: 6d6ed43f6899645db67d357635c6112aa826cb84790f83a4a92792bdef21ee25
Opcode Fuzzy Hash: d425564743f48b54904d3f8b8e6dfc1eafedfded423f0373498b50fd89e18dbe
Instruction Fuzzy Hash: CF51AF70A00249DFDF21CFA8D988BEEBBF5BF45314F144129E861AB290D374D9A5CB61

Function 009B1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 009B179A
GetWindowRect.USER32(?,?), ref: 009B17FE
ScreenToClient.USER32(?,?), ref: 009B181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009B182C
EndPaint.USER32(?,?), ref: 009B1876

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 9e5416dd9f4e82edf50ec2ba85a7c1114a2ec60d43845eff92f2cb26dd57acb2
Instruction ID: 9a98f446e8295ffae76ed3e31e04d81f1f1060c677c58477294f8afbf2c897b9
Opcode Fuzzy Hash: 9e5416dd9f4e82edf50ec2ba85a7c1114a2ec60d43845eff92f2cb26dd57acb2
Instruction Fuzzy Hash: EB419D30900640AFD711DF65DC94FAA7BE8FB45734F144629FAA8872B2C7709C46DB62

Function 00A3B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00A757B0,00000000,011C5C00,?,?,00A757B0,?,00A3B5A8,?,?), ref: 00A3B712
EnableWindow.USER32(00000000,00000000), ref: 00A3B736
ShowWindow.USER32(00A757B0,00000000,011C5C00,?,?,00A757B0,?,00A3B5A8,?,?), ref: 00A3B796
ShowWindow.USER32(00000000,00000004,?,00A3B5A8,?,?), ref: 00A3B7A8
EnableWindow.USER32(00000000,00000001), ref: 00A3B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00A3B7EF

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: d34beae4248c7dc71624c115248db693018399193f37200c3f840cb755c98876
Instruction ID: eaeaed9d1400a9c09d73c1fbf341656d508cc80c32815df9c9dd39e05a999dca
Opcode Fuzzy Hash: d34beae4248c7dc71624c115248db693018399193f37200c3f840cb755c98876
Instruction Fuzzy Hash: 96417634612244AFDB25CF24C899B947BE2FF45310F1841B9FA4C9F6A2C731A856CB61

Function 00A2709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00A24E41,?,?,00000000,00000001), ref: 00A270AC

Part of subcall function 00A239A0: GetWindowRect.USER32(?,?), ref: 00A239B3

GetDesktopWindow.USER32 ref: 00A270D6
GetWindowRect.USER32(00000000), ref: 00A270DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00A2710F

Part of subcall function 00A15244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A152BC

GetCursorPos.USER32(?), ref: 00A2713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A27199

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: da6c4efd1f02fc5e98c1bc3ee2422edf6de3a09d844d3bd3acb0a4cd918f7258
Instruction ID: f229f873d354f7eff14cc87dc770c7f65ea11f19dac0641b872ef79e3a4fcf9b
Opcode Fuzzy Hash: da6c4efd1f02fc5e98c1bc3ee2422edf6de3a09d844d3bd3acb0a4cd918f7258
Instruction Fuzzy Hash: 0131C172509315AFD720DF58DC49E9FB7A9FF88314F000A29F58597191CB30EA19CB92

Function 00A08879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A080A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A080C0
Part of subcall function 00A080A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A080CA
Part of subcall function 00A080A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A080D9
Part of subcall function 00A080A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A080E0
Part of subcall function 00A080A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A080F6

GetLengthSid.ADVAPI32(?,00000000,00A0842F), ref: 00A088CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00A088D6
HeapAlloc.KERNEL32(00000000), ref: 00A088DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 00A088F6
GetProcessHeap.KERNEL32(00000000,00000000,00A0842F), ref: 00A0890A
HeapFree.KERNEL32(00000000), ref: 00A08911

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: cf1a5d01d173f3b89ca5d62792adbaaadd8ea428e2a94bca344d5b4a748697a2
Instruction ID: 56a2c4157d48df54c69eaf3271652ac4828ac5ed697b03b7299be78d48e678c1
Opcode Fuzzy Hash: cf1a5d01d173f3b89ca5d62792adbaaadd8ea428e2a94bca344d5b4a748697a2
Instruction Fuzzy Hash: A511AF31911209FFDB14DFE4EC0ABBE7B68EB45351F108128F88597250DB3A9905DB64

Function 00A085B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00A085E2
OpenProcessToken.ADVAPI32(00000000), ref: 00A085E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00A085F8
CloseHandle.KERNEL32(00000004), ref: 00A08603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A08632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00A08646

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 580b3239f48db08bb8bb48ddf02cd8ea4fb73e494a3448c0456e98003e5acc92
Instruction ID: 3b2689b4e465366a76ba8d1ac00951f87d7b6498a3c637047b4ed618bd8048ae
Opcode Fuzzy Hash: 580b3239f48db08bb8bb48ddf02cd8ea4fb73e494a3448c0456e98003e5acc92
Instruction Fuzzy Hash: E411477250124DAFDF11CFA8ED49BDA7BA9EB08304F044065FE04A21A0C7769E61AB60

Function 00A0B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A0B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A0B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A0B7CD
ReleaseDC.USER32(00000000,00000000), ref: 00A0B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00A0B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 00A0B7FE

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: ea0bbbd16cc78bd7f2c52fb5a07ec3c268beef131ba070105291f532c8e20352
Instruction ID: be26caa0b6ba441c770da8620fe272de6c5acb0b5fcc7644bda6441305c1f683
Opcode Fuzzy Hash: ea0bbbd16cc78bd7f2c52fb5a07ec3c268beef131ba070105291f532c8e20352
Instruction Fuzzy Hash: 10012175E01219BFEB109BE6AD45A5EBFA8EB48751F004065FA04A7291D6709C11CFA1

Function 009D0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 009D0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 009D019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 009D01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 009D01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 009D01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 009D01C1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: b5a5ea193111bb3d0c7e5a23f59a01d34eca6cf52d4aca11ef5eba43cda1d45f
Instruction ID: 6298244fd5d6ef341cce70152948bf81ba64050235b13444a0b0aae8a9485a3c
Opcode Fuzzy Hash: b5a5ea193111bb3d0c7e5a23f59a01d34eca6cf52d4aca11ef5eba43cda1d45f
Instruction Fuzzy Hash: FD0148B09017597DE3008F5A8C85A52FEA8FF19354F00411BA15847941C7B5A864CBE5

Function 00A153E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A153F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A1540F
GetWindowThreadProcessId.USER32(?,?), ref: 00A1541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A1542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A15437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A1543E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: bbcea998e3f9347a8aa7a24716b0b9cc924b168052b4c70fd59d64bbc1cbdb4a
Instruction ID: c97e2b088847f9b77b88f5036530d70f45204ce3f8a8417f8457ab65c9040b11
Opcode Fuzzy Hash: bbcea998e3f9347a8aa7a24716b0b9cc924b168052b4c70fd59d64bbc1cbdb4a
Instruction Fuzzy Hash: 16F09032A50558BFE3209BE2EC0EEEF7B7CEFC6B11F000169FA05D1060D7A01A0286B5

Function 00A17230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00A17243
EnterCriticalSection.KERNEL32(?,?,009C0EE4,?,?), ref: 00A17254
TerminateThread.KERNEL32(00000000,000001F6,?,009C0EE4,?,?), ref: 00A17261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,009C0EE4,?,?), ref: 00A1726E

Part of subcall function 00A16C35: CloseHandle.KERNEL32(00000000,?,00A1727B,?,009C0EE4,?,?), ref: 00A16C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00A17281
LeaveCriticalSection.KERNEL32(?,?,009C0EE4,?,?), ref: 00A17288

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 6ca0d5eb539b68e18392b25aaa50c320e22888b7f407a00b1c1b41b2de695e4a
Instruction ID: f66a5105b3f8d9ef02d6f9b76b98a08df795c5d7e1d7e8d687d15fbab5898984
Opcode Fuzzy Hash: 6ca0d5eb539b68e18392b25aaa50c320e22888b7f407a00b1c1b41b2de695e4a
Instruction Fuzzy Hash: C7F0BE76850212EFD7515BE4ED4CDDB3739EF08302B000231F603900A1CBB61842CB50

Function 00A08992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A0899D
UnloadUserProfile.USERENV(?,?), ref: 00A089A9
CloseHandle.KERNEL32(?), ref: 00A089B2
CloseHandle.KERNEL32(?), ref: 00A089BA
GetProcessHeap.KERNEL32(00000000,?), ref: 00A089C3
HeapFree.KERNEL32(00000000), ref: 00A089CA

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 3ded19d24a8f76d4065de216d94993a7714cc266a3ac60305332168b95e6afa4
Instruction ID: f7acd8a275b90c7c51c59e2f446261157dff0f8c5e2307aae9e6bb45ac51ad3e
Opcode Fuzzy Hash: 3ded19d24a8f76d4065de216d94993a7714cc266a3ac60305332168b95e6afa4
Instruction Fuzzy Hash: 01E0C236414001FFDA019FE2EC0CD0ABB69FB89322B108230F32985070CB329426DB50

Function 00A285ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A28613
CharUpperBuffW.USER32(?,?), ref: 00A28722
VariantClear.OLEAUT32(?), ref: 00A2889A

Part of subcall function 00A17562: VariantInit.OLEAUT32(00000000), ref: 00A175A2
Part of subcall function 00A17562: VariantCopy.OLEAUT32(00000000,?), ref: 00A175AB
Part of subcall function 00A17562: VariantClear.OLEAUT32(00000000), ref: 00A175B7

Strings

AUTOIT.ERROR, xrefs: 00A28728
Incorrect Parameter format, xrefs: 00A2864B, 00A2880D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: f189998660f50fd52fec972af168634b929591316150061bc16f497e317e8ca6
Instruction ID: 49079cf6c18cc4ac9537404aa007eac8a2ad7dbee6bc597b46200a0252f1a68d
Opcode Fuzzy Hash: f189998660f50fd52fec972af168634b929591316150061bc16f497e317e8ca6
Instruction Fuzzy Hash: 95919D706083019FC710DF28C584A9ABBF4EFC9754F14892EF99A8B361DB35E905CB92

Function 00A12A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009CFC86: _wcscpy.LIBCMT ref: 009CFCA9

_memset.LIBCMT ref: 00A12B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A12BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A12C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A12C97

Strings

0, xrefs: 00A12B73

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d64e722e19f6a5fa664b37504ff1136c5b6391c44ca3ea8416870360d35b8f15
Instruction ID: e2f22fe152a66dcaa434b38cacb2169be24620be8acf79e3a4ddfbb3704455e2
Opcode Fuzzy Hash: d64e722e19f6a5fa664b37504ff1136c5b6391c44ca3ea8416870360d35b8f15
Instruction Fuzzy Hash: 8151CE716083019FD724DF28D845BAFB7E8EF99350F044A2DF995D6290DB70CCA49792

Function 00A0D56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A0D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00A0D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00A0D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00A0D69D

Strings

DllGetClassObject, xrefs: 00A0D610

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 9b0819cb1181c0ad9bf60ce04ea965a3aab2b86c06a052ca870d552a03b1bf0d
Instruction ID: 0fb10cf456189611f6436282fae3720ae3974d42be764fd69fcc397ed7f71e76
Opcode Fuzzy Hash: 9b0819cb1181c0ad9bf60ce04ea965a3aab2b86c06a052ca870d552a03b1bf0d
Instruction Fuzzy Hash: CC4182B2610208EFDF05CF94D884A9ABBB9EF44314F1581A9FD099F245D7B2DD44DBA0

Function 00A12753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A127C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A127DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00A12822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00A75890,00000000), ref: 00A1286B

Strings

0, xrefs: 00A127B5

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 6d3dec1dc3b758d8ac47fd17b9a8f83266b28719db3ed76051ca75ab0c609e51
Instruction ID: c1cf08a39beb085deb2f4ac4932b957c1c8a3cdb84bb5e5b12ecf541bcece0f6
Opcode Fuzzy Hash: 6d3dec1dc3b758d8ac47fd17b9a8f83266b28719db3ed76051ca75ab0c609e51
Instruction Fuzzy Hash: 0F41BE716043419FDB24DF24CC84BAABBE9EF85324F144A2DF8A5972D1D730E855CB62

Function 00A2D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00A2D7C5

Part of subcall function 009B784B: _memmove.LIBCMT ref: 009B7899

Strings

none, xrefs: 00A2D8A0
stdcall, xrefs: 00A2D847
winapi, xrefs: 00A2D836
cdecl, xrefs: 00A2D81C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 6d72377548f86d80796807105db40034527d5f3ad016d2e46d153bc1007415f1
Instruction ID: 07fb8f6489d0324bd58348c5ee85944f5a5380238a95bedc5e4bc687d3e2f322
Opcode Fuzzy Hash: 6d72377548f86d80796807105db40034527d5f3ad016d2e46d153bc1007415f1
Instruction Fuzzy Hash: 0831A371904615ABCF00EF98CD51AEEB7B5FF84720F10862AE825977D2DB31A905CB80

Function 00A08E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 00A0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00A0AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00A08F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00A08F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00A08F57

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

Strings

ComboBox, xrefs: 00A08E9E
ListBox, xrefs: 00A08ED3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 2586c8914bf5fd6fa7418b1909b081f3a9eaa31db103f3319f2e6d6fd58e9fcc
Instruction ID: 308289ffb7178365fcccf3f72b1257af0a60aeda0a27c46afa4b0150affcd817
Opcode Fuzzy Hash: 2586c8914bf5fd6fa7418b1909b081f3a9eaa31db103f3319f2e6d6fd58e9fcc
Instruction Fuzzy Hash: E121F271A00109BFDB14ABB0DC86EFFB779DF85360F048619F461972E0DB3948099610

Function 00A2182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A2184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A21872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A218A2
InternetCloseHandle.WININET(00000000), ref: 00A218E9

Part of subcall function 00A22483: GetLastError.KERNEL32(?,?,00A21817,00000000,00000000,00000001), ref: 00A22498
Part of subcall function 00A22483: SetEvent.KERNEL32(?,?,00A21817,00000000,00000000,00000001), ref: 00A224AD

Strings

, xrefs: 00A21893

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: f0f9c95d421c4adf4bd5777b6615ff4b2a1bdf6077cfa89a2fb83eea27171966
Instruction ID: baf1aac3c890791eab3f548ae1550f6a3483f4a38eb4b461ebd712011cf81400
Opcode Fuzzy Hash: f0f9c95d421c4adf4bd5777b6615ff4b2a1bdf6077cfa89a2fb83eea27171966
Instruction Fuzzy Hash: 27218EB1500318BFEB119F68ECC5EBB77EDEB59744F10413AF805A6240EA259D0597A1

Function 00A363E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009B1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009B1D73
Part of subcall function 009B1D35: GetStockObject.GDI32(00000011), ref: 009B1D87
Part of subcall function 009B1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009B1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A36461
LoadLibraryW.KERNEL32(?), ref: 00A36468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A3647D
DestroyWindow.USER32(?), ref: 00A36485

Strings

SysAnimate32, xrefs: 00A3643C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 7f92b13579a7e888e64257821d22ed28ba0c135aa68a3f1654ce5a0f8559c209
Instruction ID: c6fa197ac60f59732f81ed827757eb164d6dd71b8b3982c2959ccd3afc624297
Opcode Fuzzy Hash: 7f92b13579a7e888e64257821d22ed28ba0c135aa68a3f1654ce5a0f8559c209
Instruction Fuzzy Hash: 8A219D71A10205BFEF108FA4EE80EBB77ADEF59324F10C629FA2096090D771DC819760

Function 00A16D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00A16DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A16DEF
GetStdHandle.KERNEL32(0000000C), ref: 00A16E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00A16E3B

Strings

nul, xrefs: 00A16E36

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 4ab5828702effaece8e41692f8b58f0f829399becfb7f423be2282cc498ef873
Instruction ID: 9b4d19deee161e66b64fce95d0d4fdd03aeda9ec009b84dd261a7212272ca2ea
Opcode Fuzzy Hash: 4ab5828702effaece8e41692f8b58f0f829399becfb7f423be2282cc498ef873
Instruction Fuzzy Hash: 10219D74A00209AFDB209F69EC05ADA7BF8EF54760F204A29FDA0D72D0DB709991CB50

Function 00A16E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A16E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A16EBB
GetStdHandle.KERNEL32(000000F6), ref: 00A16ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00A16F06

Strings

nul, xrefs: 00A16F01

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: cad3428dc03f52eb9ce048a6c423fb2d8e9ff94f904997908cb738eb61320393
Instruction ID: 5bd855240d0f53c0bf7a02d6e8c398e4dda89eeab12fcc45618436e366b6df4b
Opcode Fuzzy Hash: cad3428dc03f52eb9ce048a6c423fb2d8e9ff94f904997908cb738eb61320393
Instruction Fuzzy Hash: 78217F79600316AFDB209FA9DC04AEA77B9EF55720F200B19FDA1D72D0DB70A891CB50

Function 00A1AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A1AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A1ACA8
__swprintf.LIBCMT ref: 00A1ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,00A3F910), ref: 00A1ACFF

Strings

%lu, xrefs: 00A1ACBB

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: dba37c7903f4b575750aeb14096a4ed7bce9c94c61ea7b9cfd3dd617d9e438fe
Instruction ID: b56d2873d5fa7d732a1b0031890b0378d6c4979cdb270ca91c291461bc6cb745
Opcode Fuzzy Hash: dba37c7903f4b575750aeb14096a4ed7bce9c94c61ea7b9cfd3dd617d9e438fe
Instruction Fuzzy Hash: 7E214131A00109AFCB10DFA9DD45EEEBBB8FF89714B004469F9099B251DA31EA41DB61

Function 00A11AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A11B19

Strings

APPEND, xrefs: 00A11B52
KEYS, xrefs: 00A11B30
REMOVE, xrefs: 00A11B1F
EXISTS, xrefs: 00A11B41

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 200e7ac2b1c67cf74e02e9028c682b35c0f07716de267b31b2ead42c161134f3
Instruction ID: 560b868c0c2c3a8b8e3a1e95c065ae2d6c4d7d239c1940d7d98d6a7c44650ae1
Opcode Fuzzy Hash: 200e7ac2b1c67cf74e02e9028c682b35c0f07716de267b31b2ead42c161134f3
Instruction Fuzzy Hash: 69115E309541088FCF00EF94D855AEEB7B4FFA5704F548569D91567291EB325D06CB50

Function 00A2EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A2EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A2EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00A2ED6A
CloseHandle.KERNEL32(?), ref: 00A2EDEB

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 378461a9e7b3f7da14768ff492c1b8fb0495342e34f93e3fd13b86ca301af9db
Instruction ID: 926d1f5a73a52e4441aff01532d60b7553c49804742ba2cb066805fa4d30f69d
Opcode Fuzzy Hash: 378461a9e7b3f7da14768ff492c1b8fb0495342e34f93e3fd13b86ca301af9db
Instruction Fuzzy Hash: AA8182716043109FD720EF28D986F6AB7E5AF89720F14882DFA99DB2D2D770AC41CB51

Function 00A30037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 00A30E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A2FDAD,?,?), ref: 00A30E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A300FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A3013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A30183
RegCloseKey.ADVAPI32(?,?), ref: 00A301AF
RegCloseKey.ADVAPI32(00000000), ref: 00A301BC

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 888b6118d88a45ae2f399b5fcdeced1e2ac5f13387d7386c093f9a42f6e2f1b8
Instruction ID: b24af9b2dcf063b2b443c10d8c04fa34d248379d316a9db4a82d6864d366c90d
Opcode Fuzzy Hash: 888b6118d88a45ae2f399b5fcdeced1e2ac5f13387d7386c093f9a42f6e2f1b8
Instruction Fuzzy Hash: 24515931218204AFCB14EF68DD91FAAB7E9FF84314F44492DF595872A2DB31E905CB52

Function 00A2D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00A2D927
GetProcAddress.KERNEL32(00000000,?), ref: 00A2D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00A2D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 00A2DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00A2DA21

Part of subcall function 009B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A17896,?,?,00000000), ref: 009B5A2C
Part of subcall function 009B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A17896,?,?,00000000,?,?), ref: 009B5A50

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: b8c2a20f124ec3d6bf77d92963accb188e2581825b5c2ff2111044a5bbb844c7
Instruction ID: 28e4e78f6f9ccd6aa46b24e38bfd3f27dbc3173ba0a2979c0cb7c9c35b5d72ea
Opcode Fuzzy Hash: b8c2a20f124ec3d6bf77d92963accb188e2581825b5c2ff2111044a5bbb844c7
Instruction Fuzzy Hash: 52512635A04219DFCB00EFA8D584AADB7B5FF49320B058169F955AB322D730ED45CF90

Function 00A1E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A1E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00A1E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A1E687

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A1E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A1E6B4

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 486becca1b73b7f51d9cdb09005e1bc385844f100c9fcb83c065d282dc65a68c
Instruction ID: be83f70a47163113a1a9a29cdd4ff52014e85425c7e71ec51093bbe450b01b29
Opcode Fuzzy Hash: 486becca1b73b7f51d9cdb09005e1bc385844f100c9fcb83c065d282dc65a68c
Instruction Fuzzy Hash: 4551E935A10205DFCB01EFA4C981AAEBBF5EF49314F1480A9F959AB362CB31ED51DB50

Function 00A3A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7331a2bb659f3bdf2c70836180e59e1006b23db1215e760238fdad963bfc1792
Instruction ID: 0e814bc115732abffb668d38128e2dac9c9ae8fbd22a518a65eed10c67ab7dab
Opcode Fuzzy Hash: 7331a2bb659f3bdf2c70836180e59e1006b23db1215e760238fdad963bfc1792
Instruction Fuzzy Hash: 4E41F735D04224AFDB14DF78CC49FA9BBB8EB29310F144265F896A72E1C7709D41DA51

Function 009B2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009B2357
ScreenToClient.USER32(00A757B0,?), ref: 009B2374
GetAsyncKeyState.USER32(00000001), ref: 009B2399
GetAsyncKeyState.USER32(00000002), ref: 009B23A7

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 5a9d2880c81827731c0cb742f10fd022d16492b21efc212818c92130b85505b5
Instruction ID: 2eedcf8fef31696edbb82112bb105065bd3fa0a5dfb0dc7af6ce200e6e976f66
Opcode Fuzzy Hash: 5a9d2880c81827731c0cb742f10fd022d16492b21efc212818c92130b85505b5
Instruction Fuzzy Hash: 70418175A04105FFCF169F69CD44AE9BBB8FB05770F20431AF869962A0C7349D91DB90

Function 00A063AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A063E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00A06433
TranslateMessage.USER32(?), ref: 00A0645C
DispatchMessageW.USER32(?), ref: 00A06466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A06475

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: e4dad24bb519a2ee7847dc127767528e5b749c94aef552010f35ba51d5a0a1c5
Instruction ID: 3a5582244fa64e978e400e1376e4a671b91350b4efc86a3c1e54b0491f0593fc
Opcode Fuzzy Hash: e4dad24bb519a2ee7847dc127767528e5b749c94aef552010f35ba51d5a0a1c5
Instruction Fuzzy Hash: AF31F831E0064AAFDB24CFF0ED44BF67BBCAB01318F144165F425C60E1E76694AAD7A1

Function 00A08A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A08A30
PostMessageW.USER32(?,00000201,00000001), ref: 00A08ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00A08AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00A08AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00A08AF8

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a698a3fa98af3c36925d3c745321c511d22891131d9feb74fde2138fe3e7aa83
Instruction ID: 3b31eb6c49cad3778ea20749ea3e3d50ed4e9264594a45ce6f7696867eed3ef5
Opcode Fuzzy Hash: a698a3fa98af3c36925d3c745321c511d22891131d9feb74fde2138fe3e7aa83
Instruction Fuzzy Hash: 4B31E071A0021DEFDF14CFA8ED4DA9E3BB5EB04315F11822AF965E61D0C7B49914CB90

Function 00A0B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00A0B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A0B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00A0B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00A0B27F
_wcsstr.LIBCMT ref: 00A0B289

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 94c1a31b4aa02457e30d27d694cf58d82256220cff6f7d3999391c52d55499fd
Instruction ID: 4f241eb51a8459bc91659d694a417a06cb95eee01c9d2575b5008cc02b79b7bc
Opcode Fuzzy Hash: 94c1a31b4aa02457e30d27d694cf58d82256220cff6f7d3999391c52d55499fd
Instruction Fuzzy Hash: 1C210731654244BBEB159B75AD49FBF7BA8DF89710F00813AF808DA1E1EF61DC419270

Function 00A3B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

GetWindowLongW.USER32(?,000000F0), ref: 00A3B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00A3B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A3B1CF
GetSystemMetrics.USER32(00000004), ref: 00A3B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00A20E90,00000000), ref: 00A3B216

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: c5b5bfcd83f744f511d9012431392d245db53053d3081d3161516c00357e32a4
Instruction ID: f678f84e6e61309e56d61479eed019b4d74a30789a50d983bd9545264223ccbb
Opcode Fuzzy Hash: c5b5bfcd83f744f511d9012431392d245db53053d3081d3161516c00357e32a4
Instruction Fuzzy Hash: F2219F71A20655EFCB109FB89C04AAA7BA5FB05321F114728FA36D71E0E73098519BA0

Function 00A09307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A09320

Part of subcall function 009B7BCC: _memmove.LIBCMT ref: 009B7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A09352
__itow.LIBCMT ref: 00A0936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A09392
__itow.LIBCMT ref: 00A093A3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: c78247dcb759ee7f7c6229d51d37ce5ff86d7940c45bfd5dbe3ff330197b9805
Instruction ID: 6b10f20704c52e1f89c6da9677a9155c4f0306f768067b03b3744bb4066b8669
Opcode Fuzzy Hash: c78247dcb759ee7f7c6229d51d37ce5ff86d7940c45bfd5dbe3ff330197b9805
Instruction Fuzzy Hash: D6219831B0120C7BDB109BA5AD86EEF7BB9EB89710F044029F945DB2D2D670CD459B92

Function 00A25A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00A25A6E
GetForegroundWindow.USER32 ref: 00A25A85
GetDC.USER32(00000000), ref: 00A25AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00A25ACD
ReleaseDC.USER32(00000000,00000003), ref: 00A25B08

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 7b40777bf7e92c9b8377eda24c46116da910e5eb6ccb13b8ddf5384a8e755ef9
Instruction ID: 20660688fb882a7be0c21a58a93aa549515c074803f406440a50eb3fda0cc7c0
Opcode Fuzzy Hash: 7b40777bf7e92c9b8377eda24c46116da910e5eb6ccb13b8ddf5384a8e755ef9
Instruction Fuzzy Hash: FE21A135A00114AFDB04EFA9ED89A9ABBF5EF48350F148079F90997362CB30AC41CB90

Function 009B12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009B134D
SelectObject.GDI32(?,00000000), ref: 009B135C
BeginPath.GDI32(?), ref: 009B1373
SelectObject.GDI32(?,00000000), ref: 009B139C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: f468ca3bbd4930fbb8913966aac7a21d33ec268b838366ff9561e5574e545a9a
Instruction ID: 1ce2ed0b553c0b1468084cd3a12a8f281e3f10cbd06d0461bf0283d3c935e2cd
Opcode Fuzzy Hash: f468ca3bbd4930fbb8913966aac7a21d33ec268b838366ff9561e5574e545a9a
Instruction Fuzzy Hash: 99216230C10608EFDB11CFA5EE547A97BE8FB00721F588626F414961B1E3B19992EF51

Function 00A0BC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00A0BCB3
_memcmp.LIBCMT ref: 00A0BCD1
_memcmp.LIBCMT ref: 00A0BCE4
_memcmp.LIBCMT ref: 00A0BCFC
_memcmp.LIBCMT ref: 00A0BD14

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 83a81de0107131f4291db6d1c0c66da8f59a1e3e5e022bbe1e3c9638a5d6fde3
Instruction ID: cf7eeda1a01c7155e8fbafa293795c4fded65be6add286f898934149c3f07c2f
Opcode Fuzzy Hash: 83a81de0107131f4291db6d1c0c66da8f59a1e3e5e022bbe1e3c9638a5d6fde3
Instruction Fuzzy Hash: 5501757265110D7BE6046B117E82FFBB76CEFA9398F088426FD0596383EB51DE1182B1

Function 00A14A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A14ABA
__beginthreadex.LIBCMT ref: 00A14AD8
MessageBoxW.USER32(?,?,?,?), ref: 00A14AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A14B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A14B0A

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: c1dd7620c496a0438cb30ae7dc4e7c5101ef5a5d440e4a98fb2d2b61353ba112
Instruction ID: 0f974f4fdc6baa8efad7238d1373780ed526d209704997e34ea4bc5da33a5728
Opcode Fuzzy Hash: c1dd7620c496a0438cb30ae7dc4e7c5101ef5a5d440e4a98fb2d2b61353ba112
Instruction Fuzzy Hash: 5D11E576D08244BFD700DBFCAC08ADA7BACAB49321F148269F918D3251E6B1898587E0

Function 00A08202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A0821E
GetLastError.KERNEL32(?,00A07CE2,?,?,?), ref: 00A08228
GetProcessHeap.KERNEL32(00000008,?,?,00A07CE2,?,?,?), ref: 00A08237
HeapAlloc.KERNEL32(00000000,?,00A07CE2,?,?,?), ref: 00A0823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A08255

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 22ad8c80a4c62fe547cc94858c24450828e9e90774fa74ffaede16e8c44203c3
Instruction ID: c418af56c9a3607744f751d14b37d485d02a4401ca2e56d6bdd48369106bba98
Opcode Fuzzy Hash: 22ad8c80a4c62fe547cc94858c24450828e9e90774fa74ffaede16e8c44203c3
Instruction Fuzzy Hash: C2018171A10208FFDB208FA6EC49DAB7FACEF8A754B500529F959C3260DB318C11DA60

Function 00A0710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?,?,?,00A07455), ref: 00A07127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?,?), ref: 00A07142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?,?), ref: 00A07150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?), ref: 00A07160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00A07044,80070057,?,?), ref: 00A0716C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 5c96cbe1c78862a49e6e09e17de349a4c3d19c8eacbb05b19ec9f1cbff7914e2
Instruction ID: 876da80cf0bf1d863c61605a5224e9d6aead38b9427bc1003037861cd4ac7dad
Opcode Fuzzy Hash: 5c96cbe1c78862a49e6e09e17de349a4c3d19c8eacbb05b19ec9f1cbff7914e2
Instruction Fuzzy Hash: 16017C76E11208BFDB118FA4EC84AAE7BBDEB44791F140265FD04D22A0D731ED42DBA0

Function 00A15244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A15260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00A1526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A15276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00A15280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A152BC

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 96d92d03ffd3456f9c824b963d27d84a676484b809ae879004a42610d240fa39
Instruction ID: 7db205965ab244642d6aeffb3462dcf6c34b5f728c5019d67a4e2e5dd64f7056
Opcode Fuzzy Hash: 96d92d03ffd3456f9c824b963d27d84a676484b809ae879004a42610d240fa39
Instruction Fuzzy Hash: 9B011732D11A19DBCF00EFF5ED49AEEBB78BB49711F400156EA45B2140CB30599587A1

Function 00A0810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A08121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A0812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A0813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A08141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A08157

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a8c85b9971eaae48837adba2f809c4cf2b990c7b8e0402bfd2001b42f46e5840
Instruction ID: 75b2582a4e540acef0889f2271b766ee589bbdef0fef9fd3614218e7c3cb19af
Opcode Fuzzy Hash: a8c85b9971eaae48837adba2f809c4cf2b990c7b8e0402bfd2001b42f46e5840
Instruction Fuzzy Hash: 1CF06271610308BFEB114FA5FC88E673BACFF4A754B000135FA85C61A0DB65DD56DA64

Function 00A0C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00A0C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 00A0C20E
MessageBeep.USER32(00000000), ref: 00A0C226
KillTimer.USER32(?,0000040A), ref: 00A0C242
EndDialog.USER32(?,00000001), ref: 00A0C25C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 25edd5c58071fa00f60d665b10c91b64d255db0759e6d63e9fcf1b356c73458b
Instruction ID: 16ef2ab359586fc48fa5ff0ef4c5ed05d3d4aab0224545d6ecbfa9492bb20f65
Opcode Fuzzy Hash: 25edd5c58071fa00f60d665b10c91b64d255db0759e6d63e9fcf1b356c73458b
Instruction Fuzzy Hash: 2C01D630814708ABEB20ABA0ED4EFD677B8FF04B16F000369F542A18F0DBF469458B90

Function 009B13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009B13BF
StrokeAndFillPath.GDI32(?,?,009EB888,00000000,?), ref: 009B13DB
SelectObject.GDI32(?,00000000), ref: 009B13EE
DeleteObject.GDI32 ref: 009B1401
StrokePath.GDI32(?), ref: 009B141C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 87aef69308c20a6cef7b859ab9dbea24e1743269363ea9e26bed6e752b00b188
Instruction ID: 077d8850f9a5f9a7ee6ae095424afbfe4435b60abc87cf91584444c902509564
Opcode Fuzzy Hash: 87aef69308c20a6cef7b859ab9dbea24e1743269363ea9e26bed6e752b00b188
Instruction Fuzzy Hash: 34F0FB30804A08DFDB159FAAED587983FA9EB01326F48C224F429480B2D77045A6EF11

Function 00A1C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A1C432
CoCreateInstance.OLE32(00A42D6C,00000000,00000001,00A42BDC,?), ref: 00A1C44A

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

CoUninitialize.OLE32 ref: 00A1C6B7

Strings

.lnk, xrefs: 00A1C3C6, 00A1C3EE, 00A1C3F8

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: e3ac2aac84d9307ddcc12a37cbf5ec2950dd6096905ee49b09aa6cc92d530d0c
Instruction ID: a49847a903aaea5d3e5cad6880d90831518cf8e503742b8886fe77ee8ff95ef1
Opcode Fuzzy Hash: e3ac2aac84d9307ddcc12a37cbf5ec2950dd6096905ee49b09aa6cc92d530d0c
Instruction Fuzzy Hash: FBA13871114205AFD700EF64C981EABB7ECEFC9764F004A2CF1559B1A2EB71EA49CB52

Function 009C2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 009D0DB6: std::exception::exception.LIBCMT ref: 009D0DEC
Part of subcall function 009D0DB6: __CxxThrowException@8.LIBCMT ref: 009D0E01

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 009B7A51: _memmove.LIBCMT ref: 009B7AAB

__swprintf.LIBCMT ref: 009C2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 009C2D66

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 3a3ebe1c9bb03fa9750b794498487addc65a8cda7080059d9e29090edc9368a0
Instruction ID: 312e4d4c8a459371b683a006e92682646ce58663846d6f51fc3047a379d76111
Opcode Fuzzy Hash: 3a3ebe1c9bb03fa9750b794498487addc65a8cda7080059d9e29090edc9368a0
Instruction Fuzzy Hash: 179138715083059FD714EF68C985EBEB7B8EFC5720F00491EF5969B2A1EA20ED44CB62

Function 00A1B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 009B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009B4743,?,?,009B37AE,?), ref: 009B4770

CoInitialize.OLE32(00000000), ref: 00A1B9BB
CoCreateInstance.OLE32(00A42D6C,00000000,00000001,00A42BDC,?), ref: 00A1B9D4
CoUninitialize.OLE32 ref: 00A1B9F1

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

Strings

.lnk, xrefs: 00A1B99D, 00A1B9AB

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 482120506595ce39a98387ce320a99534ed69634b55b7d3e63901fa63ea7dfd8
Instruction ID: e4a51bd278864a508baf3108ebe882d885e9e9a5fa898ba22503f1204d05ce6f
Opcode Fuzzy Hash: 482120506595ce39a98387ce320a99534ed69634b55b7d3e63901fa63ea7dfd8
Instruction Fuzzy Hash: ABA136756182059FCB00DF14C984E9ABBE5FF89324F148998F9999B3A1CB31EC46CB91

Function 009D501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 009D50AD

Part of subcall function 009E00F0: __87except.LIBCMT ref: 009E012B

Strings

pow, xrefs: 009D5085, 009D50A2

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 3802bc2c5306a1309b110eab6f608093c2bd238b8495144b6660af927d7a7bde
Instruction ID: e697a494e1b6ae2621458eb983a7620dbf7a104044f2a607c9bf22099bff0078
Opcode Fuzzy Hash: 3802bc2c5306a1309b110eab6f608093c2bd238b8495144b6660af927d7a7bde
Instruction Fuzzy Hash: 0F51CE6494C64286DB12BB65CC4137E2BD89BC1300F24CD5AE0D98A3ADDFB8CDC59BC2

Function 009C6192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009C6248
_memmove.LIBCMT ref: 009C62E4
_memset.LIBCMT ref: 009C6308

Strings

ERCP, xrefs: 009C61B3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: f007d408edb0312b491c500e4c20bd7df591881fbffd31b1a78e171a5e7b88b2
Instruction ID: 2983abb7b34ba7e3d776dde46257b9e3c4d798592d42f97517434cbeff76a47e
Opcode Fuzzy Hash: f007d408edb0312b491c500e4c20bd7df591881fbffd31b1a78e171a5e7b88b2
Instruction Fuzzy Hash: A2517E71900709DBDB24CF65C981BABB7F8AF44314F20856EE55ACB291E770EA44CB51

Function 00A097F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A114BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A09296,?,?,00000034,00000800,?,00000034), ref: 00A114E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00A0983F

Part of subcall function 00A11487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A092C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00A114B1

Part of subcall function 00A113DE: GetWindowThreadProcessId.USER32(?,?), ref: 00A11409
Part of subcall function 00A113DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00A0925A,00000034,?,?,00001004,00000000,00000000), ref: 00A11419
Part of subcall function 00A113DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00A0925A,00000034,?,?,00001004,00000000,00000000), ref: 00A1142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A098AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A098F9

Strings

@, xrefs: 00A09911

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 01e2c8af5dd9de67e69944c11cfa0f7bbc12e1f62ee3d768b54003736f33a738
Instruction ID: 5834606050893b9b0aaee38b1c69791ef6474d5b7004b134a19b0ebe4815c2f4
Opcode Fuzzy Hash: 01e2c8af5dd9de67e69944c11cfa0f7bbc12e1f62ee3d768b54003736f33a738
Instruction Fuzzy Hash: 1E415E7690121CBFCB10DFA4CD82ADEBBB8EB09700F004099FA55B7191DA706E85CBA1

Function 00A37946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00A3F910,00000000,?,?,?,?), ref: 00A379DF
GetWindowLongW.USER32 ref: 00A379FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A37A0C

Strings

SysTreeView32, xrefs: 00A379B1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 968e37cedb739eb992a48c327ca1d22649196d9d81f5ed31b237c5167a213dce
Instruction ID: 53ae3d25abd37661b01921f7801476f12ed6f3781c5b36c4264ba6602cc334a7
Opcode Fuzzy Hash: 968e37cedb739eb992a48c327ca1d22649196d9d81f5ed31b237c5167a213dce
Instruction Fuzzy Hash: 1F31BC71604206AFDB618F78DC41BEA77A9EB49374F208725F879A32E0D731E9518B50

Function 00A373D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00A37461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00A37475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A37499

Strings

SysMonthCal32, xrefs: 00A3742C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 9428bc00fd755dbd183ea7903766825c654dded1c13d5de2f3b2c2f99cc9e806
Instruction ID: 0ec29d95b066bb5bc9b2a639f9a8c0fcec15a9c82097ced810c3a9d8367ec1bb
Opcode Fuzzy Hash: 9428bc00fd755dbd183ea7903766825c654dded1c13d5de2f3b2c2f99cc9e806
Instruction Fuzzy Hash: 8D218D72510218ABDF21CFA4CC46FEE3B6AEB48724F110214FA556B190DAB5A8919BA0

Function 00A37B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00A37C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00A37C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00A37C5F

Strings

msctls_updown32, xrefs: 00A37BC4

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 119eb3dcd689aca1f18157f8c22b296ba486f9173f287966ca2072aa3f600e99
Instruction ID: 41efbf53d8c558d0d2e2334996a008390ea2427d6abb0701051ad0680093e790
Opcode Fuzzy Hash: 119eb3dcd689aca1f18157f8c22b296ba486f9173f287966ca2072aa3f600e99
Instruction Fuzzy Hash: F5218EB1A04208AFDB20DF64DCC1DAB37EDEF5A364B144459FA059B3A1CB71EC418AA0

Function 00A36CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00A36D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00A36D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00A36D70

Strings

Listbox, xrefs: 00A36D08

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 135db567b3a525a9fe152ad88c697841ced9d2c87fad472093fa13b3f08b54fb
Instruction ID: 91a87414384b01c9fab1a7b0150665c20e44a0d1d4ba0b3010fa2fafef7ac477
Opcode Fuzzy Hash: 135db567b3a525a9fe152ad88c697841ced9d2c87fad472093fa13b3f08b54fb
Instruction Fuzzy Hash: E9219232610118BFDF118F54DC45FEB3BBAEF89760F01C128FA459B1A0C6719C5287A0

Function 00A3770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00A37772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00A37787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00A37794

Strings

msctls_trackbar32, xrefs: 00A37749

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: f22b32f52a0065d3fa79ba48e761e0122be18092d0160c5741d4506418ca081d
Instruction ID: f9e5993a664bb912ac483938c53649c1967048b569957f81df37378cd2ab0bc2
Opcode Fuzzy Hash: f22b32f52a0065d3fa79ba48e761e0122be18092d0160c5741d4506418ca081d
Instruction Fuzzy Hash: 85112372610208BEEF209F60CC01FEB37A9EF89B64F014528FA41A2090C272E811CB20

Function 009B4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009B4BD0,?,009B4DEF,?,00A752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009B4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009B4C23

Strings

Wow64DisableWow64FsRedirection, xrefs: 009B4C1D
kernel32.dll, xrefs: 009B4C0C

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 2c492e1fde8bb365fadf64ced37f02bb241ccc5b9cb733b20ce4e150a8ca9aba
Instruction ID: 5226ff2895538fc07a2e1c49fae3fb0081dc4cff5777c6fa43c95054c3a600be
Opcode Fuzzy Hash: 2c492e1fde8bb365fadf64ced37f02bb241ccc5b9cb733b20ce4e150a8ca9aba
Instruction Fuzzy Hash: 9FD01270921713DFDB209FB1DD08687BAE9EF09751F118C3AA4C6D6161E6B0D481C650

Function 009B4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009B4B83,?), ref: 009B4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009B4C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 009B4C50
kernel32.dll, xrefs: 009B4C3F

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 5778694a915497e717c18fcc8c7620661c9d00c100bb0c39226d2b50c65d5689
Instruction ID: 0bec1bd9ff9b79d345e2f066bd0eb120c3d821cdb6c4fe9fddf904853c3ef9fb
Opcode Fuzzy Hash: 5778694a915497e717c18fcc8c7620661c9d00c100bb0c39226d2b50c65d5689
Instruction Fuzzy Hash: DFD01770920713DFDB209F71EE0968ABBE8AF05761F118C3AA9D6D61A1E670D880CA50

Function 00A30DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00A31039), ref: 00A30DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A30E07

Strings

advapi32.dll, xrefs: 00A30DF0
RegDeleteKeyExW, xrefs: 00A30E01

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 196aab59c4a926d435debc60705bcc83f1b1a16b72577bc4e71f5459c91c39cf
Instruction ID: e624a6f2c99f6e8516e0d5b42476a688fb5d0b7084103156fce35d82e9d42a9e
Opcode Fuzzy Hash: 196aab59c4a926d435debc60705bcc83f1b1a16b72577bc4e71f5459c91c39cf
Instruction Fuzzy Hash: D6D01770A20723DFD7209FB6DC18A8776E9AF15352F218C3EA586D2160E6B4D890CA51

Function 00A290E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00A28CF4,?,00A3F910), ref: 00A290EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00A29100

Strings

kernel32.dll, xrefs: 00A290E9
GetModuleHandleExW, xrefs: 00A290FA

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: ddc3821e6cc4f6da197245b91ad7afbc8e5b4d7ba099574fc228c7bdfae270fe
Instruction ID: 8d031264e5fa1721d249d2b08c5ac6011e0d93a78fcc0e7fd57ce1c7b1487491
Opcode Fuzzy Hash: ddc3821e6cc4f6da197245b91ad7afbc8e5b4d7ba099574fc228c7bdfae270fe
Instruction Fuzzy Hash: 8AD0C230960323DFCB20CF75EC0850372E4AF11741F018D3AA881C2550E670C480C690

Function 009F1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 009F1718
__swprintf.LIBCMT ref: 009F1749

Strings

WIN_XPe, xrefs: 009F1788
%.3d, xrefs: 009F1723

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 21e4dd3afcefc5b42fe6d3c1f1c53f73264979d0f83003ac5654a67a8b963765
Instruction ID: 141253be9735512345121a3e8725e5f86d648c9ba9947934acd72954b2e3d20c
Opcode Fuzzy Hash: 21e4dd3afcefc5b42fe6d3c1f1c53f73264979d0f83003ac5654a67a8b963765
Instruction Fuzzy Hash: EBD0127184410DFBC700AA909D89CFA73BCA719311F600D52B61AD2040E23A9754D761

Function 00A0717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f24dd0cc521f2c295c8b4f0e59f633b7422e73c118f5f8971824926781a89b1
Instruction ID: 380b66e3560a687237aab40ef987da1b2df782b66d82d46f16e48370f23e8d60
Opcode Fuzzy Hash: 9f24dd0cc521f2c295c8b4f0e59f633b7422e73c118f5f8971824926781a89b1
Instruction Fuzzy Hash: 50C17F74E0421AEFDB14CFA8D884EAEBBB5FF48704B148598E805DB291D731ED81DB90

Function 00A2E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00A2E0BE
CharLowerBuffW.USER32(?,?), ref: 00A2E101

Part of subcall function 00A2D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00A2D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00A2E301
_memmove.LIBCMT ref: 00A2E314

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: a2d6a4ffbafe9d7461b96b65cd43a4f40e808e91e425e46df3d4f9dee58e4a42
Instruction ID: 589b37b8e2b28885983b91d4b46e2d82b71f500168ad758b49c84cb6e6e82dc8
Opcode Fuzzy Hash: a2d6a4ffbafe9d7461b96b65cd43a4f40e808e91e425e46df3d4f9dee58e4a42
Instruction Fuzzy Hash: 26C13871608311DFC714DF28C580A6ABBE4FF89724F14896EF89A9B351D731E946CB82

Function 00A28093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A280C3
CoUninitialize.OLE32 ref: 00A280CE

Part of subcall function 00A0D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A0D5D4

VariantInit.OLEAUT32(?), ref: 00A280D9
VariantClear.OLEAUT32(?), ref: 00A283AA

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: d2c56d4c7c72e500bc060565cbcd3c1a2f7bd63c0609753aa5e1ca22a703463b
Instruction ID: a5a215ed3ecac58655c7a56ae1f4db9372dcd1cd021d579637c9d55f2a67d113
Opcode Fuzzy Hash: d2c56d4c7c72e500bc060565cbcd3c1a2f7bd63c0609753aa5e1ca22a703463b
Instruction Fuzzy Hash: 43A169356147119FDB00DF68D981B6AB7F4BF89764F048418FA969B3A1CB34EC05CB82

Function 00A07530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A42C7C,?), ref: 00A076EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A42C7C,?), ref: 00A07702
CLSIDFromProgID.OLE32(?,?,00000000,00A3FB80,000000FF,?,00000000,00000800,00000000,?,00A42C7C,?), ref: 00A07727
_memcmp.LIBCMT ref: 00A07748

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: a172ecbfcca94df09b4f61ddd2af4f3d1d57e27ab059b98e33717c494d2daad4
Instruction ID: aa4093fea93b3633e4e1827d7890eb28f09de9ad89c517a725a28cf788abcbe9
Opcode Fuzzy Hash: a172ecbfcca94df09b4f61ddd2af4f3d1d57e27ab059b98e33717c494d2daad4
Instruction Fuzzy Hash: 1B81D975E00109EFCB04DFA4D984EEEB7B9FF89315F204559E506AB290DB71AE06CB60

Function 00A0687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A0688E
SysAllocString.OLEAUT32(00000000), ref: 00A06937
VariantCopy.OLEAUT32 ref: 00A06966
VariantClear.OLEAUT32(?), ref: 00A0698D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 5b5d493a06c65d9c43a2897cd96babe42c9805465c1f067f3ebac3eb9cab7a6e
Instruction ID: cf97fecf428c206ff7b762e3579b40a5d7d0fc336add2149100919ca2068d1bc
Opcode Fuzzy Hash: 5b5d493a06c65d9c43a2897cd96babe42c9805465c1f067f3ebac3eb9cab7a6e
Instruction Fuzzy Hash: E751CF7471030A9EDB24EF65E891B6AB3F5AF45358F20D81FE596EB2D1DB30D8A08700

Function 00A397F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(011CEA90,?), ref: 00A39863
ScreenToClient.USER32(00000002,00000002), ref: 00A39896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00A39903

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 550041744d892283ddad387b8ccd8187f07f25cbff95b6fb7a8db2db1e6b8764
Instruction ID: 6786576039ee96d288887632bf092480bf691b939922422a80def44fbfd90aa8
Opcode Fuzzy Hash: 550041744d892283ddad387b8ccd8187f07f25cbff95b6fb7a8db2db1e6b8764
Instruction Fuzzy Hash: 48514E34A00209EFDF10CF64D980AAF7BB6FF95360F148159F8659B2A0D770AD81CB90

Function 00A09A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00A09AD2
__itow.LIBCMT ref: 00A09B03

Part of subcall function 00A09D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00A09DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00A09B6C
__itow.LIBCMT ref: 00A09BC3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: c34862cb75da57359a5535efb1b388a4e9578f34008aab6719331d4a275a8544
Instruction ID: f01a3c4d4f3d2e287d55db7a9c9785fa6d6165931a58c59d17de600901b770b6
Opcode Fuzzy Hash: c34862cb75da57359a5535efb1b388a4e9578f34008aab6719331d4a275a8544
Instruction Fuzzy Hash: F1416274A0020CABDF15EF94E945BFFBBB9EF85760F004059F905A7292DB709944CB51

Function 00A269AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00A269D1
WSAGetLastError.WSOCK32(00000000), ref: 00A269E1

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A26A45
WSAGetLastError.WSOCK32(00000000), ref: 00A26A51

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 3b0bcfbbee07cba6a3ebe3769adcc0a89265df19d70d609d2f69fda8116f569b
Instruction ID: d39ed61a9d9022f6271d0b371502fe22f17d803a49e9816b789ec03aca107daa
Opcode Fuzzy Hash: 3b0bcfbbee07cba6a3ebe3769adcc0a89265df19d70d609d2f69fda8116f569b
Instruction Fuzzy Hash: 2641C7757402106FEB50AF68DD86F7A77E8EF89B24F04842CFA199F2D2DA709D018751

Function 00A2641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00A3F910), ref: 00A264A7
_strlen.LIBCMT ref: 00A264D9

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 6e34c788c47188202947567d6da180573cf91bc993b50a5ebf6899e5416b49bc
Instruction ID: afb0252048bb52d916488715f199d17bd32fb9413cf836f56254fd9e749b156e
Opcode Fuzzy Hash: 6e34c788c47188202947567d6da180573cf91bc993b50a5ebf6899e5416b49bc
Instruction Fuzzy Hash: 90418331A05114AFCB14EBA8ED95FEEB7B9AF44320F148165F91A97292DB30AD04C750

Function 00A1B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00A1B89E
GetLastError.KERNEL32(?,00000000), ref: 00A1B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00A1B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00A1B915

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 4bc71e6fb23ff0a8cfa6a4a497503e6c74a634c42dbe9fc879d595ca354f3b29
Instruction ID: 5c19aa7c1802ef7f03c02bf5d34e94f6371be790b94ba0700af886e4f1b56fc7
Opcode Fuzzy Hash: 4bc71e6fb23ff0a8cfa6a4a497503e6c74a634c42dbe9fc879d595ca354f3b29
Instruction Fuzzy Hash: 7241F835610510DFCB11EF55C585A99BBF1AF8A720F198098FD4A9B362CB30FD42CB91

Function 00A38851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A388DE

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: ad1587995ccd86088518dc928c77441d1ca9c5ff6ff4ed74b02b85a06134000a
Instruction ID: 981e7f4d1a8a6bb46a679ca997eea13ff60306e5fe0aebfab4ec5cdd5a83d833
Opcode Fuzzy Hash: ad1587995ccd86088518dc928c77441d1ca9c5ff6ff4ed74b02b85a06134000a
Instruction Fuzzy Hash: 1931C474A00308AFEF209BA8DC45FB977B5EB49360F644112FA15E72A1CF79E9409792

Function 00A3AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00A3AB60
GetWindowRect.USER32(?,?), ref: 00A3ABD6
PtInRect.USER32(?,?,00A3C014), ref: 00A3ABE6
MessageBeep.USER32(00000000), ref: 00A3AC57

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 059cd6640c9268bc0e4bd3b6fc2906e130c8b4c420f687debabe172320c95866
Instruction ID: 26283935ba09bbdc75d66c7e5783ad08555792db5187c970e49d28b208a326a0
Opcode Fuzzy Hash: 059cd6640c9268bc0e4bd3b6fc2906e130c8b4c420f687debabe172320c95866
Instruction Fuzzy Hash: AA416030A00529DFCF15DF98D884A59BBF5FF59310F1890A9F499DB261D730A842DB92

Function 00A10AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00A10B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00A10B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00A10BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00A10BFB

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c4026dc6efdb847bb6591132ba3af2e30792e91d09ad75f9ceeaeec559960b1c
Instruction ID: 855d365f7cd02ed7b79befb1311214cedddc6ca4dd202975661d5231451d6fe7
Opcode Fuzzy Hash: c4026dc6efdb847bb6591132ba3af2e30792e91d09ad75f9ceeaeec559960b1c
Instruction Fuzzy Hash: E1313870D4C618AEFF308B658C05FFABBBAAB45318F08425AF491921D1C3F989C19751

Function 00A10C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00A10C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00A10C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00A10CE1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00A10D33

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ecafff07fe5e5cee0b6608ded5692daeb7e7ea40d9fe0e28498d2290a611f82c
Instruction ID: 13d6dd2c117ac3b6fe8eb300648f38d9f36e3825097a07993297eac0954d3014
Opcode Fuzzy Hash: ecafff07fe5e5cee0b6608ded5692daeb7e7ea40d9fe0e28498d2290a611f82c
Instruction Fuzzy Hash: B731F670940618AEFF308B659C05FFEBB76AB45310F08431AE485621D1C3B599D59BD5

Function 009E61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 009E61FB
__isleadbyte_l.LIBCMT ref: 009E6229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 009E6257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 009E628D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: d5e976621af2db855fa9f943ac67bda1749b7e8ddf219eaea5b576475e90384f
Instruction ID: 52ae4ee49f6e75f149d5f708f2b4c6da5f3325c822c0a2cbdbd42e9c94aa12cd
Opcode Fuzzy Hash: d5e976621af2db855fa9f943ac67bda1749b7e8ddf219eaea5b576475e90384f
Instruction Fuzzy Hash: 7B31CE30604286AFDF228F66CC44BAA7FA9BF92390F154529E964C72A1D730ED50DB90

Function 00A34EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00A34F02

Part of subcall function 00A13641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A1365B
Part of subcall function 00A13641: GetCurrentThreadId.KERNEL32 ref: 00A13662
Part of subcall function 00A13641: AttachThreadInput.USER32(00000000,?,00A15005), ref: 00A13669

GetCaretPos.USER32(?), ref: 00A34F13
ClientToScreen.USER32(00000000,?), ref: 00A34F4E
GetForegroundWindow.USER32 ref: 00A34F54

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: a505cfe4b0fc8c6302a9a0321ebd7a7e2ae279292dc41637128d9f2a24a1b4cd
Instruction ID: 4aeb18cb73f540415d1c092b49608edfdb4de0e847fe13b696617a7144d69e83
Opcode Fuzzy Hash: a505cfe4b0fc8c6302a9a0321ebd7a7e2ae279292dc41637128d9f2a24a1b4cd
Instruction Fuzzy Hash: C1312E72D10108AFCB00EFA5C985AEFB7F9EF99310F10406AF515E7241DA71AE45CBA0

Function 00A13C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A13C7A
Process32FirstW.KERNEL32(00000000,?), ref: 00A13C88
Process32NextW.KERNEL32(00000000,?), ref: 00A13CA8
CloseHandle.KERNEL32(00000000), ref: 00A13D52

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d3b4a4e54821fc72585d49d4d87acfb6c2d7c43beeb1942b80843e27b3204149
Instruction ID: 4d97cccd5dd22ca10cdcdcf544f2f11d17d904350e82dfe2e436b9b7f46c48bc
Opcode Fuzzy Hash: d3b4a4e54821fc72585d49d4d87acfb6c2d7c43beeb1942b80843e27b3204149
Instruction Fuzzy Hash: FA31C2721083059FC700EF60D985BEFBBE8EFC5360F40092DF581861A1EB719A49CB92

Function 00A3C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

GetCursorPos.USER32(?), ref: 00A3C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,009EB9AB,?,?,?,?,?), ref: 00A3C4E7
GetCursorPos.USER32(?), ref: 00A3C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,009EB9AB,?,?,?), ref: 00A3C56E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 5990f3511083d61b5976bbd5e0ecb92a39f16d816b8a1f77f4d1a19f17d8c217
Instruction ID: 8980618b45e676f1f350e340aeada0cbd268a7cfe3a4d3bc35ce6020cf3716de
Opcode Fuzzy Hash: 5990f3511083d61b5976bbd5e0ecb92a39f16d816b8a1f77f4d1a19f17d8c217
Instruction Fuzzy Hash: D3319135A01058EFCB25CF98CC58EEA7BB5EB49320F444169F90A9B261C732AD51DFA4

Function 00A08656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A08121
Part of subcall function 00A0810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A0812B
Part of subcall function 00A0810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A0813A
Part of subcall function 00A0810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A08141
Part of subcall function 00A0810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A08157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00A086A3
_memcmp.LIBCMT ref: 00A086C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A086FC
HeapFree.KERNEL32(00000000), ref: 00A08703

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 9be959594d1b9c77e0ebc309a2496c59648bf52d1fd61614315b4acb576f0287
Instruction ID: 6dd7776aeaccb72be1d650c01e808e676b3ef1d190347ed8f2c611cd7412130d
Opcode Fuzzy Hash: 9be959594d1b9c77e0ebc309a2496c59648bf52d1fd61614315b4acb576f0287
Instruction Fuzzy Hash: 1A219071E40208EFDB10DFA4DD49BEEB7B8EF44304F154059E485A7281DB35AE05CB54

Function 009D098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 009D09AE

Part of subcall function 009B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A17896,?,?,00000000), ref: 009B5A2C
Part of subcall function 009B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A17896,?,?,00000000,?,?), ref: 009B5A50

_fprintf.LIBCMT ref: 009D09E5
OutputDebugStringW.KERNEL32(?), ref: 00A05DBB

Part of subcall function 009D4AAA: _flsall.LIBCMT ref: 009D4AC3

__setmode.LIBCMT ref: 009D0A1A

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 92adf11744d97f3697297a76dbbc90808a67f468414f48f2d183a3b402f75a13
Instruction ID: 7a0c5705aecdadefa473590bca9e77c789b601b00e5ef91acdbbe53384963873
Opcode Fuzzy Hash: 92adf11744d97f3697297a76dbbc90808a67f468414f48f2d183a3b402f75a13
Instruction Fuzzy Hash: E7113A319842087FD704B3B4AC47BFE77689FC5320F548027F205672C2EE34588297A1

Function 00A21767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A217A3

Part of subcall function 00A2182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A2184C
Part of subcall function 00A2182D: InternetCloseHandle.WININET(00000000), ref: 00A218E9

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 9c14a574b55974ef3b2f48ca03770466a40f3fca083523822f79e0466c47535b
Instruction ID: 6c0c93124fe725888ec6af364b5c5269c0ae76080ec7b3f2980bc9d953448c1e
Opcode Fuzzy Hash: 9c14a574b55974ef3b2f48ca03770466a40f3fca083523822f79e0466c47535b
Instruction Fuzzy Hash: 2521C631600615BFEB129F68EC41FBBBBA9FFA8710F10403AFA1196650D771D8119BA0

Function 00A13A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00A3FAC0), ref: 00A13A64
GetLastError.KERNEL32 ref: 00A13A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A13A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00A3FAC0), ref: 00A13ADF

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 8f95d90abfdd9f27603ccd65b2b91a967043f13d806ad43ab1f5b0f65e03869d
Instruction ID: ce81dddef26806bbdbb02cf9dfa089f5e001bba12caf73158bc7a18b48d7246b
Opcode Fuzzy Hash: 8f95d90abfdd9f27603ccd65b2b91a967043f13d806ad43ab1f5b0f65e03869d
Instruction Fuzzy Hash: A721A6355092019F8700EF64C9819EFB7E8BE553A4F144A2DF499C72A1D731DE86CB82

Function 00A0DCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0F0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00A0DCD3,?,?,?,00A0EAC6,00000000,000000EF,00000119,?,?), ref: 00A0F0CB
Part of subcall function 00A0F0BC: lstrcpyW.KERNEL32(00000000,?,?,00A0DCD3,?,?,?,00A0EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00A0F0F1
Part of subcall function 00A0F0BC: lstrcmpiW.KERNEL32(00000000,?,00A0DCD3,?,?,?,00A0EAC6,00000000,000000EF,00000119,?,?), ref: 00A0F122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00A0EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00A0DCEC
lstrcpyW.KERNEL32(00000000,?,?,00A0EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00A0DD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,00A0EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00A0DD46

Strings

cdecl, xrefs: 00A0DD3D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: c44ef26ed4114d02a6eaababa1a930191b2f39836851fdca7f98b09b709734bd
Instruction ID: 231a668afa5c638a67acb0f1898142bdce0eda1c4dcea98d8b5cf2f14824f3d8
Opcode Fuzzy Hash: c44ef26ed4114d02a6eaababa1a930191b2f39836851fdca7f98b09b709734bd
Instruction Fuzzy Hash: 6211AF37200309EFDB259FB4EC4597A77A9FF45310B40812AF906CB2A0EB719C41D790

Function 009E50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009E5101

Part of subcall function 009D571C: __FF_MSGBANNER.LIBCMT ref: 009D5733
Part of subcall function 009D571C: __NMSG_WRITE.LIBCMT ref: 009D573A
Part of subcall function 009D571C: RtlAllocateHeap.NTDLL(011B0000,00000000,00000001,00000000,?,?,?,009D0DD3,?), ref: 009D575F

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 8a288cb1c7418e050beef52ea48352821c85779522f75b7a41eaf9a0e0387e89
Instruction ID: 1fc770bdc4c826b9a3636ba8c6ff27a06e62e8f31b7bc6b7bac958cd8ed134d5
Opcode Fuzzy Hash: 8a288cb1c7418e050beef52ea48352821c85779522f75b7a41eaf9a0e0387e89
Instruction Fuzzy Hash: 32112C72948A51AFCF322FB2BC0575E379C5F50365F12892BF9089A351DE34CC419790

Function 009B44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009B44CF

Part of subcall function 009B407C: _memset.LIBCMT ref: 009B40FC
Part of subcall function 009B407C: _wcscpy.LIBCMT ref: 009B4150
Part of subcall function 009B407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009B4160

KillTimer.USER32(?,00000001,?,?), ref: 009B4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009B4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009ED4B9

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 403955335cf5f24256d5136da8525eb404729f65643ec03143088b018f297c58
Instruction ID: 332a3b23fa151d4f113e161618476882941bb75b335cdfb7788b579939b6da37
Opcode Fuzzy Hash: 403955335cf5f24256d5136da8525eb404729f65643ec03143088b018f297c58
Instruction Fuzzy Hash: C021F5709057849FE733CB648C45BE6BBEC9B11314F04049DF68E561D2D3B42D85DB41

Function 00A26369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A17896,?,?,00000000), ref: 009B5A2C
Part of subcall function 009B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A17896,?,?,00000000,?,?), ref: 009B5A50

gethostbyname.WSOCK32(?,?,?), ref: 00A26399
WSAGetLastError.WSOCK32(00000000), ref: 00A263A4
_memmove.LIBCMT ref: 00A263D1
inet_ntoa.WSOCK32(?), ref: 00A263DC

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: a54710e38a894186751da7bf6cc0f7a3b94c714b0760790fc3103172ec424b46
Instruction ID: a8a6837d703e7a5e04da79ed40b2e2438041b4ddedf8e6c29e32ab366e32bacb
Opcode Fuzzy Hash: a54710e38a894186751da7bf6cc0f7a3b94c714b0760790fc3103172ec424b46
Instruction Fuzzy Hash: 33112E31910109AFCF04FBA4DE46EEEB7B8AF49320B544465F506A7261DB30AE14DBA1

Function 00A08B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00A08B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A08B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A08B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A08BA4

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a0fe60b5cef286b10164c4485ea5c9e848f434bae8d9dd7356966be6d2e40afe
Instruction ID: d1527a193a24161e634954f923db9e01d184b4593144904f4470bcdbe057a575
Opcode Fuzzy Hash: a0fe60b5cef286b10164c4485ea5c9e848f434bae8d9dd7356966be6d2e40afe
Instruction Fuzzy Hash: 47114879900218FFEB10DFA5CD85FADBBB8FB48310F2040A5EA00B7290DA716E11DB94

Function 009B1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 009B2612: GetWindowLongW.USER32(?,000000EB), ref: 009B2623

DefDlgProcW.USER32(?,00000020,?), ref: 009B12D8
GetClientRect.USER32(?,?), ref: 009EB5FB
GetCursorPos.USER32(?), ref: 009EB605
ScreenToClient.USER32(?,?), ref: 009EB610

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: ff38baac0e0acb2227ac02140f09dabd0422392ef64c32195405b9429be03605
Instruction ID: bad073114698791f0ddbffa91aa9d4564102cc8c868d2863a873584a55d5b441
Opcode Fuzzy Hash: ff38baac0e0acb2227ac02140f09dabd0422392ef64c32195405b9429be03605
Instruction Fuzzy Hash: 26113A35A10059EFCB04DFA8DE95DEE77B8FB05311F904456F911E7150C730BA528BA5

Function 00A11142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00A0FCED,?,00A10D40,?,00008000), ref: 00A1115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00A0FCED,?,00A10D40,?,00008000), ref: 00A11184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00A0FCED,?,00A10D40,?,00008000), ref: 00A1118E
Sleep.KERNEL32(?,?,?,?,?,?,?,00A0FCED,?,00A10D40,?,00008000), ref: 00A111C1

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 1461f3d6717dd76488e00fd5fb3f99a93a5df88de019e0fb78ee5b218d9780b6
Instruction ID: c3a6e0c8bf7db87fe0541950f673261cd36da5be5f0ed81f8058e11770008fc5
Opcode Fuzzy Hash: 1461f3d6717dd76488e00fd5fb3f99a93a5df88de019e0fb78ee5b218d9780b6
Instruction Fuzzy Hash: 68111831D00629EBCF00DFE5E848BEEFBB8FB09751F004259EB45B2240CB7095918B95

Function 00A0D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00A0D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00A0D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00A0D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00A0D897

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: f291d5d589e4759f022437fdcf358dcef673c49d8669e55d5457181c20b360ef
Instruction ID: c5c4109eee504c145f47307fa49c5fbdf522bb4591a95755ba0e2cb294528709
Opcode Fuzzy Hash: f291d5d589e4759f022437fdcf358dcef673c49d8669e55d5457181c20b360ef
Instruction Fuzzy Hash: B4115E76A05308DFE720CF94ED08F92BBBCEB00B10F10C569AA16D6090D7B0E5499BA1

Function 009E6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 009E6FDB

Part of subcall function 009E76C2: __fltout2.LIBCMT ref: 009E76EB

__cftog_l.LIBCMT ref: 009E7001
__cftoe_l.LIBCMT ref: 009E7033

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 3e716877bf8580d672878847496ae33f25f901a7e892b5dc7b39eca819613786
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 27014B7244818ABBCF175FC5CC01CEE7F66BB68396B588815FE5858031D236C9B1AB92

Function 00A3B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A3B2E4
ScreenToClient.USER32(?,?), ref: 00A3B2FC
ScreenToClient.USER32(?,?), ref: 00A3B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A3B33B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: cfc932c365083375194a3b5de62872935b99de6a159f32206f4c6b1c3eb131f2
Instruction ID: d12ad6879e231e009b6907efe026f879282ec72d44c2f94b923575432de64c94
Opcode Fuzzy Hash: cfc932c365083375194a3b5de62872935b99de6a159f32206f4c6b1c3eb131f2
Instruction Fuzzy Hash: 651144B9D10649EFDB41CFA9C8859EEBBF9FF08310F108166E914E3620D735AA558F50

Function 00A3B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A3B644
_memset.LIBCMT ref: 00A3B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00A76F20,00A76F64), ref: 00A3B682
CloseHandle.KERNEL32 ref: 00A3B694

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: af11a5a8e7059dd9e55c484d74e010957503f0f8d06432fdc406ffa77bca5e4c
Instruction ID: 0df09d363997bebb50f7df2754b8aa548c6f78ab32e1658af86d92d4c059d227
Opcode Fuzzy Hash: af11a5a8e7059dd9e55c484d74e010957503f0f8d06432fdc406ffa77bca5e4c
Instruction Fuzzy Hash: 3DF05EB25507007EE210ABA1BC06FBB3A9CEB08395F00C021FA0CEA192D7754C018BA8

Function 00A16BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A16BE6

Part of subcall function 00A176C4: _memset.LIBCMT ref: 00A176F9

_memmove.LIBCMT ref: 00A16C09
_memset.LIBCMT ref: 00A16C16
LeaveCriticalSection.KERNEL32(?), ref: 00A16C26

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 11546e14596791660d5c54e40b4fe19ba4c0f8705400ab6151bd1cd436c7d347
Instruction ID: 40e0241b983d28ea1c6d076966190f6bdf38ad5e733640a5cc0cbd1a415d8a3c
Opcode Fuzzy Hash: 11546e14596791660d5c54e40b4fe19ba4c0f8705400ab6151bd1cd436c7d347
Instruction Fuzzy Hash: 75F05E3A200100ABCF41AF95DC85E8ABB2AEF95360F08C061FE085F267D771E851CBB4

Function 009B2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009B2231
SetTextColor.GDI32(?,000000FF), ref: 009B223B
SetBkMode.GDI32(?,00000001), ref: 009B2250
GetStockObject.GDI32(00000005), ref: 009B2258
GetWindowDC.USER32(?,00000000), ref: 009EBE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 009EBE90
GetPixel.GDI32(00000000,?,00000000), ref: 009EBEA9
GetPixel.GDI32(00000000,00000000,?), ref: 009EBEC2
GetPixel.GDI32(00000000,?,?), ref: 009EBEE2
ReleaseDC.USER32(?,00000000), ref: 009EBEED

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 8a6366d39c99eca440cf3289ae0862782afd44724c5d9f911ff12bc6ef62ac8a
Instruction ID: 8e49183067d9a433b61084de506a53dc50572213e0fbadb4d742073a8a80c92a
Opcode Fuzzy Hash: 8a6366d39c99eca440cf3289ae0862782afd44724c5d9f911ff12bc6ef62ac8a
Instruction Fuzzy Hash: 9FE03932914284EEDF219FA4FC0DBD83B14EB05332F008366FB69880E187B14981DB12

Function 00A08712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00A0871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,00A082E6), ref: 00A08722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00A082E6), ref: 00A0872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,00A082E6), ref: 00A08736

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 28ae1899870226d236cfa40700b261b355ce1e8d94c9de407f0e55cfb6fd7ea0
Instruction ID: 2195d6224f7fbc5100ae1445d3ef5b8e9232076ef73adb379cd3d0e06c01a4e2
Opcode Fuzzy Hash: 28ae1899870226d236cfa40700b261b355ce1e8d94c9de407f0e55cfb6fd7ea0
Instruction Fuzzy Hash: F6E08636A212119FD7609FF46D0CB973BACEF51B91F144828B685C9091EB388442C750

Function 009D5DAC Relevance: 6.0, APIs: 4, Instructions: 14threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 009D5DAD

Part of subcall function 009D99C4: GetLastError.KERNEL32(00000000,009D0DD3,009D8B2D,009D57A3,?,?,009D0DD3,?), ref: 009D99C6
Part of subcall function 009D99C4: __calloc_crt.LIBCMT ref: 009D99E7
Part of subcall function 009D99C4: __initptd.LIBCMT ref: 009D9A09
Part of subcall function 009D99C4: GetCurrentThreadId.KERNEL32 ref: 009D9A10
Part of subcall function 009D99C4: SetLastError.KERNEL32(00000000,009D0DD3,?), ref: 009D9A28

CloseHandle.KERNEL32(?,?,009D5D8C), ref: 009D5DC1
__freeptd.LIBCMT ref: 009D5DC8
ExitThread.KERNEL32 ref: 009D5DD0

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ErrorLastThread$CloseCurrentExitHandle__calloc_crt__freeptd__getptd_noexit__initptd
String ID:
API String ID: 4169687693-0
Opcode ID: eb2a5a5a7ec145a9815c3126ecbf9c2cf52b6840ef2e0363808c4fd12d84c808
Instruction ID: 0c80aaa8fc359d411896860b001182c05c9f4ed0f9cad3f5e2b7657869b6a1c8
Opcode Fuzzy Hash: eb2a5a5a7ec145a9815c3126ecbf9c2cf52b6840ef2e0363808c4fd12d84c808
Instruction Fuzzy Hash: B5D0A731441F104FC23277708C0D73932549F00721F05C21AF075492F08F2098038751

Function 00A0B2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00A0B4BE

Strings

Container, xrefs: 00A0B43B
AutoIt3GUI, xrefs: 00A0B436

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 3c55124ca5bcb85707b0d2ecc1e3bce5c720c56638ffe9894df3525b1a02f9ef
Instruction ID: e9aa1cbd89880da4ec86f84bc7088511f37d9d278055d1d8980eff470c908825
Opcode Fuzzy Hash: 3c55124ca5bcb85707b0d2ecc1e3bce5c720c56638ffe9894df3525b1a02f9ef
Instruction Fuzzy Hash: 06915870610605AFDB14CF68D984B6ABBF5FF48710F20856EF94ACB6A1DB71E841CB60

Function 00A1AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 009CFC86: _wcscpy.LIBCMT ref: 009CFCA9

Part of subcall function 009B9837: __itow.LIBCMT ref: 009B9862
Part of subcall function 009B9837: __swprintf.LIBCMT ref: 009B98AC

__wcsnicmp.LIBCMT ref: 00A1B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00A1B0F6

Strings

LPT, xrefs: 00A1B027

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: da8871e5dab5f197f59aeb7cb5cc2d26dfb54f2fb9f93b19a942dcaf8522ba91
Instruction ID: 31a7ef9b5e7ee73b259046bd883eb0d5cf806a1443e88c5a474e4b74e31decb9
Opcode Fuzzy Hash: da8871e5dab5f197f59aeb7cb5cc2d26dfb54f2fb9f93b19a942dcaf8522ba91
Instruction Fuzzy Hash: 20619E75E10219AFCB14DF94C991EEEB7B5EF48310F11416AF916AB2A1D770AE80CB60

Function 009C2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 009C2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 009C2981

Strings

@, xrefs: 009C2975

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 0d14450c6d4e29c0d92af43037a584ec923be77ca8a1a74518cd2f0101d07bfd
Instruction ID: 3c43133a1ebe4efce009911f3dfdb889f9fe4939098586ae4cc750550ddad535
Opcode Fuzzy Hash: 0d14450c6d4e29c0d92af43037a584ec923be77ca8a1a74518cd2f0101d07bfd
Instruction Fuzzy Hash: A65164724187449BD320EF60D886BEBBBF8FBC9354F41885DF2D8410A1DB309569CB66

Function 00A19734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 009B4F0B: __fread_nolock.LIBCMT ref: 009B4F29

_wcscmp.LIBCMT ref: 00A19824
_wcscmp.LIBCMT ref: 00A19837

Strings

FILE, xrefs: 00A19770

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 98d24f3cb497311f27d0a9c3834bd39c443520e89986c21b3ed392b542c167b0
Instruction ID: fdc9b2fb00116dd942748f9761fc55cc3bd520c088d2e80678e7a9667029ff8a
Opcode Fuzzy Hash: 98d24f3cb497311f27d0a9c3834bd39c443520e89986c21b3ed392b542c167b0
Instruction Fuzzy Hash: 9041C871A40219BADF209FA0CC55FEFB7BEDF85710F004469F904A7281DA71A944DB61

Function 00A2258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A225D4

Strings

|, xrefs: 00A225A5

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 2c91fad85687da9cec2c7891da1dd5ecf86211d9eb9c8da4bb3a5d07d5780d03
Instruction ID: 44048726c0438350a9f10ad477a0a1ac01e01b3de9bfe835c063df57e6b682ce
Opcode Fuzzy Hash: 2c91fad85687da9cec2c7891da1dd5ecf86211d9eb9c8da4bb3a5d07d5780d03
Instruction Fuzzy Hash: 2C314671800119EBDF01EFA4DD85EEEBFB8FF48310F10006AF914A6262EB355916DB60

Function 00A37A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00A37B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A37B76

Strings

', xrefs: 00A37ACA

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: ef65d82d4f1e40c49aa3dcf1dd11df628a02413e8baea39c3a9dbd827ca88710
Instruction ID: 3f04c85f9d0a2f6bba959997e9dc54540658b3539902bf64caeb4f32e8bb7da6
Opcode Fuzzy Hash: ef65d82d4f1e40c49aa3dcf1dd11df628a02413e8baea39c3a9dbd827ca88710
Instruction Fuzzy Hash: FB41E7B4E0520A9FDB24CF68C981BEEBBB5FB09340F14416AF909AB351D770A951CF90

Function 00A36A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00A36B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00A36B53

Strings

static, xrefs: 00A36AB3

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ddbe6741462e21e48588b453fa44069ffb14ae1c2e03ec57c78ae83e9a44278c
Instruction ID: cd60564a4c4428db35926c7d9f5cfb215f4aaf200576e9bf337dde74ed8b5110
Opcode Fuzzy Hash: ddbe6741462e21e48588b453fa44069ffb14ae1c2e03ec57c78ae83e9a44278c
Instruction Fuzzy Hash: D1314D71610604AEEB109F64CC81BFBB7B9FF88760F10C619F9A9D7190DA31AC91DB60

Function 00A128A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A12911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A1294C

Strings

0, xrefs: 00A1290A

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 17eede9648ce77a95c35cf16371c8947a2cc2c23e15fc94df62580b93298e426
Instruction ID: 8d5c9950a5ca4423b10ec37f498e3dd56c14e19b0bb49136832230f52d31f34b
Opcode Fuzzy Hash: 17eede9648ce77a95c35cf16371c8947a2cc2c23e15fc94df62580b93298e426
Instruction Fuzzy Hash: FA31A231A003099FEF28CF9CCD85BEEBBB9EF45350F184029E985A61A1D770D9A4DB51

Function 00A239E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00A23A66

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Strings

AUTOITCALLVARIABLE%d, xrefs: 00A23A58
, $, xrefs: 00A23AA6

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 0ba9a0426d97d58f18530a5d5b1674fb338f214d71b80268fa6c78d26cf2bf82
Instruction ID: d87c7c4ca7ab8fc5c019cfc69f478b744f125df29b8de93150f6f15967be1592
Opcode Fuzzy Hash: 0ba9a0426d97d58f18530a5d5b1674fb338f214d71b80268fa6c78d26cf2bf82
Instruction Fuzzy Hash: 8B21C331600118AFCF10EFA8DD81EEEB7B9BF85350F400568F445A7281DB39EA41CB61

Function 00A366D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A36761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A3676C

Strings

Combobox, xrefs: 00A3672E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 6e804d9b82d25375f8df3bccf783623934283d7243c66f50347a03ed3cd8c88b
Instruction ID: 8d327af7aec33371b1617b1a5d57981a1017cfa20b15fc5d5e98ad6a8eac6e37
Opcode Fuzzy Hash: 6e804d9b82d25375f8df3bccf783623934283d7243c66f50347a03ed3cd8c88b
Instruction Fuzzy Hash: D911C171710208BFEF25CF64CC81EFB37AAEB883A8F508129F91897290D671DC5187A0

Function 00A36C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 009B1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009B1D73
Part of subcall function 009B1D35: GetStockObject.GDI32(00000011), ref: 009B1D87
Part of subcall function 009B1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009B1D91

GetWindowRect.USER32(00000000,?), ref: 00A36C71
GetSysColor.USER32(00000012), ref: 00A36C8B

Strings

static, xrefs: 00A36C4E

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 5eb5a2c265fe902aa35a831d4b349b034139463b3cc8d4e8f1fdaa44d0fa3bb0
Instruction ID: e91fc11b5f277326be03150858efbed843b5ef17ebd5153d0ab0ad6272c69b52
Opcode Fuzzy Hash: 5eb5a2c265fe902aa35a831d4b349b034139463b3cc8d4e8f1fdaa44d0fa3bb0
Instruction Fuzzy Hash: 61212972920209AFDF04DFB8CD45EEA7BB8FB08314F045629F995D2250D735E851DB60

Function 00A36920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00A369A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A369B1

Strings

edit, xrefs: 00A36986

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 9b391ecfa72ef8f6f33dcca9e8ed579ec0df3c172943450dd17d02e53f4a73a6
Instruction ID: caa126299d57cb956b152ad4d42d856f9e5e3703d17a6182fefbad6a6aec4fed
Opcode Fuzzy Hash: 9b391ecfa72ef8f6f33dcca9e8ed579ec0df3c172943450dd17d02e53f4a73a6
Instruction Fuzzy Hash: FD113A71510208BFEB108F64DD45BEB3BA9EB453B4F608724F9A5961E0C771DC91A760

Function 00A129AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A12A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00A12A41

Strings

0, xrefs: 00A12A18

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: d9c725797f002b512ef90e328923e84160c76b3f6c9b87fe36d2ea3e788ca207
Instruction ID: 49f8c44499a9ea7a1ddf1df5887d610e527ae1e2de2398fb227bc7b8618dae22
Opcode Fuzzy Hash: d9c725797f002b512ef90e328923e84160c76b3f6c9b87fe36d2ea3e788ca207
Instruction Fuzzy Hash: 6B11C472D01214ABDF34DBA8DC44BEE77B8AF45390F158021E859E7290D770ED9AC791

Function 00A221D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A2222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A22255

Strings

<local>, xrefs: 00A2221D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 7e9f14b3508721bf76ff7af5e57c338cc6629656218e7decbb2783c50a76f35c
Instruction ID: b598085cd861300822d9c14fc71ca20fee841830ab84091c9f5e0a11e489a143
Opcode Fuzzy Hash: 7e9f14b3508721bf76ff7af5e57c338cc6629656218e7decbb2783c50a76f35c
Instruction Fuzzy Hash: FF11CA70541235FADB288F59AC89FFABBA8FB16751F10823AF90486000E2725991D7F0

Function 00A27D8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A27FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00A27DB3,?,00000000,?,?), ref: 00A2800D

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A27DB6
htons.WSOCK32(00000000,?,00000000), ref: 00A27DF3

Strings

255.255.255.255, xrefs: 00A27DCE

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: ee9683cc9a7f45887dd2165d9121d7113f3bf8e86c1f498b4bab3dc8aa6de958
Instruction ID: 44a693979586b178c8f332e02a30270ebbe2c73d047210e8a69280134426b815
Opcode Fuzzy Hash: ee9683cc9a7f45887dd2165d9121d7113f3bf8e86c1f498b4bab3dc8aa6de958
Instruction Fuzzy Hash: 11118E34504219ABCB20AFA8EC86FBEB334FF54320F20456AF915572D1DA71AD1186A1

Function 00A08E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 00A0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00A0AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00A08E73

Strings

ComboBox, xrefs: 00A08E12
ListBox, xrefs: 00A08E3D

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: b5a76a3ed5fb359b8fba3614d8f74c3b5703a92727e9523d6dbc77543db7481b
Instruction ID: dfed06e975f183a186a6242d2736a303ab23576ca6b55c5a19b8b55f7ad12dbe
Opcode Fuzzy Hash: b5a76a3ed5fb359b8fba3614d8f74c3b5703a92727e9523d6dbc77543db7481b
Instruction Fuzzy Hash: 5B01F171A01218ABCF14EBA0CD46AFE7368AF81360B440A19F865572E2DE359808C650

Function 00A08CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 00A0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00A0AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00A08D6B

Strings

ComboBox, xrefs: 00A08D0A
ListBox, xrefs: 00A08D35

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 86d2f0a16eac1d887cf1ac3b713712f517b164b95ba0a81144c8128dac126913
Instruction ID: bad4f54444bdb3133d6ac8b56532f593961ce9dc6f06683b9cbe5af2eb44e456
Opcode Fuzzy Hash: 86d2f0a16eac1d887cf1ac3b713712f517b164b95ba0a81144c8128dac126913
Instruction Fuzzy Hash: 9101BC71A4110CABCF14EBE0DA96BFE73A89F95390F540129B842632E1EE245E089261

Function 00A08D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B7DE1: _memmove.LIBCMT ref: 009B7E22

Part of subcall function 00A0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00A0AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00A08DEE

Strings

ComboBox, xrefs: 00A08D8F
ListBox, xrefs: 00A08DBA

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 6ff3919a63e690134e2a1618e7dabd027b59539508cafd4c1d3a09e2f6bc01f1
Instruction ID: 8d18b2d49a8ea6beafa45fac9ef940799bd28c646613c815726fd2384ea28cca
Opcode Fuzzy Hash: 6ff3919a63e690134e2a1618e7dabd027b59539508cafd4c1d3a09e2f6bc01f1
Instruction Fuzzy Hash: A401F271B4110CBBDF10EBE4DA42BFF73A89F61350F144119B841632D2DE254E08D275

Function 00A14F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A14F46
_wcscmp.LIBCMT ref: 00A14F58

Strings

#32770, xrefs: 00A14F52

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 9166362fc53ff5f214e3754b4d38476998ad0ecd27b1d55f624c6384b140da04
Instruction ID: f278355c74e17d4acfd608689974babe5f2d2f242d283895244202593a273896
Opcode Fuzzy Hash: 9166362fc53ff5f214e3754b4d38476998ad0ecd27b1d55f624c6384b140da04
Instruction Fuzzy Hash: D0E0D13250422C2BD720D799AC45FA7F7ACEB45B71F000157FD04D3151D5609A4687D1

Function 009EB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009EB314: _memset.LIBCMT ref: 009EB321

Part of subcall function 009D0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,009EB2F0,?,?,?,009B100A), ref: 009D0945

IsDebuggerPresent.KERNEL32(?,?,?,009B100A), ref: 009EB2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009B100A), ref: 009EB303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 009EB2FE

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: b7380264f5ef56f828ec2ce910beb506e7afc5441d50cd9a4fc4bac129edc78a
Instruction ID: 078b2cdcfbbe14aa8373adf83231cb5877c04cd5b64edd2236887e24282e9be0
Opcode Fuzzy Hash: b7380264f5ef56f828ec2ce910beb506e7afc5441d50cd9a4fc4bac129edc78a
Instruction Fuzzy Hash: 5CE065706007418FD721EFA9E9063877AE8BF40714F008A2DF896C7651EBB4E849CBA1

Function 00A07C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00A07C82

Part of subcall function 009D3358: _doexit.LIBCMT ref: 009D3362

Strings

AutoIt, xrefs: 00A07C76
Error allocating memory., xrefs: 00A07C7B

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: de4086f4f9ef62457b4a5696a022be28ab6af8b892a14fb1338ebc26ceee1a0c
Instruction ID: b270f1a97736121d30cb46af8fa5dbe1ea47c5de91fb64de1db6bad9cbe509f4
Opcode Fuzzy Hash: de4086f4f9ef62457b4a5696a022be28ab6af8b892a14fb1338ebc26ceee1a0c
Instruction Fuzzy Hash: E3D05B323C435837D21533B56D07FCE76484F55F56F044816FB08595D349D1599151F5

Function 009F1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 009F1775

Part of subcall function 00A2BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,009F195E,?), ref: 00A2BFFE
Part of subcall function 00A2BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00A2C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 009F196D

Strings

WIN_XPe, xrefs: 009F1788

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 24b0a417de5d5071bcda9741b0e50c909f0e0949452643a2a61c42a9d262e3a0
Instruction ID: 9965fffe6e24de8dcf25cf2d681a8c461f7bc8a138bdd3477339f771ebca971f
Opcode Fuzzy Hash: 24b0a417de5d5071bcda9741b0e50c909f0e0949452643a2a61c42a9d262e3a0
Instruction Fuzzy Hash: E3F0C97081010DDFDB15EB95DE84AFCBBF8AB18301F640495E216A60A0D7758F85DFA0

Function 00A35998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A359AE
PostMessageW.USER32(00000000), ref: 00A359B5

Part of subcall function 00A15244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A152BC

Strings

Shell_TrayWnd, xrefs: 00A359A7

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 589e75670b0471d2e8572fbb02e4bc7cb24bc50f8a2933c71fe062ce43924d50
Instruction ID: 7c6491966f5bf02521e7bc559a9efbe7d409f4b644d1e5a91255f44e928ff623
Opcode Fuzzy Hash: 589e75670b0471d2e8572fbb02e4bc7cb24bc50f8a2933c71fe062ce43924d50
Instruction Fuzzy Hash: C0D0C932B90711BAE664ABB09C0BFD76624BB54B50F000825B246EA1E0C9E4A801C654

Function 00A35964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A3596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00A35981

Part of subcall function 00A15244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A152BC

Strings

Shell_TrayWnd, xrefs: 00A35967

Memory Dump Source

Source File: 00000000.00000002.1708372641.00000000009B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.1708293181.00000000009B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708529199.0000000000A64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708618332.0000000000A6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708645795.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_rDOC24INV0616.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: e8481cccc939fbcf2ae622ce16abf1736b49bb0011f00b523648effc72ea8321
Instruction ID: 93c134b6c61f658b72676379881f1cae1f978a4abca430141748a68f7429d704
Opcode Fuzzy Hash: e8481cccc939fbcf2ae622ce16abf1736b49bb0011f00b523648effc72ea8321
Instruction Fuzzy Hash: 0ED0C932B94711BAE664ABB09C0BFD76A24BB50B50F000825B24AAA1E0C9E49801C654

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rDOC24INV0616.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autF6E.tmp

C:\Users\user\AppData\Local\Temp\caprone

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
rDOC24INV0616.exe

Function 009B3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 009B49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 009B4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00A19155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 009B3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Function 009B3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 009B708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 009B3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 009B3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 009B3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 013720D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 009B39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01371E90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
fileCOMMON

Function 009B407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 009D541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre