Edit tour

Windows Analysis Report
z37CurriculumVitaeIsabelGonzalez.exe

Overview

General Information

Sample name:	z37CurriculumVitaeIsabelGonzalez.exe
Analysis ID:	1579936
MD5:	cebc14097108206cf2149465b7ac4a23
SHA1:	033a1ef67618c81ecc07d2be9816c387e00226c2
SHA256:	59f94ff9fa02e65e2ccaa22af592a32088ed265f82b43a369ef811150f65b381
Tags:	exeuser-Porcupine
Infos:

Detection

FormBook

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

z37CurriculumVitaeIsabelGonzalez.exe (PID: 6832 cmdline: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe" MD5: CEBC14097108206CF2149465B7AC4A23)

svchost.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2351028222.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2351306500.0000000003080000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe", CommandLine: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe", ParentImage: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe, ParentProcessId: 6832, ParentProcessName: z37CurriculumVitaeIsabelGonzalez.exe, ProcessCommandLine: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe", ProcessId: 6880, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe", CommandLine: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe", ParentImage: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe, ParentProcessId: 6832, ParentProcessName: z37CurriculumVitaeIsabelGonzalez.exe, ProcessCommandLine: "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe", ProcessId: 6880, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: z37CurriculumVitaeIsabelGonzalez.exe

ReversingLabs: Detection: 21%

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2351028222.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2351306500.0000000003080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: z37CurriculumVitaeIsabelGonzalez.exe

Joe Sandbox ML: detected

Source: z37CurriculumVitaeIsabelGonzalez.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692672154.0000000003710000.00000004.00001000.00020000.00000000.sdmp, z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692925341.0000000003570000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019823966.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2351336591.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2351336591.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021938398.0000000003000000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692672154.0000000003710000.00000004.00001000.00020000.00000000.sdmp, z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692925341.0000000003570000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.2019823966.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2351336591.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2351336591.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021938398.0000000003000000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1449B GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B1449B
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1C7E8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B1C7E8
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1C75D FindFirstFileW,FindClose,	0_2_00B1C75D
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1F021 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B1F021
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1F17E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B1F17E
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1F47F FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B1F47F
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B13833 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B13833
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B13B56 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B13B56
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1BD48 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B1BD48

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B22404 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00B22404

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B2407C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B2407C

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B2427A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B2427A

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

0_2_00B2407C

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B1003A GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00B1003A

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B3CB26 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00B3CB26

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2351028222.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2351306500.0000000003080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00AB3B4C
Source: z37CurriculumVitaeIsabelGonzalez.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e738e21f-f
Source: z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_8d599635-2
Source: z37CurriculumVitaeIsabelGonzalez.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6eed23e3-3
Source: z37CurriculumVitaeIsabelGonzalez.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_1258a4b4-8

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C9C3 NtClose,	1_2_0042C9C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272B60 NtClose,LdrInitializeThunk,	1_2_03272B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03272DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032735C0 NtCreateMutant,LdrInitializeThunk,	1_2_032735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03274340 NtSetContextThread,	1_2_03274340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03274650 NtSuspendThread,	1_2_03274650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BA0 NtEnumerateValueKey,	1_2_03272BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272B80 NtQueryInformationFile,	1_2_03272B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BE0 NtQueryValueKey,	1_2_03272BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BF0 NtAllocateVirtualMemory,	1_2_03272BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AB0 NtWaitForSingleObject,	1_2_03272AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AF0 NtWriteFile,	1_2_03272AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AD0 NtReadFile,	1_2_03272AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F30 NtCreateSection,	1_2_03272F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F60 NtCreateProcessEx,	1_2_03272F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FA0 NtQuerySection,	1_2_03272FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FB0 NtResumeThread,	1_2_03272FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F90 NtProtectVirtualMemory,	1_2_03272F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FE0 NtCreateFile,	1_2_03272FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272E30 NtWriteVirtualMemory,	1_2_03272E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272EA0 NtAdjustPrivilegesToken,	1_2_03272EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272E80 NtReadVirtualMemory,	1_2_03272E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272EE0 NtQueueApcThread,	1_2_03272EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D30 NtUnmapViewOfSection,	1_2_03272D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D00 NtSetInformationFile,	1_2_03272D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D10 NtMapViewOfSection,	1_2_03272D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DB0 NtEnumerateKey,	1_2_03272DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DD0 NtDelayExecution,	1_2_03272DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C00 NtQueryInformationProcess,	1_2_03272C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C60 NtCreateKey,	1_2_03272C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C70 NtFreeVirtualMemory,	1_2_03272C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CA0 NtQueryInformationToken,	1_2_03272CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CF0 NtOpenProcess,	1_2_03272CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CC0 NtQueryVirtualMemory,	1_2_03272CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273010 NtOpenDirectoryObject,	1_2_03273010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273090 NtSetValueKey,	1_2_03273090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032739B0 NtGetContextThread,	1_2_032739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273D10 NtOpenProcessToken,	1_2_03273D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273D70 NtOpenThread,	1_2_03273D70

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B1A279: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00B1A279

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B08638 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00B08638

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B15264 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00B15264

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ABE800	0_2_00ABE800
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADDAF5	0_2_00ADDAF5
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ABE060	0_2_00ABE060
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AC4140	0_2_00AC4140
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AD2345	0_2_00AD2345
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B30465	0_2_00B30465
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AE6452	0_2_00AE6452
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AE25AE	0_2_00AE25AE
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AD277A	0_2_00AD277A
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B308E2	0_2_00B308E2
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AC6841	0_2_00AC6841
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AE69C4	0_2_00AE69C4
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B18932	0_2_00B18932
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B0E928	0_2_00B0E928
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AE890F	0_2_00AE890F
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AC8968	0_2_00AC8968
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADCCA1	0_2_00ADCCA1
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AE6F36	0_2_00AE6F36
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AC70FE	0_2_00AC70FE
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AC3190	0_2_00AC3190
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AB1287	0_2_00AB1287
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADF359	0_2_00ADF359
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AC5680	0_2_00AC5680
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AD1604	0_2_00AD1604
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AC58C0	0_2_00AC58C0
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AD7813	0_2_00AD7813
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AD1AF8	0_2_00AD1AF8
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AE9C35	0_2_00AE9C35
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B37E0D	0_2_00B37E0D
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ABFE40	0_2_00ABFE40
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADBF26	0_2_00ADBF26
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AD1F10	0_2_00AD1F10
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00D19FF0	0_2_00D19FF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004100D3	1_2_004100D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004100D2	1_2_004100D2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401190	1_2_00401190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402250	1_2_00402250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E2D3	1_2_0040E2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004102F3	1_2_004102F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416A8E	1_2_00416A8E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416A93	1_2_00416A93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402B19	1_2_00402B19
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402B20	1_2_00402B20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402449	1_2_00402449
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E417	1_2_0040E417
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E423	1_2_0040E423
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040242E	1_2_0040242E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402430	1_2_00402430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402F80	1_2_00402F80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EFB3	1_2_0042EFB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA352	1_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033003E6	1_2_033003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C02C0	1_2_032C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230100	1_2_03230100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C8158	1_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F41A2	1_2_032F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033001AA	1_2_033001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F81CC	1_2_032F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264750	1_2_03264750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323C7C0	1_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325C6E0	1_2_0325C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03300591	1_2_03300591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4420	1_2_032E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F2446	1_2_032F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EE4F6	1_2_032EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FAB40	1_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F6BD7	1_2_032F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330A9A6	1_2_0330A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324A840	1_2_0324A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03242840	1_2_03242840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032268B8	1_2_032268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E8F0	1_2_0326E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03282F28	1_2_03282F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260F30	1_2_03260F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E2F30	1_2_032E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4F40	1_2_032B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BEFA0	1_2_032BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232FC8	1_2_03232FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FEE26	1_2_032FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240E59	1_2_03240E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252E90	1_2_03252E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FCE93	1_2_032FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FEEDB	1_2_032FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324AD00	1_2_0324AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DCD1F	1_2_032DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03258DBF	1_2_03258DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323ADE0	1_2_0323ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240C00	1_2_03240C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0CB5	1_2_032E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230CF2	1_2_03230CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F132D	1_2_032F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322D34C	1_2_0322D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0328739A	1_2_0328739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032452A0	1_2_032452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E12ED	1_2_032E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325B2C0	1_2_0325B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327516C	1_2_0327516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322F172	1_2_0322F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330B16B	1_2_0330B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324B1B0	1_2_0324B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F70E9	1_2_032F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF0E0	1_2_032FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EF0CC	1_2_032EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032470C0	1_2_032470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF7B0	1_2_032FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03285630	1_2_03285630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F16CC	1_2_032F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7571	1_2_032F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DD5B0	1_2_032DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033095C3	1_2_033095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF43F	1_2_032FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03231460	1_2_03231460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFB76	1_2_032FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325FB80	1_2_0325FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B5BF0	1_2_032B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327DBF9	1_2_0327DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B3A6C	1_2_032B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFA49	1_2_032FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7A46	1_2_032F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DDAAC	1_2_032DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03285AA0	1_2_03285AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E1AA3	1_2_032E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EDAC6	1_2_032EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D5910	1_2_032D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03249950	1_2_03249950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325B950	1_2_0325B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AD800	1_2_032AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032438E0	1_2_032438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFF09	1_2_032FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFFB1	1_2_032FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03241F92	1_2_03241F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03203FD2	1_2_03203FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03203FD5	1_2_03203FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03249EB0	1_2_03249EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7D73	1_2_032F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03243D40	1_2_03243D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F1D5A	1_2_032F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325FDC0	1_2_0325FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B9C32	1_2_032B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFCF2	1_2_032FFCF2

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03287E54 appears 108 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03275130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0322B970 appears 265 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032BF290 appears 105 times
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: String function: 00AD8A80 appears 42 times
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: String function: 00AB7F41 appears 35 times
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: String function: 00AD0C63 appears 70 times

Source: z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692215589.0000000003693000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs z37CurriculumVitaeIsabelGonzalez.exe
Source: z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1693027930.000000000383D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs z37CurriculumVitaeIsabelGonzalez.exe

Source: z37CurriculumVitaeIsabelGonzalez.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@3/4@0/0

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B1A0F4 GetLastError,FormatMessageW,

0_2_00B1A0F4

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B084F3 AdjustTokenPrivileges,CloseHandle,		0_2_00B084F3
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B08AA3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00B08AA3

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B1B3BF SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00B1B3BF

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B2EF21 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B2EF21

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B284D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00B284D0

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AB4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00AB4FE9

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

File created: C:\Users\user\AppData\Local\Temp\aut69DA.tmp

Jump to behavior

Source: z37CurriculumVitaeIsabelGonzalez.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z37CurriculumVitaeIsabelGonzalez.exe

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe"
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe"
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe"	Jump to behavior

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: z37CurriculumVitaeIsabelGonzalez.exe

Static file information: File size 1183232 > 1048576

Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: z37CurriculumVitaeIsabelGonzalez.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692672154.0000000003710000.00000004.00001000.00020000.00000000.sdmp, z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692925341.0000000003570000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2019823966.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2351336591.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2351336591.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021938398.0000000003000000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692672154.0000000003710000.00000004.00001000.00020000.00000000.sdmp, z37CurriculumVitaeIsabelGonzalez.exe, 00000000.00000003.1692925341.0000000003570000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.2019823966.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2351336591.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2351336591.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2021938398.0000000003000000.00000004.00000020.00020000.00000000.sdmp

Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: z37CurriculumVitaeIsabelGonzalez.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B2C104 LoadLibraryA,GetProcAddress,

0_2_00B2C104

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B18538 push FFFFFF8Bh; iretd	0_2_00B1853A
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADE88F push edi; ret	0_2_00ADE891
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADE9A8 push esi; ret	0_2_00ADE9AA
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AD8AC5 push ecx; ret	0_2_00AD8AD8
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADEB83 push esi; ret	0_2_00ADEB85
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADEC6C push edi; ret	0_2_00ADEC6E
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00D16013 pushad ; retf	0_2_00D1606D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00422952 push esi; ret	1_2_0042295A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004031F0 push eax; ret	1_2_004031F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004252F3 push esp; retf	1_2_00425304
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041EB4C push ebp; ret	1_2_0041EBEC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413B13 push eax; ret	1_2_00413B4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D3F3 push es; ret	1_2_0040D3F4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041EB90 push ebp; ret	1_2_0041EBEC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041EC10 push ebp; ret	1_2_0041EBEC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0320225F pushad ; ret	1_2_032027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032027FA pushad ; ret	1_2_032027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD push ecx; mov dword ptr [esp], ecx	1_2_032309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0320283D push eax; iretd	1_2_03202858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0320135E push eax; iretd	1_2_03201369

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00AB4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00AB4A35
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B353DF IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00B353DF

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

API/Special instruction interceptor: Address: D19C14

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0327096E rdtsc

1_2_0327096E

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	API coverage: 4.9 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 6900

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1449B GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B1449B
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1C7E8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B1C7E8
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1C75D FindFirstFileW,FindClose,	0_2_00B1C75D
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1F021 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B1F021
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1F17E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B1F17E
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1F47F FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B1F47F
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B13833 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B13833
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B13B56 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B13B56
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B1BD48 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B1BD48

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AB4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AB4AFE

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

API call chain: ExitProcess graph end node

graph_0-97633

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0327096E rdtsc

1_2_0327096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417A23 LdrLoadDll,

1_2_00417A23

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B2401F BlockInput,

0_2_00B2401F

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AB3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AB3B4C

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AE5BFC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00AE5BFC

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B2C104 LoadLibraryA,GetProcAddress,

0_2_00B2C104

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00D18870 mov eax, dword ptr fs:[00000030h]	0_2_00D18870
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00D19EE0 mov eax, dword ptr fs:[00000030h]	0_2_00D19EE0
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00D19E80 mov eax, dword ptr fs:[00000030h]	0_2_00D19E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03308324 mov eax, dword ptr fs:[00000030h]	1_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03308324 mov ecx, dword ptr fs:[00000030h]	1_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03308324 mov eax, dword ptr fs:[00000030h]	1_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03308324 mov eax, dword ptr fs:[00000030h]	1_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C310 mov ecx, dword ptr fs:[00000030h]	1_2_0322C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250310 mov ecx, dword ptr fs:[00000030h]	1_2_03250310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D437C mov eax, dword ptr fs:[00000030h]	1_2_032D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov ecx, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA352 mov eax, dword ptr fs:[00000030h]	1_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D8350 mov ecx, dword ptr fs:[00000030h]	1_2_032D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330634F mov eax, dword ptr fs:[00000030h]	1_2_0330634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325438F mov eax, dword ptr fs:[00000030h]	1_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325438F mov eax, dword ptr fs:[00000030h]	1_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032663FF mov eax, dword ptr fs:[00000030h]	1_2_032663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC3CD mov eax, dword ptr fs:[00000030h]	1_2_032EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B63C0 mov eax, dword ptr fs:[00000030h]	1_2_032B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D43D4 mov eax, dword ptr fs:[00000030h]	1_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D43D4 mov eax, dword ptr fs:[00000030h]	1_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322823B mov eax, dword ptr fs:[00000030h]	1_2_0322823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322826B mov eax, dword ptr fs:[00000030h]	1_2_0322826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B8243 mov eax, dword ptr fs:[00000030h]	1_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B8243 mov ecx, dword ptr fs:[00000030h]	1_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330625D mov eax, dword ptr fs:[00000030h]	1_2_0330625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A250 mov eax, dword ptr fs:[00000030h]	1_2_0322A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236259 mov eax, dword ptr fs:[00000030h]	1_2_03236259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA250 mov eax, dword ptr fs:[00000030h]	1_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA250 mov eax, dword ptr fs:[00000030h]	1_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402A0 mov eax, dword ptr fs:[00000030h]	1_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402A0 mov eax, dword ptr fs:[00000030h]	1_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E284 mov eax, dword ptr fs:[00000030h]	1_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E284 mov eax, dword ptr fs:[00000030h]	1_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033062D6 mov eax, dword ptr fs:[00000030h]	1_2_033062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260124 mov eax, dword ptr fs:[00000030h]	1_2_03260124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov ecx, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F0115 mov eax, dword ptr fs:[00000030h]	1_2_032F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304164 mov eax, dword ptr fs:[00000030h]	1_2_03304164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304164 mov eax, dword ptr fs:[00000030h]	1_2_03304164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov ecx, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C156 mov eax, dword ptr fs:[00000030h]	1_2_0322C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C8158 mov eax, dword ptr fs:[00000030h]	1_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236154 mov eax, dword ptr fs:[00000030h]	1_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236154 mov eax, dword ptr fs:[00000030h]	1_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03270185 mov eax, dword ptr fs:[00000030h]	1_2_03270185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC188 mov eax, dword ptr fs:[00000030h]	1_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC188 mov eax, dword ptr fs:[00000030h]	1_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4180 mov eax, dword ptr fs:[00000030h]	1_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4180 mov eax, dword ptr fs:[00000030h]	1_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033061E5 mov eax, dword ptr fs:[00000030h]	1_2_033061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032601F8 mov eax, dword ptr fs:[00000030h]	1_2_032601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F61C3 mov eax, dword ptr fs:[00000030h]	1_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F61C3 mov eax, dword ptr fs:[00000030h]	1_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A020 mov eax, dword ptr fs:[00000030h]	1_2_0322A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C020 mov eax, dword ptr fs:[00000030h]	1_2_0322C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6030 mov eax, dword ptr fs:[00000030h]	1_2_032C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4000 mov ecx, dword ptr fs:[00000030h]	1_2_032B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325C073 mov eax, dword ptr fs:[00000030h]	1_2_0325C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232050 mov eax, dword ptr fs:[00000030h]	1_2_03232050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6050 mov eax, dword ptr fs:[00000030h]	1_2_032B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032280A0 mov eax, dword ptr fs:[00000030h]	1_2_032280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C80A8 mov eax, dword ptr fs:[00000030h]	1_2_032C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F60B8 mov eax, dword ptr fs:[00000030h]	1_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323208A mov eax, dword ptr fs:[00000030h]	1_2_0323208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0322A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032380E9 mov eax, dword ptr fs:[00000030h]	1_2_032380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B60E0 mov eax, dword ptr fs:[00000030h]	1_2_032B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0322C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032720F0 mov ecx, dword ptr fs:[00000030h]	1_2_032720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B20DE mov eax, dword ptr fs:[00000030h]	1_2_032B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C720 mov eax, dword ptr fs:[00000030h]	1_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C720 mov eax, dword ptr fs:[00000030h]	1_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov eax, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov ecx, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov eax, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AC730 mov eax, dword ptr fs:[00000030h]	1_2_032AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C700 mov eax, dword ptr fs:[00000030h]	1_2_0326C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230710 mov eax, dword ptr fs:[00000030h]	1_2_03230710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260710 mov eax, dword ptr fs:[00000030h]	1_2_03260710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238770 mov eax, dword ptr fs:[00000030h]	1_2_03238770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov esi, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov eax, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov eax, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230750 mov eax, dword ptr fs:[00000030h]	1_2_03230750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE75D mov eax, dword ptr fs:[00000030h]	1_2_032BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272750 mov eax, dword ptr fs:[00000030h]	1_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272750 mov eax, dword ptr fs:[00000030h]	1_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4755 mov eax, dword ptr fs:[00000030h]	1_2_032B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032307AF mov eax, dword ptr fs:[00000030h]	1_2_032307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E47A0 mov eax, dword ptr fs:[00000030h]	1_2_032E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D678E mov eax, dword ptr fs:[00000030h]	1_2_032D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_032BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032347FB mov eax, dword ptr fs:[00000030h]	1_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032347FB mov eax, dword ptr fs:[00000030h]	1_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B07C3 mov eax, dword ptr fs:[00000030h]	1_2_032B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E627 mov eax, dword ptr fs:[00000030h]	1_2_0324E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03266620 mov eax, dword ptr fs:[00000030h]	1_2_03266620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268620 mov eax, dword ptr fs:[00000030h]	1_2_03268620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323262C mov eax, dword ptr fs:[00000030h]	1_2_0323262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE609 mov eax, dword ptr fs:[00000030h]	1_2_032AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272619 mov eax, dword ptr fs:[00000030h]	1_2_03272619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F866E mov eax, dword ptr fs:[00000030h]	1_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F866E mov eax, dword ptr fs:[00000030h]	1_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A660 mov eax, dword ptr fs:[00000030h]	1_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A660 mov eax, dword ptr fs:[00000030h]	1_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03262674 mov eax, dword ptr fs:[00000030h]	1_2_03262674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324C640 mov eax, dword ptr fs:[00000030h]	1_2_0324C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0326C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032666B0 mov eax, dword ptr fs:[00000030h]	1_2_032666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234690 mov eax, dword ptr fs:[00000030h]	1_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234690 mov eax, dword ptr fs:[00000030h]	1_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B06F1 mov eax, dword ptr fs:[00000030h]	1_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B06F1 mov eax, dword ptr fs:[00000030h]	1_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6500 mov eax, dword ptr fs:[00000030h]	1_2_032C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238550 mov eax, dword ptr fs:[00000030h]	1_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238550 mov eax, dword ptr fs:[00000030h]	1_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032545B1 mov eax, dword ptr fs:[00000030h]	1_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032545B1 mov eax, dword ptr fs:[00000030h]	1_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232582 mov eax, dword ptr fs:[00000030h]	1_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232582 mov ecx, dword ptr fs:[00000030h]	1_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264588 mov eax, dword ptr fs:[00000030h]	1_2_03264588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E59C mov eax, dword ptr fs:[00000030h]	1_2_0326E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032325E0 mov eax, dword ptr fs:[00000030h]	1_2_032325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C5ED mov eax, dword ptr fs:[00000030h]	1_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C5ED mov eax, dword ptr fs:[00000030h]	1_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E5CF mov eax, dword ptr fs:[00000030h]	1_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E5CF mov eax, dword ptr fs:[00000030h]	1_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032365D0 mov eax, dword ptr fs:[00000030h]	1_2_032365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C427 mov eax, dword ptr fs:[00000030h]	1_2_0322C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A430 mov eax, dword ptr fs:[00000030h]	1_2_0326A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC460 mov ecx, dword ptr fs:[00000030h]	1_2_032BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA456 mov eax, dword ptr fs:[00000030h]	1_2_032EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322645D mov eax, dword ptr fs:[00000030h]	1_2_0322645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325245A mov eax, dword ptr fs:[00000030h]	1_2_0325245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032364AB mov eax, dword ptr fs:[00000030h]	1_2_032364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032644B0 mov ecx, dword ptr fs:[00000030h]	1_2_032644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_032BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA49A mov eax, dword ptr fs:[00000030h]	1_2_032EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032304E5 mov ecx, dword ptr fs:[00000030h]	1_2_032304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EB20 mov eax, dword ptr fs:[00000030h]	1_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EB20 mov eax, dword ptr fs:[00000030h]	1_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F8B28 mov eax, dword ptr fs:[00000030h]	1_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F8B28 mov eax, dword ptr fs:[00000030h]	1_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304B00 mov eax, dword ptr fs:[00000030h]	1_2_03304B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322CB7E mov eax, dword ptr fs:[00000030h]	1_2_0322CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4B4B mov eax, dword ptr fs:[00000030h]	1_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4B4B mov eax, dword ptr fs:[00000030h]	1_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6B40 mov eax, dword ptr fs:[00000030h]	1_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6B40 mov eax, dword ptr fs:[00000030h]	1_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FAB40 mov eax, dword ptr fs:[00000030h]	1_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D8B42 mov eax, dword ptr fs:[00000030h]	1_2_032D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228B50 mov eax, dword ptr fs:[00000030h]	1_2_03228B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEB50 mov eax, dword ptr fs:[00000030h]	1_2_032DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240BBE mov eax, dword ptr fs:[00000030h]	1_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240BBE mov eax, dword ptr fs:[00000030h]	1_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EBFC mov eax, dword ptr fs:[00000030h]	1_2_0325EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_032BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_032DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA24 mov eax, dword ptr fs:[00000030h]	1_2_0326CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EA2E mov eax, dword ptr fs:[00000030h]	1_2_0325EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03254A35 mov eax, dword ptr fs:[00000030h]	1_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03254A35 mov eax, dword ptr fs:[00000030h]	1_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA38 mov eax, dword ptr fs:[00000030h]	1_2_0326CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BCA11 mov eax, dword ptr fs:[00000030h]	1_2_032BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEA60 mov eax, dword ptr fs:[00000030h]	1_2_032DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032ACA72 mov eax, dword ptr fs:[00000030h]	1_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032ACA72 mov eax, dword ptr fs:[00000030h]	1_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240A5B mov eax, dword ptr fs:[00000030h]	1_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240A5B mov eax, dword ptr fs:[00000030h]	1_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238AA0 mov eax, dword ptr fs:[00000030h]	1_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238AA0 mov eax, dword ptr fs:[00000030h]	1_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286AA4 mov eax, dword ptr fs:[00000030h]	1_2_03286AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304A80 mov eax, dword ptr fs:[00000030h]	1_2_03304A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268A90 mov edx, dword ptr fs:[00000030h]	1_2_03268A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326AAEE mov eax, dword ptr fs:[00000030h]	1_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326AAEE mov eax, dword ptr fs:[00000030h]	1_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230AD0 mov eax, dword ptr fs:[00000030h]	1_2_03230AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264AD0 mov eax, dword ptr fs:[00000030h]	1_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264AD0 mov eax, dword ptr fs:[00000030h]	1_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B892A mov eax, dword ptr fs:[00000030h]	1_2_032B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C892B mov eax, dword ptr fs:[00000030h]	1_2_032C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE908 mov eax, dword ptr fs:[00000030h]	1_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE908 mov eax, dword ptr fs:[00000030h]	1_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC912 mov eax, dword ptr fs:[00000030h]	1_2_032BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228918 mov eax, dword ptr fs:[00000030h]	1_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228918 mov eax, dword ptr fs:[00000030h]	1_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov eax, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov edx, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov eax, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4978 mov eax, dword ptr fs:[00000030h]	1_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4978 mov eax, dword ptr fs:[00000030h]	1_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC97C mov eax, dword ptr fs:[00000030h]	1_2_032BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0946 mov eax, dword ptr fs:[00000030h]	1_2_032B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304940 mov eax, dword ptr fs:[00000030h]	1_2_03304940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD mov eax, dword ptr fs:[00000030h]	1_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD mov eax, dword ptr fs:[00000030h]	1_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov esi, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov eax, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov eax, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_032BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032629F9 mov eax, dword ptr fs:[00000030h]	1_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032629F9 mov eax, dword ptr fs:[00000030h]	1_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C69C0 mov eax, dword ptr fs:[00000030h]	1_2_032C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032649D0 mov eax, dword ptr fs:[00000030h]	1_2_032649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_032FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov ecx, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A830 mov eax, dword ptr fs:[00000030h]	1_2_0326A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D483A mov eax, dword ptr fs:[00000030h]	1_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D483A mov eax, dword ptr fs:[00000030h]	1_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC810 mov eax, dword ptr fs:[00000030h]	1_2_032BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE872 mov eax, dword ptr fs:[00000030h]	1_2_032BE872

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B081D4 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00B081D4

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADA2A4 SetUnhandledExceptionFilter,		0_2_00ADA2A4
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00ADA2D5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00ADA2D5

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2710008

Jump to behavior

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B08A73 LogonUserW,

0_2_00B08A73

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AB3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AB3B4C

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AB4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00AB4A35

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B14CFA mouse_event,

0_2_00B14CFA

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe"

Jump to behavior

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

0_2_00B081D4

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00B14A08 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00B14A08

Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AD87AB cpuid

0_2_00AD87AB

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AE5007 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00AE5007

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AF215F GetUserNameW,

0_2_00AF215F

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AE40BA __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00AE40BA

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe

Code function: 0_2_00AB4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AB4AFE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2351028222.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2351306500.0000000003080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: WIN_81
Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: WIN_XP
Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: WIN_XPe
Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: WIN_VISTA
Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: WIN_7
Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: WIN_8
Source: z37CurriculumVitaeIsabelGonzalez.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2351028222.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2351306500.0000000003080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B26399 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00B26399
Source: C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe	Code function: 0_2_00B2685D socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00B2685D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	21 Input Capture	2 System Time Discovery	Remote Services	21 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	LSASS Memory	15 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	21 Access Token Manipulation	2 Virtualization/Sandbox Evasion	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	212 Process Injection	21 Access Token Manipulation	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	212 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	115 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z37CurriculumVitaeIsabelGonzalez.exe	21%	ReversingLabs	Win32.Trojan.AutoitInject
z37CurriculumVitaeIsabelGonzalez.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579936
Start date and time:	2024-12-23 16:07:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z37CurriculumVitaeIsabelGonzalez.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@3/4@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 59 Number of non-executed functions: 272
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: z37CurriculumVitaeIsabelGonzalez.exe

Process:	C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	172054
Entropy (8bit):	3.181092087628872
Encrypted:	false
SSDEEP:	48:sb3feqfCpfS6ftqfA0f9fWf9fZ1fi20fq0fFfY6fofi51fK0fi0fCfZ1fK0f70fL:iaNhCHcZLfaDfJQNy7Ha6yCkJ0FZIklX
MD5:	7063D89C64D778F86C16A9E343488B56
SHA1:	5BD12F313C58BCFF01342F4AC689F60E3D41A461
SHA-256:	DF6AED00078DB8C50D34BF629513B66077F2751E0378E7F3045EC9A79144EB5C
SHA-512:	69BC4FE51C3AD8C765A1F21534A708CA308C5584BF27DDC9511C1483882E91C28694D7E8562FFDF303C5A8655B3240154478361269ACBEC60483B1AE23DDDE9C
Malicious:	false
Reputation:	low
Preview:	hixjs0hixjsxhixjs5hixjs5hixjs8hixjsbhixjsehixjschixjs8hixjs1hixjsehixjschixjschixjschixjs0hixjs2hixjs0hixjs0hixjs0hixjs0hixjs5hixjs6hixjs5hixjs7hixjsbhixjs8hixjs6hixjsbhixjs0hixjs0hixjs0hixjs0hixjs0hixjs0hixjs6hixjs6hixjs8hixjs9hixjs4hixjs5hixjs8hixjs4hixjsbhixjs9hixjs6hixjs5hixjs0hixjs0hixjs0hixjs0hixjs0hixjs0hixjs6hixjs6hixjs8hixjs9hixjs4hixjsdhixjs8hixjs6hixjsbhixjsahixjs7hixjs2hixjs0hixjs0hixjs0hixjs0hixjs0hixjs0hixjs6hixjs6hixjs8hixjs9hixjs5hixjs5hixjs8hixjs8hixjsbhixjs8hixjs6hixjsehixjs0hixjs0hixjs0hixjs0hixjs0hixjs0hixjs6hixjs6hixjs8hixjs9hixjs4hixjs5hixjs8hixjsahixjsbhixjs9hixjs6hixjs5hixjs0hixjs0hixjs0hixjs0hixjs0hixjs0hixjs6hixjs6hixjs8hixjs9hixjs4hixjsdhixjs8hixjschixjsbhixjsahixjs6hixjschixjs0hixjs0hixjs0hixjs0hixjs0hixjs0hixjs6hixjs6hixjs8hixjs9hixjs5hixjs5hixjs8hixjsehixjsbhixjs8hixjs3hixjs3hixjs0hixjs0hixjs0hixjs0hixjs0hixjs0hixjs6hixjs6hixjs8hixjs9hixjs4hixjs5hixjs9hixjs0hixjsbhixjs9hixjs3hixjs2hixjs0hixjs0hixjs0hixjs0hixjs0hixjs0hixjs6hixjs6hixjs8hixjs9hixjs4hixjsdhixj

C:\Users\user\AppData\Local\Temp\aut69DA.tmp

Download File

Process:	C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe
File Type:	data
Category:	dropped
Size (bytes):	15020
Entropy (8bit):	7.581048659255774
Encrypted:	false
SSDEEP:	384:M9/RwgFdNQgZsxLOxw37junLf45nP/0w5blUYd9Gpp:MR/fQgOOQfgcnPceBBqpp
MD5:	692ECBDB4E6518580D2CFD455000E13E
SHA1:	2AA74C276B06DD7C2F70FA9743817B48AD7B8227
SHA-256:	FBE8DA0F7751B56809C51B6E071F29233E7985E7898A8AE968EF75DC19D07532
SHA-512:	E8E50FDA706BD372644681CC9624891ABBE6749BCB47C9CC20571A06240993333EF3C0D9D8D96D832CDBA82D2DC595DF496B4E4A33CDE7D29300CEC83518414A
Malicious:	false
Reputation:	low
Preview:	EA06.....Zo.........SP.n......5e...`.....\|....T...3...(.6&.....9vp.=...G.....7@..9......$..k...........c}V.....?.P...p...Y@Q?.{..'..c.D.&.N. .'.9e.D.&`...D..' ...D...s...D...S.(......sP...h...M.Q?.y..G.c.D....Q.......O......60..........vh...0.7..!.....)^...t.C........$..C......l>[......!....\|.0...&d.....Hz..a....l?..uo.....P......V0....j......\|......l.....A.?.. Bg.8.l.E..Ed.L...?.. Bg.....Y..>@.............@..'.....8\|.?..u.........l. O..]e...O..!e...& ....#s.......3.Y....9.......9..M.7?............l?...F..........C7....g .........x2..8.a...?..j..+4.....W?..j....Y..M. ?.0....Q...d}S0{.......M.".@...Z........V....n.....Q>...'.N...r..(.-........0W.........(....... 6..p.....6zh......?.....O8....lCN....i..?..8}@L..E.i.....61...f#q....>.N....4..M.Q?.q.........D..0N..V.A..M.>K0i..d.h.&...%.Y...\|...<..aw.].3c..H.@B?...G..1...' ....k\|.A.O..#.....}V`....#..H\|.P!..d....0z....Y..>K..G./....G.7c.H..b....W..1....?.01..b.!...@.?..o.F\|....p9......S.!..nb.!....zb0..

C:\Users\user\AppData\Local\Temp\aut6A77.tmp

Download File

Process:	C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.995202592634109
Encrypted:	true
SSDEEP:	6144:393Zj6+FcjIyG1k31pByg4OKq4+x85cqCUv7VwbE5KrQC:39pj6w8H3XByXn+x85VCUD2okMC
MD5:	A05BCA2EC1756C2A2F7782C98DA1B0C3
SHA1:	1850C225BC149BD8B584074DA12D4B42BB6E7AD3
SHA-256:	398D51B21AA49DF70D71469DBFEA4B3DBD1D38771742647DC15C3B713FF3A708
SHA-512:	CC30F2CE486C982737736293D5CE44F70D6D57137E2BD878DA88864F93E31580EDE897A02C737E303FB0BA704B4B56C4C82D2C6B8FE235B15630C52BF372DE39
Malicious:	false
Reputation:	low
Preview:	...7ESLSRU38..8Q.0R6YCZ7.SLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6.CZ7HL.]V.:.m.9....^00zG4<+!78.[-/V>7.0Sy1/Yf:"s..`.!.\4m=_<}CZ7FSLS/T:.q!_.~P5.d#=.\..l5T.V..P5.C...z3+..<PPq!_.C0R6YCZ7..LS.T28%..1C0R6YCZ7.SNR]T88L.<QC0R6YCZ76GLSVE38L1<QC0.6YSZ7FQLSPU38LA8QE0R6YCZ7F#HSVW38LA8QA0..YCJ7FCLSVU#8LQ8QC0R6ICZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38b5])70R6..^7FCLSV.78LQ8QC0R6YCZ7FSLSvU3XLA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6

C:\Users\user\AppData\Local\Temp\teres

Download File

Process:	C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.995202592634109
Encrypted:	true
SSDEEP:	6144:393Zj6+FcjIyG1k31pByg4OKq4+x85cqCUv7VwbE5KrQC:39pj6w8H3XByXn+x85VCUD2okMC
MD5:	A05BCA2EC1756C2A2F7782C98DA1B0C3
SHA1:	1850C225BC149BD8B584074DA12D4B42BB6E7AD3
SHA-256:	398D51B21AA49DF70D71469DBFEA4B3DBD1D38771742647DC15C3B713FF3A708
SHA-512:	CC30F2CE486C982737736293D5CE44F70D6D57137E2BD878DA88864F93E31580EDE897A02C737E303FB0BA704B4B56C4C82D2C6B8FE235B15630C52BF372DE39
Malicious:	false
Reputation:	low
Preview:	...7ESLSRU38..8Q.0R6YCZ7.SLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6.CZ7HL.]V.:.m.9....^00zG4<+!78.[-/V>7.0Sy1/Yf:"s..`.!.\4m=_<}CZ7FSLS/T:.q!_.~P5.d#=.\..l5T.V..P5.C...z3+..<PPq!_.C0R6YCZ7..LS.T28%..1C0R6YCZ7.SNR]T88L.<QC0R6YCZ76GLSVE38L1<QC0.6YSZ7FQLSPU38LA8QE0R6YCZ7F#HSVW38LA8QA0..YCJ7FCLSVU#8LQ8QC0R6ICZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38b5])70R6..^7FCLSV.78LQ8QC0R6YCZ7FSLSvU3XLA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6YCZ7FSLSVU38LA8QC0R6

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.164331304312863
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	z37CurriculumVitaeIsabelGonzalez.exe
File size:	1'183'232 bytes
MD5:	cebc14097108206cf2149465b7ac4a23
SHA1:	033a1ef67618c81ecc07d2be9816c387e00226c2
SHA256:	59f94ff9fa02e65e2ccaa22af592a32088ed265f82b43a369ef811150f65b381
SHA512:	f7bd2f64c567aa09aeec24659213862a020e5b6ecffa517487bacdf0c14d73d4d7734eca104adfc7d98d0a99a9f2710b3f76c56f61115c4206421e6cc7353604
SSDEEP:	24576:aCdxte/80jYLT3U1jfsWatZ6Wy2Gh8j6/6VKQ:7w80cTsjkWatZ612Gh8jH
TLSH:	DA45CE2273DDC371CB769173BF6AB7012EBB78610630B85B1F881D7DA950161262DBA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427f4a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67696D79 [Mon Dec 23 14:02:33 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007EFDA4F07D4Dh
jmp 00007EFDA4EFAB14h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007EFDA4EFAC9Ah
cmp edi, eax
jc 00007EFDA4EFAFFEh
bt dword ptr [004C31FCh], 01h
jnc 00007EFDA4EFAC99h
rep movsb
jmp 00007EFDA4EFAFACh
cmp ecx, 00000080h
jc 00007EFDA4EFAE64h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007EFDA4EFACA0h
bt dword ptr [004BE324h], 01h
jc 00007EFDA4EFB170h
bt dword ptr [004C31FCh], 00000000h
jnc 00007EFDA4EFAE3Dh
test edi, 00000003h
jne 00007EFDA4EFAE4Eh
test esi, 00000003h
jne 00007EFDA4EFAE2Dh
bt edi, 02h
jnc 00007EFDA4EFAC9Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007EFDA4EFACA3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007EFDA4EFACF5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x58508	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x120000	0x7130	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dd2e	0x8de00	c2c2260508750422d20cd5cbb116b146	False	0.5729952505506608	data	6.675875439961112	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	4513b58651e3d8d87c81a396e5b2f1d1	False	0.3353340955284553	OpenPGP Public Key	5.760731648769018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	c2de4a3d214eae7e87c7bfc06bd79775	False	0.1017530487804878	data	1.1988106744719143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x58508	0x58600	bc78d3fb726e1ed1f05b3175aaa7ead9	False	0.9255353827793493	data	7.888738586332471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x120000	0x7130	0x7200	1254908a9a03d2bcf12045d49cd572b9	False	0.7703536184210527	data	6.782377328042204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x4f7ce	data			1.0003255708239398
RT_GROUP_ICON	0x11ef88	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11f000	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11f014	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11f028	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11f03c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11f118	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Target ID:	0
Start time:	10:08:32
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe"
Imagebase:	0xab0000
File size:	1'183'232 bytes
MD5 hash:	CEBC14097108206CF2149465B7AC4A23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:08:33
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z37CurriculumVitaeIsabelGonzalez.exe"
Imagebase:	0x520000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2351028222.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2351306500.0000000003080000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	32

Executed Functions

Function 00AB3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AB3B7A
IsDebuggerPresent.KERNEL32 ref: 00AB3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00B752F8,00B752E0,?,?), ref: 00AB3BFD

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

Part of subcall function 00AC0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00AB3C26,00B752F8,?,?,?), ref: 00AC0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00AB3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00B67770,00000010), ref: 00AED3EC
SetCurrentDirectoryW.KERNEL32(?,00B752F8,?,?,?), ref: 00AED424
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00B64260,00B752F8,?,?,?), ref: 00AED4AA
ShellExecuteW.SHELL32(00000000,?,?), ref: 00AED4B1

Part of subcall function 00AB3A58: GetSysColorBrush.USER32(0000000F), ref: 00AB3A62
Part of subcall function 00AB3A58: LoadCursorW.USER32(00000000,00007F00), ref: 00AB3A71
Part of subcall function 00AB3A58: LoadIconW.USER32(00000063), ref: 00AB3A88
Part of subcall function 00AB3A58: LoadIconW.USER32(000000A4), ref: 00AB3A9A
Part of subcall function 00AB3A58: LoadIconW.USER32(000000A2), ref: 00AB3AAC
Part of subcall function 00AB3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AB3AD2
Part of subcall function 00AB3A58: RegisterClassExW.USER32(?), ref: 00AB3B28

Part of subcall function 00AB39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AB3A15
Part of subcall function 00AB39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AB3A36
Part of subcall function 00AB39E7: ShowWindow.USER32(00000000,?,?), ref: 00AB3A4A
Part of subcall function 00AB39E7: ShowWindow.USER32(00000000,?,?), ref: 00AB3A53

Part of subcall function 00AB43DB: _memset.LIBCMT ref: 00AB4401
Part of subcall function 00AB43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AB44A6

Strings

runas, xrefs: 00AED4A5
This is a third-party compiled AutoIt script., xrefs: 00AED3E4

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 863763156a910cce816cb06b99cd4063776e777ec1e75d9a98e0c5640d495701
Instruction ID: a9618fd3a8f6b2a9d3caa3767a17cc03a2e4e982ada87b112c446bffdebd1187
Opcode Fuzzy Hash: 863763156a910cce816cb06b99cd4063776e777ec1e75d9a98e0c5640d495701
Instruction Fuzzy Hash: A351C332D04649AECF21EBB4DD05AFD7BBCAF45340B1041A9F465B71A3DEB05A85CB21

Function 00AB4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00AB4B2B

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

GetCurrentProcess.KERNEL32(?,00B3FAEC,00000000,00000000,?), ref: 00AB4BF8
IsWow64Process.KERNEL32(00000000), ref: 00AB4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00AB4C45
FreeLibrary.KERNEL32(00000000), ref: 00AB4C50
GetSystemInfo.KERNEL32(00000000), ref: 00AB4C81
GetSystemInfo.KERNEL32(00000000), ref: 00AB4C8D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: b5f1a7fa35f9005817ed1b5f80e9d558be794f05ae327a591e7cb52dda606cd7
Instruction ID: 44957077f40aba17f10f31eac18c5743ae7b72dc3ac160089cbd686dce0a210c
Opcode Fuzzy Hash: b5f1a7fa35f9005817ed1b5f80e9d558be794f05ae327a591e7cb52dda606cd7
Instruction Fuzzy Hash: A391C43154ABC0DEC731CB6895511EAFFF8AF2A300B584A9DD0CB93A43D630E948D759

Function 00AB4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00AB4EEE,?,?,00000000,00000000), ref: 00AB4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00AB4EEE,?,?,00000000,00000000), ref: 00AB5010
LoadResource.KERNEL32(?,00000000,?,?,00AB4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00AB4F8F), ref: 00AEDC90
SizeofResource.KERNEL32(?,00000000,?,?,00AB4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00AB4F8F), ref: 00AEDCA5
LockResource.KERNEL32(00AB4EEE,?,?,00AB4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00AB4F8F,00000000), ref: 00AEDCB8

Strings

SCRIPT, xrefs: 00AB5006

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: e6c4cde888b18b45ed7e64dbd9a4196e352f99485c42a866a6ed5a127fb695c7
Instruction ID: 44633ce840fb17f36ab7448af2671721b167706cf2c515a1e7009cc592bc977a
Opcode Fuzzy Hash: e6c4cde888b18b45ed7e64dbd9a4196e352f99485c42a866a6ed5a127fb695c7
Instruction Fuzzy Hash: 15112A75A40701AFD7219B65DC58F6B7BBDEBC9B51F204169F40697260DB62E8008660

Function 00B1449B Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00AEE6F1), ref: 00B144AB
FindFirstFileW.KERNELBASE(?,?), ref: 00B144BC
FindClose.KERNEL32(00000000), ref: 00B144CC

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 0f21a9d77a830b9acfaedfe4924278f9bf3de4750db9972ee807164a07412a8e
Instruction ID: b06cb05c01ff3f7cd562671b79a7a94499b734e6a736446bc3b4d65ecdb126ec
Opcode Fuzzy Hash: 0f21a9d77a830b9acfaedfe4924278f9bf3de4750db9972ee807164a07412a8e
Instruction Fuzzy Hash: 7DE0DF32C10802AB9210AB38EC4D8FE779CEE15335F600766F939C32E0EF7499908696

Function 00ABE800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00AF41BB

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: f4af1c4a3490ac53f1e095302d8e109bfcc74dbf94928817930e0ecdbfe295cd
Instruction ID: d8277083357e958bb083a8218574321865ad0ba5a57df80f460778f90fc05628
Opcode Fuzzy Hash: f4af1c4a3490ac53f1e095302d8e109bfcc74dbf94928817930e0ecdbfe295cd
Instruction Fuzzy Hash: E3A26E75A00205CFCB24CF98C880AEEB7B9FF58310F648559E916AB352D775ED86CB90

Function 00AC0B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AC0BBB
timeGetTime.WINMM ref: 00AC0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AC0FB3
Sleep.KERNEL32(0000000A), ref: 00AC0FC1
LockWindowUpdate.USER32(00000000,?,?), ref: 00AC105A
DestroyWindow.USER32 ref: 00AC1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00AC1080
Sleep.KERNEL32(0000000A,?,?), ref: 00AF51DC
TranslateMessage.USER32(?), ref: 00AF5FB9
DispatchMessageW.USER32(?), ref: 00AF5FC7
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00AF5FDB

Strings

@COM_EVENTOBJ, xrefs: 00AF5849
@GUI_WINHANDLE, xrefs: 00AF52E8
@GUI_CTRLID, xrefs: 00AF5293
@GUI_CTRLHANDLE, xrefs: 00AF533D
@TRAY_ID, xrefs: 00AF5AE8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: e863189521941f210fcee79bbabe61261b978852b52e3c23cb065872745a8d8f
Instruction ID: cfc75288cce0d487e656373611180fa1f2463e54bd67e926dfc417514183f0a0
Opcode Fuzzy Hash: e863189521941f210fcee79bbabe61261b978852b52e3c23cb065872745a8d8f
Instruction Fuzzy Hash: C7B2BF70A08741DFD724DF64C884FAAB7E5BF84304F14495DF69A972A2DB70E885CB82

Function 00B191FE Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B19008: __time64.LIBCMT ref: 00B19012

Part of subcall function 00AB5045: _fseek.LIBCMT ref: 00AB505D

__wsplitpath.LIBCMT ref: 00B192DD

Part of subcall function 00AD426E: __wsplitpath_helper.LIBCMT ref: 00AD42AE

_wcscpy.LIBCMT ref: 00B192F0
_wcscat.LIBCMT ref: 00B19303
__wsplitpath.LIBCMT ref: 00B19328
_wcscat.LIBCMT ref: 00B1933E
_wcscat.LIBCMT ref: 00B19351

Part of subcall function 00B1904E: _memmove.LIBCMT ref: 00B19087
Part of subcall function 00B1904E: _memmove.LIBCMT ref: 00B19096

_wcscmp.LIBCMT ref: 00B19298

Part of subcall function 00B197DD: _wcscmp.LIBCMT ref: 00B198CD
Part of subcall function 00B197DD: _wcscmp.LIBCMT ref: 00B198E0

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00B194FB
_wcsncpy.LIBCMT ref: 00B1956E
DeleteFileW.KERNEL32(?,?), ref: 00B195A4
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B195BA
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B195CB
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B195DD

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 20f9ad4fba0cc822adc330dfd7249c78ed14f8f4d3eb1f43872a3607c6f55d3b
Instruction ID: 54e54c6491f49f42d9d3879729398bd717a552562c278ceda86976232f96c8f3
Opcode Fuzzy Hash: 20f9ad4fba0cc822adc330dfd7249c78ed14f8f4d3eb1f43872a3607c6f55d3b
Instruction Fuzzy Hash: A4C14BB1D00219AACF21DFA5CD95EDEBBBDEF58310F4040A6F609E7251DB309A848F65

Function 00AB3023 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AB3074
RegisterClassExW.USER32(00000030), ref: 00AB309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AB30AF
InitCommonControlsEx.COMCTL32(?), ref: 00AB30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AB30DC
LoadIconW.USER32(000000A9), ref: 00AB30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AB3101

Strings

AutoIt v3 GUI, xrefs: 00AB3090
0, xrefs: 00AB3056
TaskbarCreated, xrefs: 00AB30A4
+, xrefs: 00AB305D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 1a4830554d0d2688f77beab7864c2ac28d8e96b6e6796152ab10b1bea5759ab0
Instruction ID: 7375755ecdcfa10a0c657bc2c533a10c38e0bd0b5a8c4c7c262f3f9730830c56
Opcode Fuzzy Hash: 1a4830554d0d2688f77beab7864c2ac28d8e96b6e6796152ab10b1bea5759ab0
Instruction Fuzzy Hash: C131D6B1D4030AAFDB508FA4D885ADDBBF4FB08310F24452AE594A72A1DBB54585CF91

Function 00AB3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AB3074
RegisterClassExW.USER32(00000030), ref: 00AB309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AB30AF
InitCommonControlsEx.COMCTL32(?), ref: 00AB30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AB30DC
LoadIconW.USER32(000000A9), ref: 00AB30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AB3101

Strings

AutoIt v3 GUI, xrefs: 00AB3090
0, xrefs: 00AB3056
TaskbarCreated, xrefs: 00AB30A4
+, xrefs: 00AB305D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 30aad246f11a8859c6861a86199f61558535941a3b06f6a4719c6fd5dbbee15b
Instruction ID: c224e882fe36bc8b8fb3519fe4ee8677c8c7ca23e6d2db2fed803640619c22f0
Opcode Fuzzy Hash: 30aad246f11a8859c6861a86199f61558535941a3b06f6a4719c6fd5dbbee15b
Instruction Fuzzy Hash: 6E21C5B1D01219EFDB10DFA4E989BEDBBF4FB08700F10412AF515A72A0DBB145848FA1

Function 00AB71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AB4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B752F8,?,00AB37C0,?), ref: 00AB4882

Part of subcall function 00AD068B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00AB72C5), ref: 00AD06AD

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00AB7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00AEEC21
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00AEEC62
RegCloseKey.ADVAPI32(?), ref: 00AEECA0
_wcscat.LIBCMT ref: 00AEECF9

Strings

\Include\, xrefs: 00AB72C5
Include, xrefs: 00AEEC18, 00AEEC59
Software\AutoIt v3\AutoIt, xrefs: 00AB72FE
\, xrefs: 00AEED1C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 13976fbab9b81401e201100d5db6c186e4b45331652ec55f1ff71911ce46d72b
Instruction ID: 340c1859a7821e3fe6889b5602e015e2f981fd0d0d982754c34bd5e76fb326cb
Opcode Fuzzy Hash: 13976fbab9b81401e201100d5db6c186e4b45331652ec55f1ff71911ce46d72b
Instruction Fuzzy Hash: 1D716A715097019EC344EF25DD819ABBBE8FF98340F50492EF449972B2EF709988CB91

Function 00AB3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AB3A62
LoadCursorW.USER32(00000000,00007F00), ref: 00AB3A71
LoadIconW.USER32(00000063), ref: 00AB3A88
LoadIconW.USER32(000000A4), ref: 00AB3A9A
LoadIconW.USER32(000000A2), ref: 00AB3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AB3AD2
RegisterClassExW.USER32(?), ref: 00AB3B28

Part of subcall function 00AB3041: GetSysColorBrush.USER32(0000000F), ref: 00AB3074
Part of subcall function 00AB3041: RegisterClassExW.USER32(00000030), ref: 00AB309E
Part of subcall function 00AB3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AB30AF
Part of subcall function 00AB3041: InitCommonControlsEx.COMCTL32(?), ref: 00AB30CC
Part of subcall function 00AB3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AB30DC
Part of subcall function 00AB3041: LoadIconW.USER32(000000A9), ref: 00AB30F2
Part of subcall function 00AB3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AB3101

Strings

#, xrefs: 00AB3B0D
AutoIt v3, xrefs: 00AB3B17
0, xrefs: 00AB3B06

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: cdf9e8371a1987770befc1c9ec461c2ff5f1b495bd3b9e2998ea3ac61533b05c
Instruction ID: cd3e484018d4e40c3afdccc153e9b738ed25c290c700d1f0db7f44ef8e549e98
Opcode Fuzzy Hash: cdf9e8371a1987770befc1c9ec461c2ff5f1b495bd3b9e2998ea3ac61533b05c
Instruction Fuzzy Hash: FD212D71D00305EFEB20DFA4ED09B9D7BB5FB08711F10051AE608A72E2DBB55A909F94

Function 00AB3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00AB36D2
KillTimer.USER32(?,00000001), ref: 00AB36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AB371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AB372A
CreatePopupMenu.USER32 ref: 00AB373E
PostQuitMessage.USER32(00000000), ref: 00AB375F

Strings

TaskbarCreated, xrefs: 00AB3725

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: f1d0d4827064fb4ee7a75d96f4f48c9c7b6a07940da3d6f2e7487d1bc1737127
Instruction ID: 9822f52b45ebe5db5e1f1b231cbdcb11a81eaaa7ed4cd06c4abd2e5e8d2c3932
Opcode Fuzzy Hash: f1d0d4827064fb4ee7a75d96f4f48c9c7b6a07940da3d6f2e7487d1bc1737127
Instruction Fuzzy Hash: A8412BB3214945BBDF249F68DD09BFA37ADEB04300F140129FA06D72A3DEA1DE909761

Function 00AB3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINE, xrefs: 00AB3834
CMDLINERAW, xrefs: 00AB380D
/AutoIt3OutputDebug, xrefs: 00AB38A4
/AutoIt3ExecuteLine, xrefs: 00AB38B9
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00AB37C0
/ErrorStdOut, xrefs: 00AB388F
/AutoIt3ExecuteScript, xrefs: 00AB38CE

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: ac11ee2e642e054a8d9732c43e2b0ee0ee205bf35e8e77bbc12ec7f80941d992
Instruction ID: 25e0668cb1a6488658ecea5d5a845ba62827865965cbd5d7f9f757845d8388a2
Opcode Fuzzy Hash: ac11ee2e642e054a8d9732c43e2b0ee0ee205bf35e8e77bbc12ec7f80941d992
Instruction Fuzzy Hash: 0EA14C72C102299ADF14EFA4DD95AEEB7BCBF14300F50052AE416B7193DF749A49CB60

Function 00D18FD0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00D190A1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00D192C7

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction ID: fa75fa1f5826162c70127af1a75dc8ad2e964faca7f43fdf870e8157161ab6ec
Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction Fuzzy Hash: FDA1F674E00209FBDB14CFA4D8A8BEEF7B5BF48304F248159E515BB280DB759A85CB64

Function 00AB39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AB3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AB3A36
ShowWindow.USER32(00000000,?,?), ref: 00AB3A4A
ShowWindow.USER32(00000000,?,?), ref: 00AB3A53

Strings

edit, xrefs: 00AB3A30
AutoIt v3, xrefs: 00AB3A0D, 00AB3A12, 00AB3A13

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c0f7ce3a5c3746309e366a3b8ef7b9b0cc6582df4d0b3861790195689030c0c6
Instruction ID: 35f6ed6e341903cdf9775e5e3e9b4f6d1383d3e625e37e8215d3a96b149d7ef6
Opcode Fuzzy Hash: c0f7ce3a5c3746309e366a3b8ef7b9b0cc6582df4d0b3861790195689030c0c6
Instruction Fuzzy Hash: A9F0DA71941690BEEA315B276C49E7B3E7DD7C6F50F10412ABA08A3271CAA11891DAB0

Function 00D18DB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D18CA0: Sleep.KERNELBASE(000001F4), ref: 00D18CB1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00D18EBD

Strings

YCZ7FSLSVU38LA8QC0R6, xrefs: 00D18F20, 00D18F23

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateFileSleep
String ID: YCZ7FSLSVU38LA8QC0R6
API String ID: 2694422964-967746149
Opcode ID: fbadc01c0ea8a6f584ec261f0b055b4f439ee229a08cbe573210445ac66c8eb5
Instruction ID: 4472171256ad0007d73450746248bce83d30a1cb61ceef9163c56a835536c190
Opcode Fuzzy Hash: fbadc01c0ea8a6f584ec261f0b055b4f439ee229a08cbe573210445ac66c8eb5
Instruction Fuzzy Hash: 6F518F30D04249EAEF11DBE4D918BEEBBB9AF15300F044199E6087B2C0DBB95B45DBB5

Function 00AB410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00AED51C

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

_memset.LIBCMT ref: 00AB418D
_wcscpy.LIBCMT ref: 00AB41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AB41F1

Strings

Line: , xrefs: 00AED545

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 6da0b0439241b0c9adea03e15c638d8e75f98ad33644cb84bdd504bbca2e88fb
Instruction ID: aac976ef5a1d32a54411c055b49940b4310abbfd502a7965fe82cc303e418760
Opcode Fuzzy Hash: 6da0b0439241b0c9adea03e15c638d8e75f98ad33644cb84bdd504bbca2e88fb
Instruction Fuzzy Hash: 2B3172714083056AD731EB64DD46BEE77ECAF54300F10461EF599931A3EFB0A688CB92

Function 00AD558D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00AD55EB
_memcpy_s.LIBCMT ref: 00AD565D
__read_nolock.LIBCMT ref: 00AD56BB
__filbuf.LIBCMT ref: 00AD56DE
_memset.LIBCMT ref: 00AD5722

Part of subcall function 00AD8CA8: __getptd_noexit.LIBCMT ref: 00AD8CA8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 85023550e632f3a2e029d8803ad8feb89e05da70391b4bd881aae18f065e9b73
Instruction ID: d934a75bc937a3efa5246dfd619648dcfdb290aeddee032ca11fde2b5b444224
Opcode Fuzzy Hash: 85023550e632f3a2e029d8803ad8feb89e05da70391b4bd881aae18f065e9b73
Instruction Fuzzy Hash: 6E519E30E00A05DBDB249FB9D98466E77B6AF45320F288A2BF827963D0D770DE508B40

Function 00AB69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00AB4F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00B752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AB4F6F

_free.LIBCMT ref: 00AEE5BC
_free.LIBCMT ref: 00AEE603

Part of subcall function 00AB6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00AB6D0D

Strings

Bad directive syntax error, xrefs: 00AEE5EB
>>>AUTOIT SCRIPT<<<, xrefs: 00AEE392

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: aa486135d0b04febad8314513e496549127a0e15a80af8cf9408bdee26695fca
Instruction ID: 9e3d4d43f06c1117724121d1ed8dbcc4b2a0a9519aea5aaf5fbd9a46997126b5
Opcode Fuzzy Hash: aa486135d0b04febad8314513e496549127a0e15a80af8cf9408bdee26695fca
Instruction Fuzzy Hash: 6F918171910259AFCF14EFA5CC919EDB7B8FF08314F14446AF816AB2A2EB319D45CB60

Function 00AB35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00AB35A1,SwapMouseButtons,00000004,?), ref: 00AB35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00AB35A1,SwapMouseButtons,00000004,?,?,?,?,00AB2754), ref: 00AB35F5
RegCloseKey.KERNELBASE(00000000,?,?,00AB35A1,SwapMouseButtons,00000004,?,?,?,?,00AB2754), ref: 00AB3617

Strings

Control Panel\Mouse, xrefs: 00AB35D2

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 1a58ac6b2dac43de36885b5ea9bbaa698c384fd8e58b12d51e874b7a68d9648c
Instruction ID: daffc6fd81727943f723f0b5ad47d681a575a2a8d2e343f60801ba6af616c9c3
Opcode Fuzzy Hash: 1a58ac6b2dac43de36885b5ea9bbaa698c384fd8e58b12d51e874b7a68d9648c
Instruction Fuzzy Hash: EC1148B6910208BFDF208F68DC90AFFB7BCEF04740F109469E805D7211D6719E40A760

Function 00D17CA0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00D1845B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00D184F1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D18513

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: 7287af9f78bb5b115d71ce05557f96b2d2a63065bb0e7955ae8fa2f717b80ae9
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: 5962FE30A14658DBEB24CFA4D851BDEB372EF58300F1091A9D10DEB390EB759E81DB69

Function 00B19604 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00AB5045: _fseek.LIBCMT ref: 00AB505D

Part of subcall function 00B197DD: _wcscmp.LIBCMT ref: 00B198CD
Part of subcall function 00B197DD: _wcscmp.LIBCMT ref: 00B198E0

_free.LIBCMT ref: 00B1974B
_free.LIBCMT ref: 00B19752
_free.LIBCMT ref: 00B197BD

Part of subcall function 00AD2ED5: RtlFreeHeap.NTDLL(00000000,00000000,?,00AD9BA4), ref: 00AD2EE9
Part of subcall function 00AD2ED5: GetLastError.KERNEL32(00000000,?,00AD9BA4), ref: 00AD2EFB

_free.LIBCMT ref: 00B197C5

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: e7380544773663296b0c3136f1e3976d6f6c9a32d6817a33089202c8b0d22308
Instruction ID: ec60f5b322e99a33886c2d603092c106cb40af9817366674bbdee8bb23d1d0a2
Opcode Fuzzy Hash: e7380544773663296b0c3136f1e3976d6f6c9a32d6817a33089202c8b0d22308
Instruction Fuzzy Hash: F4513CB1D04258AFDF249F64DC81ADEBBB9EF48700F1044AEB609A7381DB715A90CF58

Function 00AD487A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AD4910
__flush.LIBCMT ref: 00AD4930
__write.LIBCMT ref: 00AD4963
__flsbuf.LIBCMT ref: 00AD4991

Part of subcall function 00AD8CA8: __getptd_noexit.LIBCMT ref: 00AD8CA8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: c192cc0e54a8f9db57de2592849b4d8a529bf1476805975b929b304db04efb62
Instruction ID: ff3c50b9ddac964f40b2f038cff7203a0738f3492258d070bc6225d4d73e7250
Opcode Fuzzy Hash: c192cc0e54a8f9db57de2592849b4d8a529bf1476805975b929b304db04efb62
Instruction Fuzzy Hash: 7C419371A047469FDF188F6AC8919AF7BB6AF483A0B24863FE85797740D670DE409B40

Function 00AB73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AEED92
GetOpenFileNameW.COMDLG32(?), ref: 00AEEDDC

Part of subcall function 00AB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB48A1,?,?,00AB37C0,?), ref: 00AB48CE

Part of subcall function 00AD0911: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AD0930

Strings

X, xrefs: 00AEEDAA

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 4d50274e03d792f8062a302625b38f34668dc41936ff485ee56f4f02ba3e7b55
Instruction ID: dfc81e296c229bc00e63fe4122ef3da5bd64c6c5e3863f964d826aa065e14ae6
Opcode Fuzzy Hash: 4d50274e03d792f8062a302625b38f34668dc41936ff485ee56f4f02ba3e7b55
Instruction Fuzzy Hash: 8F21C331A002989BCB01DF94CC45BEE7BFDAF48304F00405AE409A7242DFF859898FA1

Function 00B18E3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B18E55
__fread_nolock.LIBCMT ref: 00B18E6A

Strings

EA06, xrefs: 00B18E9C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 06592216fd2bac93377ca6e97dadd8c751d05ea6b4fc32dd82b1e3cfc8ff478e
Instruction ID: b677e930dd822a16c8d387882f7db66c8de1a1b7150c37aca69da85650d95147
Opcode Fuzzy Hash: 06592216fd2bac93377ca6e97dadd8c751d05ea6b4fc32dd82b1e3cfc8ff478e
Instruction Fuzzy Hash: 9B01B972D042586EDB28C7A8C856EEE7BF8DB15701F00459BF553D2281E9B5A6049760

Function 00B1998C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00B199A1
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00B199B8

Strings

aut, xrefs: 00B199B2

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: bf669e7414094cd74a3cea121f09880395433b007c3c91eab424c501f8ecc975
Instruction ID: 0392ec55dcdb16f5d43b1f82edc8590cd82ac89446f0a182e2f2bf5f6d098f2c
Opcode Fuzzy Hash: bf669e7414094cd74a3cea121f09880395433b007c3c91eab424c501f8ecc975
Instruction Fuzzy Hash: 1BD05B7594030DABDB509B90DC0DFAF777CD704700F0002B1BA54920A1DD7055548B91

Function 00B2CBF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4cb78a5631fe6c6f1af0ad5ceac06ac1a39a9dd84c90ee345d58ecdabcca0b
Instruction ID: dfd91f5b21a072af1e7048eee84c7dd692457937f144fb73e1dd8721db104403
Opcode Fuzzy Hash: 1d4cb78a5631fe6c6f1af0ad5ceac06ac1a39a9dd84c90ee345d58ecdabcca0b
Instruction Fuzzy Hash: 3AF14570A083119FC714DF28D580A6EBBE5FF88314F14896EF8999B252D731E946CF82

Function 00ABF8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD02E2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AD0313
Part of subcall function 00AD02E2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00AD031B
Part of subcall function 00AD02E2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AD0326
Part of subcall function 00AD02E2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AD0331
Part of subcall function 00AD02E2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00AD0339
Part of subcall function 00AD02E2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00AD0341

Part of subcall function 00AC6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00ABFA90), ref: 00AC62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00ABFB2D
OleInitialize.OLE32(00000000), ref: 00ABFBAA
CloseHandle.KERNEL32(00000000), ref: 00AF4921

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 7a72ef334ba1697ffdabc95c7a1afbab9ec10989c83b077082dc176ce8e90fba
Instruction ID: 55bad16e48d6b02e66b6229862dacbd53def4b4248b91fecb58d447761802bf5
Opcode Fuzzy Hash: 7a72ef334ba1697ffdabc95c7a1afbab9ec10989c83b077082dc176ce8e90fba
Instruction Fuzzy Hash: 8881DAB1901A408ED3B4DF39AD456597BE9FB98306B60856A901ECB37AEFF044C4CF24

Function 00AB43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AB4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AB44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AB44C3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: de3e44fe5d4ffa0cb15b3fe9bb3430b195b3a67c9d1b28904a355090405a8ba4
Instruction ID: cd63832047e9667f34de7a0e642368085a5477e8dde87007e493e4d8e16ecfb1
Opcode Fuzzy Hash: de3e44fe5d4ffa0cb15b3fe9bb3430b195b3a67c9d1b28904a355090405a8ba4
Instruction Fuzzy Hash: EF3130709057018FD721DF64D8847DBBBF8FB49304F10092EE59A97253DBB1A954CB92

Function 00AD588C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00AD58A3

Part of subcall function 00ADA2EB: __NMSG_WRITE.LIBCMT ref: 00ADA312
Part of subcall function 00ADA2EB: __NMSG_WRITE.LIBCMT ref: 00ADA31C

__NMSG_WRITE.LIBCMT ref: 00AD58AA

Part of subcall function 00ADA348: GetModuleFileNameW.KERNEL32(00000000,00B733BA,00000104,?,00000001,00000000), ref: 00ADA3DA
Part of subcall function 00ADA348: ___crtMessageBoxW.LIBCMT ref: 00ADA488

Part of subcall function 00AD321F: ___crtCorExitProcess.LIBCMT ref: 00AD3225
Part of subcall function 00AD321F: ExitProcess.KERNEL32 ref: 00AD322E

Part of subcall function 00AD8CA8: __getptd_noexit.LIBCMT ref: 00AD8CA8

RtlAllocateHeap.NTDLL(00C80000,00000000,00000001,00000000,?,?,?,00AD0F53,?), ref: 00AD58CF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: c1e87a45b18cca80682eeae48f49f694e67bad0a37d144febb3f58819c3c9477
Instruction ID: 7bb592deae1134feae37b994ba1a0668a37eb12216c7fd62b960dfeed6307309
Opcode Fuzzy Hash: c1e87a45b18cca80682eeae48f49f694e67bad0a37d144febb3f58819c3c9477
Instruction Fuzzy Hash: 4B01F536A50B11DBDA102BB5AD52A2E7398DF92760B100027F503AB392DE748E406661

Function 00B1994B Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00B195F1,?,?,?,?,?,00000004), ref: 00B19964
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00B195F1,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00B1997A
CloseHandle.KERNEL32(00000000,?,00B195F1,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00B19981

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: ee043b74141a285d0e3a006c5a988a8fa97de4e0c5045528f48e8fd697cbd868
Instruction ID: 822dd8c2dcba62cd168d585f69285b683da6748594567bd53cf32f3a1af4be60
Opcode Fuzzy Hash: ee043b74141a285d0e3a006c5a988a8fa97de4e0c5045528f48e8fd697cbd868
Instruction Fuzzy Hash: 71E08632540615B7DB211B54EC09FEE7B58EB05760F204220FB547A0E08BB119219798

Function 00B18DB6 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B18DC4

Part of subcall function 00AD2ED5: RtlFreeHeap.NTDLL(00000000,00000000,?,00AD9BA4), ref: 00AD2EE9
Part of subcall function 00AD2ED5: GetLastError.KERNEL32(00000000,?,00AD9BA4), ref: 00AD2EFB

_free.LIBCMT ref: 00B18DD5
_free.LIBCMT ref: 00B18DE7

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3221efda5ec1aeb3564d3aaca8a62a8878e7642d45a62f0f0d26450024f2f6e1
Instruction ID: 573b92d27c6976ba9eebc4f555e5de277a206fe60170a07318ac9dac39327b97
Opcode Fuzzy Hash: 3221efda5ec1aeb3564d3aaca8a62a8878e7642d45a62f0f0d26450024f2f6e1
Instruction Fuzzy Hash: ABE012A160170143CA24657C7A40FD327DCAF68B61754086EB40AD76C2CE64E8C1C264

Function 00ABAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00AEFF5A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: c02118e005e481f58fbd3da8e3aa301dffb87cdfdedea35aea4687d7c2aa3942
Instruction ID: c3a38f4972a30f1715713a3dfda20f5b7547de49065d1cf9c986ac934d77cc87
Opcode Fuzzy Hash: c02118e005e481f58fbd3da8e3aa301dffb87cdfdedea35aea4687d7c2aa3942
Instruction Fuzzy Hash: 9E2258705082418FCB24DF14C490BAABBF5FF98304F14896DE89A9B362DB71ED45CB82

Function 00AB4DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AB4E1A

Strings

EA06, xrefs: 00AEDC25

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: ff26741cc21b2fb7ccef80cbfb004a8f7085ac769bc6f155e750b1b536c642c7
Instruction ID: 2b0cd93648c582ef8172a98d50d5bb2a9849d95d098afd973c1ab2d74f68480a
Opcode Fuzzy Hash: ff26741cc21b2fb7ccef80cbfb004a8f7085ac769bc6f155e750b1b536c642c7
Instruction Fuzzy Hash: 34414971A041586BDF219B7489A1BFE7FBEAF4D300F684075F8829B283C621DD4487E1

Function 00AB492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00AB4992

Part of subcall function 00AD34EC: __lock.LIBCMT ref: 00AD34F2
Part of subcall function 00AD34EC: DecodePointer.KERNEL32(00000001,?,00AB49A7,00B07F9C), ref: 00AD34FE
Part of subcall function 00AD34EC: EncodePointer.KERNEL32(?,?,00AB49A7,00B07F9C), ref: 00AD3509

Part of subcall function 00AB4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00AB4A73
Part of subcall function 00AB4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00AB4A88

Part of subcall function 00AB3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AB3B7A
Part of subcall function 00AB3B4C: IsDebuggerPresent.KERNEL32 ref: 00AB3B8C
Part of subcall function 00AB3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00B752F8,00B752E0,?,?), ref: 00AB3BFD
Part of subcall function 00AB3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00AB3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00AB49D2

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 662d2789a868f92cf34213a75243dc00d7d8c43346113aa51f3d01a83e66cf41
Instruction ID: a4d7b19f9b6a10226fc3549707ab1be13c4c2ff2fcb242aefd6e777801c06999
Opcode Fuzzy Hash: 662d2789a868f92cf34213a75243dc00d7d8c43346113aa51f3d01a83e66cf41
Instruction Fuzzy Hash: 0C118C718043119FC710DF28ED4594AFBE8EF88750F10491EF149932B2DFB09A85CB92

Function 00AB5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00AB5981,?,?,?,?), ref: 00AB5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00AB5981,?,?,?,?), ref: 00AEE0CC

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ff114ecb657e9fa47bb666303db546ea6d96a80943206949da1c09dba6e106eb
Instruction ID: fa75e8607c2e0e51d50571048580451b7685c8f22902211a97ee91185db9e2f4
Opcode Fuzzy Hash: ff114ecb657e9fa47bb666303db546ea6d96a80943206949da1c09dba6e106eb
Instruction Fuzzy Hash: 1F01B570584708BEF7254F34DC8AFB67AACFB05768F148318BAE56A1E1C6F15E498B10

Function 00AD0F36 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AD588C: __FF_MSGBANNER.LIBCMT ref: 00AD58A3
Part of subcall function 00AD588C: __NMSG_WRITE.LIBCMT ref: 00AD58AA
Part of subcall function 00AD588C: RtlAllocateHeap.NTDLL(00C80000,00000000,00000001,00000000,?,?,?,00AD0F53,?), ref: 00AD58CF

std::exception::exception.LIBCMT ref: 00AD0F6C
__CxxThrowException@8.LIBCMT ref: 00AD0F81

Part of subcall function 00AD871B: RaiseException.KERNEL32(?,?,?,00B69E78,00000000,?,?,?,?,00AD0F86,?,00B69E78,?,00000001), ref: 00AD8770

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 75a5c4d8f1e3fc0453e15f2d8fe89b25e0005ef3f5006883733ed6e33fb7280e
Instruction ID: f5d6980bf5c1b2bf92e71a8889588174f7c4590fba4058bab3aef4c1e3191d5e
Opcode Fuzzy Hash: 75a5c4d8f1e3fc0453e15f2d8fe89b25e0005ef3f5006883733ed6e33fb7280e
Instruction Fuzzy Hash: 7CF0A4329042196ACB24AF94ED06EDE7BEC9F04710F6044A7F90A96392EF71CB54E6D1

Function 00AD576D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AD579C
__lock_file.LIBCMT ref: 00AD57BD

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 3e1e5bbf24d81bae44ef92103e21516ecb7a603bcd210a5c2628e2b82b36153e
Instruction ID: 96f9b4806b36d637790fa80d67aa581ca3eeb2d7dac250bdfa6d356d47bdf7b2
Opcode Fuzzy Hash: 3e1e5bbf24d81bae44ef92103e21516ecb7a603bcd210a5c2628e2b82b36153e
Instruction Fuzzy Hash: C5018431D01609EBCF21AF798D054DE7B72BF80360F244617F8265A361D7358A21DF91

Function 00AD5516 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AD8CA8: __getptd_noexit.LIBCMT ref: 00AD8CA8

__lock_file.LIBCMT ref: 00AD555B

Part of subcall function 00AD6D8E: __lock.LIBCMT ref: 00AD6DB1

__fclose_nolock.LIBCMT ref: 00AD5566

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: edbe16404fa3c605e1918b0b0b2d0496d3406a7a280d7e4d0ea9fca041c30d64
Instruction ID: a2a176e52fbf3d77d51a5c5eafb5c7ad54bb5b7d880be3138d489ab7b3b0fd33
Opcode Fuzzy Hash: edbe16404fa3c605e1918b0b0b2d0496d3406a7a280d7e4d0ea9fca041c30d64
Instruction Fuzzy Hash: 1EF0B471D01A009ADB216F7599027AE7BE26F40331F15820BF427AB3D1CB7C8A419F52

Function 00AB81C1 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,00AB558F,?,?,?,?,?), ref: 00AB81DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,00AB558F,?,?,?,?,?), ref: 00AB820D

Part of subcall function 00AB78AD: _memmove.LIBCMT ref: 00AB78E9

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 6aa2959af96071c8251b83ae60b6c4cead27caedfa7792f1f9ce55a8c652a8ed
Instruction ID: 1ed42072eebe492a354e271e1022cc5048a3575e5f3c395073f8370cc13c4a95
Opcode Fuzzy Hash: 6aa2959af96071c8251b83ae60b6c4cead27caedfa7792f1f9ce55a8c652a8ed
Instruction Fuzzy Hash: F9014B71205504BEEB246B25ED4AFBB7B6DEB89760F20802AF905DE291DE71E800D661

Function 00D17C9D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00D1845B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00D184F1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D18513

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: 384f8db90ffe4c5dbc6b0fb5c609f1a88093073ff05a89bc9f2fc7c4483f9bdc
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: 8512BE24E24658C6EB24DF64D8507DEB232EF68300F1094E9910DEB7A5E77A4EC1CF5A

Function 00AC2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49438910d274213858ae06f1ae9a235ee781d877606f1f1840e30035bcc55bdb
Instruction ID: 0dec0607efe50632eaedfbec38b4c0d7c084d23e98a932e0b32045d804e0cb05
Opcode Fuzzy Hash: 49438910d274213858ae06f1ae9a235ee781d877606f1f1840e30035bcc55bdb
Instruction Fuzzy Hash: 2A515035A00604AFCF14EBA4CA95FAE77EAAF45310F15856CF946AB392DB30ED01CB51

Function 00AB5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00AB5CF6

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 30fbaa7d26be7b40a87aafa810b17083b418ad4b3c59b40d295f2b566170c963
Instruction ID: 0235ac926f1b019152c977d80e7806b446c88a627418cb54450e9bc7033bf456
Opcode Fuzzy Hash: 30fbaa7d26be7b40a87aafa810b17083b418ad4b3c59b40d295f2b566170c963
Instruction Fuzzy Hash: A7313971E00B49AFCB18DF29C484BADBBBABF48310F148629E81993751D771AD60DB90

Function 00AD0D88 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00AD0E37

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 5ac7afae597acc1dfd2956e2da4716d7ffa0ceacba2f8f253fd7fb0f52120cff
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 1531B274A001059FC718DF59D484A69FBB6FF59300F688AA6E44ACB355DB31EDC1CB90

Function 00AF0005 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00AF0010

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 988136e13be059e3c1aed5c40c92a415c29b171742648aec056ceb2acb50c714
Instruction ID: b97b15e2e568c5c303d47fca052bdb1809fa4ebca810c76786c021a2339d5030
Opcode Fuzzy Hash: 988136e13be059e3c1aed5c40c92a415c29b171742648aec056ceb2acb50c714
Instruction Fuzzy Hash: DE4137745083518FDB24CF14C484F6ABBE1BF49318F1988ACE98A8B362C772EC45CB52

Function 00AB5B19 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AB5B61

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ac562ba610dad04e7ff15bbb2604c490293bdba8bca9c52a300c95a781116a49
Instruction ID: 8a044d73555c2a0710156de6229772efa5923309f7cc122fb7d9f27a5fc7c641
Opcode Fuzzy Hash: ac562ba610dad04e7ff15bbb2604c490293bdba8bca9c52a300c95a781116a49
Instruction Fuzzy Hash: BC210231900A08EBDB209F67E881BAE7FB8FB08350F21846AE486C6151EBB185E0C755

Function 00AB4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB4D13: FreeLibrary.KERNEL32(00000000,?), ref: 00AB4D4D

Part of subcall function 00AD53CB: __wfsopen.LIBCMT ref: 00AD53D6

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00B752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AB4F6F

Part of subcall function 00AB4CC8: FreeLibrary.KERNEL32(00000000), ref: 00AB4D02

Part of subcall function 00AB4DD0: _memmove.LIBCMT ref: 00AB4E1A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 0c3928c60c821e82e6017e12c9d96cecc996b317ddb2ea6d16fdab3db418713b
Instruction ID: c7a0f161b43d88162c8f8f03d8e3c31bf7e97eba7d9a44f3418ce201b4f43557
Opcode Fuzzy Hash: 0c3928c60c821e82e6017e12c9d96cecc996b317ddb2ea6d16fdab3db418713b
Instruction Fuzzy Hash: 5B119431A0070ABACF14BF70CD16BEE77BD9F48B11F208829F541A7183DAB19A159B91

Function 00AF00DE Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00AF00EA

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 534e5800ae22abee3ef68ee140a996a03331b49fa9dc6b0aacdda129db01c8ef
Instruction ID: 5374f46e5f5df8c84994914e8a46d12efc56f77e62d2a41dc4a7fcdac39983c6
Opcode Fuzzy Hash: 534e5800ae22abee3ef68ee140a996a03331b49fa9dc6b0aacdda129db01c8ef
Instruction Fuzzy Hash: B22113B05083519FDB24DF54C444F5ABBE5BF88314F05896CF99A5B722D731E809CB92

Function 00AB5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00AB5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00AB5D76

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d36f59a360a725f00b5f30a5d8df12c87e9b025cbc735ea588c658c7009a6c50
Instruction ID: 86381f29d2281e692a5ff0cce3b2c01ed8bda6f9310bb0eb92f42fe60b6e98c3
Opcode Fuzzy Hash: d36f59a360a725f00b5f30a5d8df12c87e9b025cbc735ea588c658c7009a6c50
Instruction Fuzzy Hash: EF113A31600B019FD330CF25D484BA6B7F9FF45750F10CA2EE5AA86A51D7B1E945CB60

Function 00AB5BDA Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AEE071

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3d89ba8d023d507579d310c630cb30b42907c54d329dc3f02e34af5ce4cbb46e
Instruction ID: 3e163215f3245df5306f07c3605962423fb6a9c101a579f86f75b85ae2ea9c78
Opcode Fuzzy Hash: 3d89ba8d023d507579d310c630cb30b42907c54d329dc3f02e34af5ce4cbb46e
Instruction Fuzzy Hash: CE01A2B5A00542AFC305DB69D541E2AFBA9FF893107248159F819C7702D731FC22CBE0

Function 00AD49D3 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00AD4A16

Part of subcall function 00AD8CA8: __getptd_noexit.LIBCMT ref: 00AD8CA8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: b4583044e59e335bc24c0f23d8329e90fd5aa1c8370ece50cc0478950b95693b
Instruction ID: 99c31282daa5614b2d3f70ca1cd8238d8f2d6a20b200cbed513207a5763cf943
Opcode Fuzzy Hash: b4583044e59e335bc24c0f23d8329e90fd5aa1c8370ece50cc0478950b95693b
Instruction Fuzzy Hash: 6CF0C231940245EFDF21AF748D063DF3AA1AF043A5F058516F426AA3A1DBBC8A10DF51

Function 00AB4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00B752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AB4FDE

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 2da89e1a4a25073ab9a7c87439b6a3be39d303373b52cd471325c06400d9b7c0
Instruction ID: fecaec69e7886fea1f0c465ceb0303062b7de8e06bbd24ab3835970c36b7df0b
Opcode Fuzzy Hash: 2da89e1a4a25073ab9a7c87439b6a3be39d303373b52cd471325c06400d9b7c0
Instruction Fuzzy Hash: 4BF01571509B12CFCB349F74E4948A6BBF9AF087293208A3EE1D783613C732A850DB40

Function 00AD0911 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AD0930

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: a588b2648c03a559ba4e7d3de5178d14f8733e09bfd859214facde447f6be01d
Instruction ID: 2b48decd7309a89cccf56d6a32faaf7bdee4dc49128acc17a33db8ea7562849a
Opcode Fuzzy Hash: a588b2648c03a559ba4e7d3de5178d14f8733e09bfd859214facde447f6be01d
Instruction Fuzzy Hash: C3E0863690512957C720D6589C05FFE77EDDF88690F0401B5FC0CD7245D9B05C818690

Function 00B18F48 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00B18F6A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 87e92921201f7f350e3b6a5d32947fae34ea2a0dab1f5900b9b8b54ddfacd81a
Instruction ID: dd6902b02e2ea8aa34b575774a722aa345fb90c5a2666d8c1a9f8d0af4f7772c
Opcode Fuzzy Hash: 87e92921201f7f350e3b6a5d32947fae34ea2a0dab1f5900b9b8b54ddfacd81a
Instruction Fuzzy Hash: DBE012B1604B009BDB358E24D8517E377E1FB06315F000D5DF69AD3241EB63B886CB59

Function 00AB5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00AEE09B,?,?,00000000), ref: 00AB5DBF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a4edd3d30b8756f2150f2cd5574b376c926baa950cb4e9ddb93f5820241f386d
Instruction ID: b34557eb2dd40c2d0a79b29f790c48fc8c8cf8d8b4a0a15cd48d2d136ca1b05d
Opcode Fuzzy Hash: a4edd3d30b8756f2150f2cd5574b376c926baa950cb4e9ddb93f5820241f386d
Instruction Fuzzy Hash: 36D09E74640208BFE610DB80DC46FA9777CD705710F200194BD046629096B27D548695

Function 00AD53CB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00AD53D6

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 5775b71709802b9d7d1a71f9f274856c3e72f2fa3031bf3d3a8c7c5e561d4902
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 7CB0927A84020C77CE012A92EC02A493B599B407A4F408021FB0C1C2A2A6B3A6609689

Function 00B1D107 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00B1D28B

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 81de959df5bb3f74f23fbf2a6802470dca1dcb35cc4b18075e9b66321ef67e4e
Instruction ID: 3a8894c3451642fab641eeb9a4b2e2f029b653ff42bc2407ef93baff4fc074c6
Opcode Fuzzy Hash: 81de959df5bb3f74f23fbf2a6802470dca1dcb35cc4b18075e9b66321ef67e4e
Instruction Fuzzy Hash: 357151306043018FC714EF24D591AEEB7E4EF89354F44496DF9A69B2A2DB30ED45CB92

Function 00D18C9C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00D18CB1

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 91c54e6c86e88d0663c9aecb82eb119317e6cdf3b043a82b4ec530dfb76b5f52
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 42E0BF7494110EEFDB00EFA8E6496DE7BB4EF04301F1005A1FD05D7680DB309E549A72

Function 00D18CA0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00D18CB1

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 770929166789e71c9b7ae864848fa584096f0e89e964d059ae77d632f0eeeefd
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 6FE0BF7494110EAFDB00EFA8D64969E7BB4EF04301F100161FD0192280DA3099509A72

Non-executed Functions

Function 00B3CB26 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00B3CBA1
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B3CBFF
GetWindowLongW.USER32(?,000000F0), ref: 00B3CC40
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B3CC6A
SendMessageW.USER32 ref: 00B3CC93
_wcsncpy.LIBCMT ref: 00B3CCFF
GetKeyState.USER32(00000011), ref: 00B3CD20
GetKeyState.USER32(00000009), ref: 00B3CD2D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B3CD43
GetKeyState.USER32(00000010), ref: 00B3CD4D
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B3CD76
SendMessageW.USER32 ref: 00B3CD9D
SendMessageW.USER32(?,00001030,?,00B3B37C), ref: 00B3CEA1
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00B3CEB7
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B3CECA
SetCapture.USER32(?), ref: 00B3CED3
ClientToScreen.USER32(?,?), ref: 00B3CF38
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B3CF45
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B3CF5F
ReleaseCapture.USER32 ref: 00B3CF6A
GetCursorPos.USER32(?), ref: 00B3CFA4
ScreenToClient.USER32(?,?), ref: 00B3CFB1
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B3D00D
SendMessageW.USER32 ref: 00B3D03B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B3D078
SendMessageW.USER32 ref: 00B3D0A7
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B3D0C8
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B3D0D7
GetCursorPos.USER32(?), ref: 00B3D0F7
ScreenToClient.USER32(?,?), ref: 00B3D104
GetParent.USER32(?), ref: 00B3D124
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B3D18D
SendMessageW.USER32 ref: 00B3D1BE
ClientToScreen.USER32(?,?), ref: 00B3D21C
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B3D24C
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B3D276
SendMessageW.USER32 ref: 00B3D299
ClientToScreen.USER32(?,?), ref: 00B3D2EB
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B3D31F

Part of subcall function 00AB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AB25EC

GetWindowLongW.USER32(?,000000F0), ref: 00B3D3BB

Strings

@GUI_DRAGID, xrefs: 00B3CF06
F, xrefs: 00B3D29F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 363abec82e962b181d123786d481bccc556fc44e1586e56ae25bdc5a9c4968e8
Instruction ID: 85b8c67acf742de2fd87d05b4d1532523171173d6e00f475750b990948bafed3
Opcode Fuzzy Hash: 363abec82e962b181d123786d481bccc556fc44e1586e56ae25bdc5a9c4968e8
Instruction Fuzzy Hash: 1D42CF31604305AFD720CF68C885EAABFE5FF49310F2409A9F599A72B1DB71E854CB52

Function 00AC70FE Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AC7323
_memset.LIBCMT ref: 00AC7699
_memmove.LIBCMT ref: 00AC780C

Strings

[:>:]], xrefs: 00AC75F2
\b(?=\w), xrefs: 00B03ABF
[:<:]], xrefs: 00AC75D9
DEFINE, xrefs: 00B02459
\b(?<=\w), xrefs: 00B03AC9
Q\E, xrefs: 00AC812B

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 0d629919d75fa418df402510435e44e7fcd62810f5e0fb57ff5a67d9667b486a
Instruction ID: 02941fd1e48110d9cd4804a6ea8779642ec4a7df720756e392b1d11488683d1b
Opcode Fuzzy Hash: 0d629919d75fa418df402510435e44e7fcd62810f5e0fb57ff5a67d9667b486a
Instruction Fuzzy Hash: 3E939175A00219DBDB24CF98C885BADBBF1FF48710F2581AAE955AB3D0E7749D81CB40

Function 00AB4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00AB4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00AED9BE
IsIconic.USER32(?), ref: 00AED9C7
ShowWindow.USER32(?,00000009), ref: 00AED9D4
SetForegroundWindow.USER32(?), ref: 00AED9DE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00AED9F4
GetCurrentThreadId.KERNEL32 ref: 00AED9FB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00AEDA07
AttachThreadInput.USER32(?,00000000,00000001), ref: 00AEDA18
AttachThreadInput.USER32(?,00000000,00000001), ref: 00AEDA20
AttachThreadInput.USER32(00000000,?,00000001), ref: 00AEDA28
SetForegroundWindow.USER32(?), ref: 00AEDA2B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AEDA40
keybd_event.USER32(00000012,00000000), ref: 00AEDA4B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AEDA55
keybd_event.USER32(00000012,00000000), ref: 00AEDA5A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AEDA63
keybd_event.USER32(00000012,00000000), ref: 00AEDA68
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AEDA72
keybd_event.USER32(00000012,00000000), ref: 00AEDA77
SetForegroundWindow.USER32(?), ref: 00AEDA7A
AttachThreadInput.USER32(?,?,00000000), ref: 00AEDAA1

Strings

Shell_TrayWnd, xrefs: 00AED9B9

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: eb9db3996f51eb7fb6263d6871b46afbb26628a24c24281e1cc4c84dbc8dcd04
Instruction ID: ff16fbb6d34aeb1c8c0eb77bcccdf26a08cdd31a29661608e08fdfb4e2980e01
Opcode Fuzzy Hash: eb9db3996f51eb7fb6263d6871b46afbb26628a24c24281e1cc4c84dbc8dcd04
Instruction Fuzzy Hash: E6315571E40319BBEB216FA29C49F7E7E6CEB54B90F214035FA04EB1D1CA705D01AAA0

Function 00B08638 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00B08AA3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B08AED
Part of subcall function 00B08AA3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B08B1A
Part of subcall function 00B08AA3: GetLastError.KERNEL32 ref: 00B08B27

_memset.LIBCMT ref: 00B0867B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00B086CD
CloseHandle.KERNEL32(?), ref: 00B086DE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B086F5
GetProcessWindowStation.USER32 ref: 00B0870E
SetProcessWindowStation.USER32(00000000), ref: 00B08718
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B08732

Part of subcall function 00B084F3: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B08631), ref: 00B08508
Part of subcall function 00B084F3: CloseHandle.KERNEL32(?,?,00B08631), ref: 00B0851A

Strings

default, xrefs: 00B0872D
, xrefs: 00B0868A
winsta0, xrefs: 00B086F0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 74f87345e292632f787b05624ad36b8f33ec5136258abc369f3cac3e225a2a0b
Instruction ID: 0bb37c0fab17d6db40efe35eb47ddb2a07b6de4fae82785bf9e03f2fbcf21057
Opcode Fuzzy Hash: 74f87345e292632f787b05624ad36b8f33ec5136258abc369f3cac3e225a2a0b
Instruction Fuzzy Hash: E1815971900209AFDF119FA5CC45AEE7FB9EF08304F1481A9F955A72A1DF318E14DB60

Function 00B2407C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00B3F910), ref: 00B240A6
IsClipboardFormatAvailable.USER32(0000000D), ref: 00B240B4
GetClipboardData.USER32(0000000D), ref: 00B240BC
CloseClipboard.USER32 ref: 00B240C8
GlobalLock.KERNEL32(00000000), ref: 00B240E4
CloseClipboard.USER32 ref: 00B240EE
GlobalUnlock.KERNEL32(00000000), ref: 00B24103
IsClipboardFormatAvailable.USER32(00000001), ref: 00B24110
GetClipboardData.USER32(00000001), ref: 00B24118
GlobalLock.KERNEL32(00000000), ref: 00B24125
GlobalUnlock.KERNEL32(00000000), ref: 00B24159
CloseClipboard.USER32 ref: 00B24269

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: a7be0aa57c703c6654eceac3cac8de3aacde4b8ee2cdfe97eb362639c735107c
Instruction ID: 9343e66c021814c6004bd5a4bdf76066db6db384884be65939ad8593a0fc23b4
Opcode Fuzzy Hash: a7be0aa57c703c6654eceac3cac8de3aacde4b8ee2cdfe97eb362639c735107c
Instruction Fuzzy Hash: 29518935604312ABD310AF64ED86FBF77A8AF94B00F204569F64AD31A2DF70D9058A62

Function 00B1C7E8 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B1C819
FindClose.KERNEL32(00000000), ref: 00B1C86D
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B1C892
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B1C8A9
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B1C8D0
__swprintf.LIBCMT ref: 00B1C91C
__swprintf.LIBCMT ref: 00B1C95F

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

__swprintf.LIBCMT ref: 00B1C9B3

Part of subcall function 00AD3818: __woutput_l.LIBCMT ref: 00AD3871

__swprintf.LIBCMT ref: 00B1CA01

Part of subcall function 00AD3818: __flsbuf.LIBCMT ref: 00AD3893
Part of subcall function 00AD3818: __flsbuf.LIBCMT ref: 00AD38AB

__swprintf.LIBCMT ref: 00B1CA50
__swprintf.LIBCMT ref: 00B1CA9F
__swprintf.LIBCMT ref: 00B1CAEE

Strings

%02d, xrefs: 00B1C9A7, 00B1C9B1, 00B1C9FF, 00B1CA4E, 00B1CA9D, 00B1CAEC
%4d%02d%02d%02d%02d%02d, xrefs: 00B1C916
%4d, xrefs: 00B1C959

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 833e4cb3a593e025bda1b33d310bf2ad911422ced67969584eff2215af28b708
Instruction ID: fc0c1aa05c0269973ae6a4f98c6a66508fa2010915ad14082b2c16cbe1788574
Opcode Fuzzy Hash: 833e4cb3a593e025bda1b33d310bf2ad911422ced67969584eff2215af28b708
Instruction Fuzzy Hash: D7A12EB2408305ABC710EF64C986DEFB7ECEF95700F40491DB686D7192EA34DA48CB62

Function 00B1F021 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B1F042
_wcscmp.LIBCMT ref: 00B1F057
_wcscmp.LIBCMT ref: 00B1F06E
GetFileAttributesW.KERNEL32(?), ref: 00B1F080
SetFileAttributesW.KERNEL32(?,?), ref: 00B1F09A
FindNextFileW.KERNEL32(00000000,?), ref: 00B1F0B2
FindClose.KERNEL32(00000000), ref: 00B1F0BD
FindFirstFileW.KERNEL32(*.*,?), ref: 00B1F0D9
_wcscmp.LIBCMT ref: 00B1F100
_wcscmp.LIBCMT ref: 00B1F117
SetCurrentDirectoryW.KERNEL32(?), ref: 00B1F129
SetCurrentDirectoryW.KERNEL32(00B68920), ref: 00B1F147
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B1F151
FindClose.KERNEL32(00000000), ref: 00B1F15E
FindClose.KERNEL32(00000000), ref: 00B1F170

Strings

*.*, xrefs: 00B1F0D4

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 1064d89b5aee0386a794ca381b04e3154fb460cd3563a93709055d48e424ff22
Instruction ID: d46d9c3570d4c109bba29570a3f58ba6897bad17e59e6d349f24d39f537bf00d
Opcode Fuzzy Hash: 1064d89b5aee0386a794ca381b04e3154fb460cd3563a93709055d48e424ff22
Instruction Fuzzy Hash: A1319F7290021BBADB109EA4DC59AFF77ECEF49320F5441B5F805E31A1DB34DA85CA64

Function 00B308E2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B309DE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00B3F910,00000000,?,00000000,?,?), ref: 00B30A4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00B30A94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00B30B1D
RegCloseKey.ADVAPI32(?), ref: 00B30E3D
RegCloseKey.ADVAPI32(00000000), ref: 00B30E4A

Strings

REG_BINARY, xrefs: 00B30DD8
REG_QWORD, xrefs: 00B30D8B
REG_MULTI_SZ, xrefs: 00B30C05
REG_EXPAND_SZ, xrefs: 00B30ABA
REG_SZ, xrefs: 00B30B5B
REG_DWORD, xrefs: 00B30D0E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 1a8ce570e64cfbcc0b4410b9bed91c3f0638d15c5363679d829d1214e39a0be7
Instruction ID: 5f4c11b6ca7962dfa81221945a238d643d06a37843bc53f24de8fe0fa7cd9c7a
Opcode Fuzzy Hash: 1a8ce570e64cfbcc0b4410b9bed91c3f0638d15c5363679d829d1214e39a0be7
Instruction Fuzzy Hash: 5B027F756106119FCB14EF24C995E6AB7E9FF88714F14889DF98A9B362CB30ED01CB81

Function 00B1F17E Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B1F19F
_wcscmp.LIBCMT ref: 00B1F1B4
_wcscmp.LIBCMT ref: 00B1F1CB

Part of subcall function 00B143C6: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B143E1

FindNextFileW.KERNEL32(00000000,?), ref: 00B1F1FA
FindClose.KERNEL32(00000000), ref: 00B1F205
FindFirstFileW.KERNEL32(*.*,?), ref: 00B1F221
_wcscmp.LIBCMT ref: 00B1F248
_wcscmp.LIBCMT ref: 00B1F25F
SetCurrentDirectoryW.KERNEL32(?), ref: 00B1F271
SetCurrentDirectoryW.KERNEL32(00B68920), ref: 00B1F28F
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B1F299
FindClose.KERNEL32(00000000), ref: 00B1F2A6
FindClose.KERNEL32(00000000), ref: 00B1F2B8

Strings

*.*, xrefs: 00B1F21C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 03b059d6f627c3fce7f31f05586566510505fb3785808b5c901fce6ba594c214
Instruction ID: bb0e256025232f7e03da785ccaba87e9275ef30b63e5d6514e932c3b2609eceb
Opcode Fuzzy Hash: 03b059d6f627c3fce7f31f05586566510505fb3785808b5c901fce6ba594c214
Instruction Fuzzy Hash: 6631A23690065BAACF109BA4DC58AFE77ECEF45360F6041F5F804A31A0DB70DE85CA94

Function 00B1A279 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B1A299
__swprintf.LIBCMT ref: 00B1A2BB
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B1A2F8
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B1A31D
_memset.LIBCMT ref: 00B1A33C
_wcsncpy.LIBCMT ref: 00B1A378
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B1A3AD
CloseHandle.KERNEL32(00000000), ref: 00B1A3B8
RemoveDirectoryW.KERNEL32(?), ref: 00B1A3C1
CloseHandle.KERNEL32(00000000), ref: 00B1A3CB

Strings

:, xrefs: 00B1A2DC
\, xrefs: 00B1A2D1
\??\%s, xrefs: 00B1A2B5

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 8a495eca57b2a1899e5885de264b0d4b8391d74f9d24bd12e73609a29001547e
Instruction ID: 6cf8caa83df6a6069e14118cd834eb270b63665852014795aeb5784b49244956
Opcode Fuzzy Hash: 8a495eca57b2a1899e5885de264b0d4b8391d74f9d24bd12e73609a29001547e
Instruction Fuzzy Hash: 1B3193B590010AABDB219FA0DC45FFF77BCEF89740F6041B6F919D2160EB7096848B65

Function 00B081D4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0852A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B08546
Part of subcall function 00B0852A: GetLastError.KERNEL32(?,00B0800A,?,?,?), ref: 00B08550
Part of subcall function 00B0852A: GetProcessHeap.KERNEL32(00000008,?,?,00B0800A,?,?,?), ref: 00B0855F
Part of subcall function 00B0852A: HeapAlloc.KERNEL32(00000000,?,00B0800A,?,?,?), ref: 00B08566
Part of subcall function 00B0852A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B0857D

Part of subcall function 00B085C7: GetProcessHeap.KERNEL32(00000008,00B08020,00000000,00000000,?,00B08020,?), ref: 00B085D3
Part of subcall function 00B085C7: HeapAlloc.KERNEL32(00000000,?,00B08020,?), ref: 00B085DA
Part of subcall function 00B085C7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00B08020,?), ref: 00B085EB

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B08238
_memset.LIBCMT ref: 00B0824D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B0826C
GetLengthSid.ADVAPI32(?), ref: 00B0827D
GetAce.ADVAPI32(?,00000000,?), ref: 00B082BA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B082D6
GetLengthSid.ADVAPI32(?), ref: 00B082F3
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00B08302
HeapAlloc.KERNEL32(00000000), ref: 00B08309
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B0832A
CopySid.ADVAPI32(00000000), ref: 00B08331
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B08362
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B08388
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B0839C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 071858203a5719bb877b3d6519343af248d1239343b2a8a96d3b9f9a7c379be7
Instruction ID: 984c99ddc174608518dd64886e757952a5331b9177a03b5a423c8f851ff515bc
Opcode Fuzzy Hash: 071858203a5719bb877b3d6519343af248d1239343b2a8a96d3b9f9a7c379be7
Instruction Fuzzy Hash: DF61447190020AEFDF148FA4DC85AEEBBB9FF44700F1481A9F955A7291DF319A05CBA0

Function 00AC6841 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

ANY), xrefs: 00B01634
UCP), xrefs: 00B01463
CR), xrefs: 00B015DD
LIMIT_RECURSION=, xrefs: 00B01552
UTF), xrefs: 00B01450
NO_AUTO_POSSESS), xrefs: 00B01484
BSR_UNICODE), xrefs: 00B0168E
LF), xrefs: 00B015FA
NO_START_OPT), xrefs: 00B014A5
ANYCRLF), xrefs: 00B01651
BSR_ANYCRLF), xrefs: 00B01674
LIMIT_MATCH=, xrefs: 00B014C6
UTF16), xrefs: 00B01425
CRLF), xrefs: 00B01617

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: e49dc7c3625967a208ac27bfd9c45541b649b821a3d9902b571099917c40e05d
Instruction ID: 04bed215f9a877538544d32f3eb7b0783c8cfe594f4bc41b3b1ae1af35e17b30
Opcode Fuzzy Hash: e49dc7c3625967a208ac27bfd9c45541b649b821a3d9902b571099917c40e05d
Instruction Fuzzy Hash: 49725075E006199BDF28CF59C890BADBBF5FF48710F1585AAE805EB290EB349E41CB50

Function 00B30465 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B30EA5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2FE38,?,?), ref: 00B30EBC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B30537

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B305D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B3066E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00B308AD
RegCloseKey.ADVAPI32(00000000), ref: 00B308BA

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: a99baff4ceefbea584ab35b30a7ddd852d6db0434677f7e3f627446b7c95a582
Instruction ID: 9f2012e7214cea6fa361e12505548a6680543f8bb99567268d60216d10a3edc4
Opcode Fuzzy Hash: a99baff4ceefbea584ab35b30a7ddd852d6db0434677f7e3f627446b7c95a582
Instruction Fuzzy Hash: 30E15E31614210AFCB14EF28C995E6BBBE9EF88714F1485ADF44ADB262DB30ED01CB51

Function 00B1003A Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B10062
GetAsyncKeyState.USER32(000000A0), ref: 00B100E3
GetKeyState.USER32(000000A0), ref: 00B100FE
GetAsyncKeyState.USER32(000000A1), ref: 00B10118
GetKeyState.USER32(000000A1), ref: 00B1012D
GetAsyncKeyState.USER32(00000011), ref: 00B10145
GetKeyState.USER32(00000011), ref: 00B10157
GetAsyncKeyState.USER32(00000012), ref: 00B1016F
GetKeyState.USER32(00000012), ref: 00B10181
GetAsyncKeyState.USER32(0000005B), ref: 00B10199
GetKeyState.USER32(0000005B), ref: 00B101AB

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 2eac1633ed63e9a052a898695ba7cce54f1d2fb3defc5cd638df818af6a0ffc2
Instruction ID: 217e671c2aa1088c846888aaec0bb99703ca681cbced3721fd7a6c20aec203de
Opcode Fuzzy Hash: 2eac1633ed63e9a052a898695ba7cce54f1d2fb3defc5cd638df818af6a0ffc2
Instruction Fuzzy Hash: A741CB249147CA79FF31AA6088043F5BEE1EF15340F9880DAE9C5571C2DBE899D4C792

Function 00B284D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

CoInitialize.OLE32 ref: 00B28518
CoUninitialize.OLE32 ref: 00B28523
CoCreateInstance.OLE32(?,00000000,00000017,00B42BEC,?), ref: 00B28583
IIDFromString.OLE32(?,?), ref: 00B285F6
VariantInit.OLEAUT32(?), ref: 00B28690
VariantClear.OLEAUT32(?), ref: 00B286F1

Strings

Failed to create object, xrefs: 00B2858E, 00B28644
NULL Pointer assignment, xrefs: 00B285C8
Invalid parameter, xrefs: 00B2860F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 8ddb0926c496553481e5e61b73f59c93d80d99b5905dd0392e6829f2cbe879a1
Instruction ID: b93818832118c9aea29ba738c3727c7da95d096423ace8c864d04e909e8c0dca
Opcode Fuzzy Hash: 8ddb0926c496553481e5e61b73f59c93d80d99b5905dd0392e6829f2cbe879a1
Instruction Fuzzy Hash: 2061AF706093219FC711DF14E984B6EBBE8EF48714F10489DF9899B2A1CB70ED48CB92

Function 00B2427A Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B242A1
EmptyClipboard.USER32 ref: 00B242A7
GlobalAlloc.KERNEL32(00000002,?), ref: 00B242BC
CloseClipboard.USER32 ref: 00B2435B

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f688d71a8ac49685677c4edea7ba115204632bfbe11ccba692141dcfb98717dc
Instruction ID: f2eba9f45818939598d500178e7ed127bb4ea74309ea1188395b5841824ec969
Opcode Fuzzy Hash: f688d71a8ac49685677c4edea7ba115204632bfbe11ccba692141dcfb98717dc
Instruction Fuzzy Hash: 11217C356006219FDB10AF64ED49B6E7BA8EF08710F20806AF94ADB2B1DB70A801CB54

Function 00B13833 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB48A1,?,?,00AB37C0,?), ref: 00AB48CE

Part of subcall function 00B14AD8: GetFileAttributesW.KERNEL32(?,00B1374F), ref: 00B14AD9

FindFirstFileW.KERNEL32(?,?), ref: 00B138E7
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00B1398F
MoveFileW.KERNEL32(?,?), ref: 00B139A2
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00B139BF
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B139E1
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00B139FD

Strings

\*.*, xrefs: 00B13892, 00B1389B, 00B138B0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: abfd85865d317c52e848c77abbc18dff8a49763966a7f8bc7500263397f9f205
Instruction ID: 183759bb0357d8154f2a478f8b94ccc516a881fc76ca544b68a2f65b70af361e
Opcode Fuzzy Hash: abfd85865d317c52e848c77abbc18dff8a49763966a7f8bc7500263397f9f205
Instruction Fuzzy Hash: 32518C31805249AACF11EBA0CE929FDB7FDAF14340FA441A9E44277092EF716F49CB60

Function 00B1F47F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00B1F4CC
Sleep.KERNEL32(0000000A), ref: 00B1F4FC
_wcscmp.LIBCMT ref: 00B1F510
_wcscmp.LIBCMT ref: 00B1F52B
FindNextFileW.KERNEL32(?,?), ref: 00B1F5C9
FindClose.KERNEL32(00000000), ref: 00B1F5DF

Strings

*.*, xrefs: 00B1F4B1

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: d5cde9207271eaf5484cf4ac6bec1cb7d55dd908e988a3075183169711877876
Instruction ID: 61b0d6e7d09f7873ae4982f61e5110c8a06af4937cfceb8563c52684dddbac59
Opcode Fuzzy Hash: d5cde9207271eaf5484cf4ac6bec1cb7d55dd908e988a3075183169711877876
Instruction Fuzzy Hash: 6E41707190021AABCF11DFA4CC45AFEBBF9FF14350F5445A6E815A32A1EB319E85CB50

Function 00AC4140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00AF7A3B
VUUU, xrefs: 00AC4520
VUUU, xrefs: 00AC44ED
VUUU, xrefs: 00AC44DB
ERCP, xrefs: 00AC421F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 3029b89a2e09d7df735e5058f898d40ae1073960788104bc1348e6e13188413f
Instruction ID: 68d98976b214f5a3e6f23b2227a1977f19b567bca2cf188a7cd3157398737c6c
Opcode Fuzzy Hash: 3029b89a2e09d7df735e5058f898d40ae1073960788104bc1348e6e13188413f
Instruction Fuzzy Hash: 97A28174E0421ACBDF24CF98C9A0BBDB7B1BB58314F2581AEE956A7280D7349D81CF54

Function 00AC58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AC5A05
_memmove.LIBCMT ref: 00AC5A55
_memmove.LIBCMT ref: 00AC5ABB

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 68fac54d835c932985ab311720a7d95b5e27833ae316f9bbf95f0c263433665c
Instruction ID: 7ccfce5dc7a3862fff64c10edb05653ac76f354a40658cd8879af99835ab0429
Opcode Fuzzy Hash: 68fac54d835c932985ab311720a7d95b5e27833ae316f9bbf95f0c263433665c
Instruction Fuzzy Hash: 83127A70A00609DFDF14DFA9DA85AEEB7F9FF48300F108569E406A7291EB35AD51CB50

Function 00B13B56 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB48A1,?,?,00AB37C0,?), ref: 00AB48CE

Part of subcall function 00B14AD8: GetFileAttributesW.KERNEL32(?,00B1374F), ref: 00B14AD9

FindFirstFileW.KERNEL32(?,?), ref: 00B13BCD
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B13C1D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B13C2E
FindClose.KERNEL32(00000000), ref: 00B13C45
FindClose.KERNEL32(00000000), ref: 00B13C4E

Strings

\*.*, xrefs: 00B13B9F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 82cbc3ad120e3108351b0a981f92279e31acae5bc5fcf25e416cf5317d30e74c
Instruction ID: 130857b0530ccb49fde59e1aaad8b7e54eae988e4a21a3dfe8154f6685153321
Opcode Fuzzy Hash: 82cbc3ad120e3108351b0a981f92279e31acae5bc5fcf25e416cf5317d30e74c
Instruction Fuzzy Hash: 61314B31408385ABC305EF64D9959EFB7ECAE95700F844E6DF4D593192EF209A09CBA2

Function 00B15264 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08AA3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B08AED
Part of subcall function 00B08AA3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B08B1A
Part of subcall function 00B08AA3: GetLastError.KERNEL32 ref: 00B08B27

ExitWindowsEx.USER32(?,00000000), ref: 00B152A0

Strings

, xrefs: 00B1528E
@, xrefs: 00B15293
SeShutdownPrivilege, xrefs: 00B15270

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: ca5d6d50c719b3978762af02487026b9b058eb271c864e1d9ee7cd71b23f4911
Instruction ID: 8884c61db9c5577cb28f74fef6433e9a22d0109e3c52ca0dddb291c558022bff
Opcode Fuzzy Hash: ca5d6d50c719b3978762af02487026b9b058eb271c864e1d9ee7cd71b23f4911
Instruction Fuzzy Hash: 0301D472B90612EAE73826689C8BBFA72D8EB45741FB401A5F847D24D2DA715C8481D0

Function 00B26399 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00B263F2
WSAGetLastError.WSOCK32(00000000), ref: 00B26401
bind.WSOCK32(00000000,?,00000010), ref: 00B2641D
listen.WSOCK32(00000000,00000005), ref: 00B2642C
WSAGetLastError.WSOCK32(00000000), ref: 00B26446
closesocket.WSOCK32(00000000,00000000), ref: 00B2645A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 074a22e4233905ca99423f5aae989df2bcecefd78d115a0a3d88d60967df7dec
Instruction ID: 7c937e3d3b316b80cfabe4f00a29e783b26ad0cbf6a9a387397f80a12d4a0103
Opcode Fuzzy Hash: 074a22e4233905ca99423f5aae989df2bcecefd78d115a0a3d88d60967df7dec
Instruction Fuzzy Hash: BC21A5346002159FCB10EF64D945A7EB7E9EF49710F248199F95AA73D2CB70AD01CB51

Function 00AC5680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00AD0F36: std::exception::exception.LIBCMT ref: 00AD0F6C
Part of subcall function 00AD0F36: __CxxThrowException@8.LIBCMT ref: 00AD0F81

_memmove.LIBCMT ref: 00B005AE
_memmove.LIBCMT ref: 00B006C3
_memmove.LIBCMT ref: 00B0076A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 9e11778a9759bab90d5cb4c172986e533eb1ca1ac39f6402eb0bf9fac3383211
Instruction ID: cf88d8bf1a8e5dd9246ca7ea6193b4e92ee9443039d6fa0453f563463eead135
Opcode Fuzzy Hash: 9e11778a9759bab90d5cb4c172986e533eb1ca1ac39f6402eb0bf9fac3383211
Instruction Fuzzy Hash: E8028F70E10209DBDF14DF64D981AAEBBF9EF44300F1580A9E806DB395EB35EA51CB91

Function 00AB1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00AB19FA
GetSysColor.USER32(0000000F), ref: 00AB1A4E
SetBkColor.GDI32(?,00000000), ref: 00AB1A61

Part of subcall function 00AB1290: DefDlgProcW.USER32(?,00000020,?), ref: 00AB12D8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 46564157902fd31a43cd4e25a201e590c57bb810514f3f83293ad8ce082ebd29
Instruction ID: 5ee7c0c1c3abb4e8781be372b497561a195fee6846acb51e4aa97db9abbd8ec2
Opcode Fuzzy Hash: 46564157902fd31a43cd4e25a201e590c57bb810514f3f83293ad8ce082ebd29
Instruction Fuzzy Hash: 00A13C711215C4BEEA38AB695C7DDFF3AADDB413C1FA4011DF402E6193DE24AD4192B2

Function 00B2685D Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B27EA0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00B27ECB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00B268B4
WSAGetLastError.WSOCK32(00000000), ref: 00B268DD
bind.WSOCK32(00000000,?,00000010), ref: 00B26916
WSAGetLastError.WSOCK32(00000000), ref: 00B26923
closesocket.WSOCK32(00000000,00000000), ref: 00B26937

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 1f9f407213fe9a379d787c4f50c4b9ade02bc4d5ad28c3733acb9eca33b763f4
Instruction ID: 7496c9cf2b488035fd5aea181bc76fcc5e5cc6ae4f8773651e17fc0991edc447
Opcode Fuzzy Hash: 1f9f407213fe9a379d787c4f50c4b9ade02bc4d5ad28c3733acb9eca33b763f4
Instruction Fuzzy Hash: 6041B475A00210AFEB10AF689D86FBE77EDDB48710F44815CFA1AAB3D3DA749D018791

Function 00B353DF Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00B3542E
IsWindowEnabled.USER32 ref: 00B3543C
GetForegroundWindow.USER32(?,?,00000001), ref: 00B35449
IsIconic.USER32 ref: 00B35457
IsZoomed.USER32 ref: 00B35465

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b3bed54fca7db07c26b70cf5486506969b33bd7f6e45926496cfe7b5967317bd
Instruction ID: 2266d4ae8203b88cd437753198bec6b0a105a0d725c8838dd2dfb9d72ab6b6a8
Opcode Fuzzy Hash: b3bed54fca7db07c26b70cf5486506969b33bd7f6e45926496cfe7b5967317bd
Instruction Fuzzy Hash: 1C11DD31B00A116BE7245F26DC44A6EBBDCFF44762F208068F846D7351CB70E84286A4

Function 00B2C104 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00AF1CB7,?), ref: 00B2C112
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00B2C124

Strings

GetSystemWow64DirectoryW, xrefs: 00B2C11E
kernel32.dll, xrefs: 00B2C10D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 7b328a2262b2ee1b6bd459adef4f5775448b5e4ba7acda3c9ebd80914d7c40dc
Instruction ID: 56231e529a1bf99c19d3cf0b9170d6086d552892fe613454c17e2de6aaf0ddee
Opcode Fuzzy Hash: 7b328a2262b2ee1b6bd459adef4f5775448b5e4ba7acda3c9ebd80914d7c40dc
Instruction Fuzzy Hash: 45E01D74510733CFD7205F25E819B5A7AD4EF05755B508479D499E3260E774D440C751

Function 00AC3190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: e40cbf957436f37ba9cdbcb12ae89cd28ffc424203fdb86598624acf0dfef228
Instruction ID: 76dce9b5c6afb0bb0f117b1db3f437c189a023b76c862fc47e9b051b6ba8acd2
Opcode Fuzzy Hash: e40cbf957436f37ba9cdbcb12ae89cd28ffc424203fdb86598624acf0dfef228
Instruction Fuzzy Hash: 32228B725083019FCB24DF64C991FAFB7E4AF88710F11891DF59A97292DB71EA04CB92

Function 00B2EF21 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B2EF51
Process32FirstW.KERNEL32(00000000,?), ref: 00B2EF5F

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Process32NextW.KERNEL32(00000000,?), ref: 00B2F01F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00B2F02E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 617cccf02d52c15210fe811fa0f905316a90d6338a42c13ba59ccb559167b967
Instruction ID: 61943deb44901432e44b90ae2a1733ba18ca426b190741742e083fbe030659b0
Opcode Fuzzy Hash: 617cccf02d52c15210fe811fa0f905316a90d6338a42c13ba59ccb559167b967
Instruction Fuzzy Hash: AB515D715043119BD310EF24D985EAFBBECEF88750F10492DF59597252DB70E908CB92

Function 00B0E928 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00B0E93A

Strings

|, xrefs: 00B0E96A
(, xrefs: 00B0E980

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 46511e5e628ea6cb4192a291e7420dcd2171efdd7df10af088faf99d5d733eff
Instruction ID: c13b8bd0c7e50cf486c02a5c0e0ce7fd75885c046e3d855af1f492e42f8897ac
Opcode Fuzzy Hash: 46511e5e628ea6cb4192a291e7420dcd2171efdd7df10af088faf99d5d733eff
Instruction Fuzzy Hash: 0A321775A00605DFD728CF19C48196ABBF1FF48320B15C9AEE4AADB7A1E770E941CB44

Function 00B22404 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00B21920,00000000), ref: 00B224F7
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00B2252E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: d7541063835b3a6a577066a558c8e5ee8744fb7447a2e2c0418547e103379819
Instruction ID: 44087c8f53274b4a22f5c9dc19be4e46b0696fee3e35c80a3a1bf417bd9257e9
Opcode Fuzzy Hash: d7541063835b3a6a577066a558c8e5ee8744fb7447a2e2c0418547e103379819
Instruction Fuzzy Hash: ED41D471904219BFEB20DF95EC95EBFB7FCEB54724F1080AAF609E7240DA709E419660

Function 00B1B3BF Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B1B3CF
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B1B429
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00B1B476

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 39515a470d03aca4646e58c2af5e06e816f8e45b36591d82a74c45b87a84db57
Instruction ID: da3d15888d25fa5c509f13cbf74a51cb0c1065c4ff6b61a55c0f8730a00458ed
Opcode Fuzzy Hash: 39515a470d03aca4646e58c2af5e06e816f8e45b36591d82a74c45b87a84db57
Instruction Fuzzy Hash: 91213235A10518DFCB00EFA5D884EEEBBF8FF49310F1480A9E905AB362DB319955CB51

Function 00B08AA3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00AD0F36: std::exception::exception.LIBCMT ref: 00AD0F6C
Part of subcall function 00AD0F36: __CxxThrowException@8.LIBCMT ref: 00AD0F81

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B08AED
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B08B1A
GetLastError.KERNEL32 ref: 00B08B27

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: b0909f94b57042b98fe7c50520e20004af7554ac70858eab7a63d0c1c1e9d458
Instruction ID: efa44745fa3a0da0d65ddddfc84e3cec205d969378fb0cbeb6d62732db8b0bd4
Opcode Fuzzy Hash: b0909f94b57042b98fe7c50520e20004af7554ac70858eab7a63d0c1c1e9d458
Instruction Fuzzy Hash: 7B11BCB1914209AFD728AF64DCC5D3BBBF9EB44310B20816EF48693251EB30AC00CA60

Function 00B14A08 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00B14A31
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00B14A48
FreeSid.ADVAPI32(?), ref: 00B14A58

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: b9356a6ced11a5250c83672a17627994e814ba187da57e5e4e9b7c952f108258
Instruction ID: 59d987471b58f8e1795c69181d458f975166454cfea3f0f706f3fefab65f8b8c
Opcode Fuzzy Hash: b9356a6ced11a5250c83672a17627994e814ba187da57e5e4e9b7c952f108258
Instruction Fuzzy Hash: 95F03775E5120DBFDB04DFE49D89ABEBBB8EF08201F5044A9A905E2181E6706A448B50

Function 00ABE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e587ddcc7613276c759dbee755af33fbc4d7d080e7e53134292dd460d2e11de4
Instruction ID: b57108766a3d8925c3788d77a691a4b0561b32c32367786b7ddaec211d05d9bc
Opcode Fuzzy Hash: e587ddcc7613276c759dbee755af33fbc4d7d080e7e53134292dd460d2e11de4
Instruction Fuzzy Hash: E4228C75A002198FDB24DF54C490AFEB7F8FF18310F248169E956AB342E375AD85CB91

Function 00B1C75D Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B1C787
FindClose.KERNEL32(00000000), ref: 00B1C7B7

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 269312e11ea409df151cd2dd31f52aee4ee85d20725abfd5bdf512a781fe0965
Instruction ID: 86e84ae5ca905da401dfe060ab71c7350080508c18604430f8277a9d0e564cf2
Opcode Fuzzy Hash: 269312e11ea409df151cd2dd31f52aee4ee85d20725abfd5bdf512a781fe0965
Instruction Fuzzy Hash: 8D11A1326102009FD710DF29C845A6AF7E9FF84320F00855EF9A9D72A1DB70AC01CB81

Function 00B1A0F4 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00B2957D,?,00B3FB84,?), ref: 00B1A121
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00B2957D,?,00B3FB84,?), ref: 00B1A133

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: b8575730bb5811819aa2a085680cec99548580339aad1c1521239b0e21b5ab65
Instruction ID: bb5c7815f9ccb6e31f16d83b873595d82d4791fe22ac5df6e2c0e6516937daa2
Opcode Fuzzy Hash: b8575730bb5811819aa2a085680cec99548580339aad1c1521239b0e21b5ab65
Instruction Fuzzy Hash: 04F0BE35505229BBDB109AA4CC48FEE73ACEF09361F0081A6B80993181DA30A940CBA1

Function 00B084F3 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B08631), ref: 00B08508
CloseHandle.KERNEL32(?,?,00B08631), ref: 00B0851A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 42d1a18660d0bb236823bf735a55cfeae68b876d6e2c299a45d7c6ae18d50afa
Instruction ID: bc4cfb0414baef95fd378842711785812d36210f3a00f3878496ca01fe800566
Opcode Fuzzy Hash: 42d1a18660d0bb236823bf735a55cfeae68b876d6e2c299a45d7c6ae18d50afa
Instruction Fuzzy Hash: 3CE0E671014511AFE7252F64ED05E777BE9EF44310B24842EF4D682470DF615C91DB50

Function 00ADA2D5 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00AD8ED7,?,?,?,00000001), ref: 00ADA2DA
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00ADA2E3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0ddf2f8bf37a8891759ea122525062f61c41f76f65971dae60b8b8017f970d85
Instruction ID: d29eda0f7f55933780b59ac1b1efb793d1011e431a82105262331ca914237df9
Opcode Fuzzy Hash: 0ddf2f8bf37a8891759ea122525062f61c41f76f65971dae60b8b8017f970d85
Instruction Fuzzy Hash: BDB0923145420AABCB002B91EC09BAE3F68EB45AA2F504020F60D86060CF6254508A99

Function 00ADF359 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce67c155959943b8b7b8a7dc1162bda538f2756ec4a0f14e68aef9dc0303d19f
Instruction ID: f1757c23b48d333f9d1f64f4d9a7361ff79e2dab54d1424ce3ef086220c8950a
Opcode Fuzzy Hash: ce67c155959943b8b7b8a7dc1162bda538f2756ec4a0f14e68aef9dc0303d19f
Instruction Fuzzy Hash: FB320F26D69F014DD7239635D832336A259AFB73C4F15D737E82BB6AA6EF28C5834100

Function 00AE25AE Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4ba3cc9434898f33f715a6d32bdbabba2af1942804382adc633d5c55aece7c
Instruction ID: 59d88326edcb994a771d72550f0f09be1517a363ba3fcb70e855feb5f40aa182
Opcode Fuzzy Hash: ea4ba3cc9434898f33f715a6d32bdbabba2af1942804382adc633d5c55aece7c
Instruction Fuzzy Hash: 8FB1F024D6AF404DD2239A398831336BA5CBFBB2C5F51D71BFC6675D22FB2186834241

Function 00B18932 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00B18944

Part of subcall function 00AD537A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00B19017,00000000,?,?,?,?,00B191C8,00000000,?), ref: 00AD5383
Part of subcall function 00AD537A: __aulldiv.LIBCMT ref: 00AD53A3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 21fd9c2827666ce8ce4e39083f522c507c8f66772215b9b073ac349806e5feb7
Instruction ID: 088520e10c1632f8485587e49a1ac02d4fc50a7cc8672488b2ad0fbebaacf3b6
Opcode Fuzzy Hash: 21fd9c2827666ce8ce4e39083f522c507c8f66772215b9b073ac349806e5feb7
Instruction Fuzzy Hash: CB21E432635910CBC729CF25D441A92B3E1EBA5310F688E6CE1F9CB2C0CE34B945DB50

Function 00B2401F Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00B2403A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: b1f131dd436e62b566bc899d58bf7b10c5e44f2d765232e298871c524309bdf3
Instruction ID: a11908f9fab1ae717daaa886b40abb80755057f82d3d5f0b223f33e9f2403497
Opcode Fuzzy Hash: b1f131dd436e62b566bc899d58bf7b10c5e44f2d765232e298871c524309bdf3
Instruction Fuzzy Hash: 5AE012312001145FC7109F59E445A9BBBDCAF657A0F008055F949D7652DA70A8458B95

Function 00B14CFA Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00B14D1D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: db3dfe19d875af0edbae4482d2912d87122a1bf2e4e0e222382aedf7983a9dc1
Instruction ID: 999db14c5b0f329b7b1a4816753b93f5ce7bc9b40b29b2e6c664a9e961e1f0eb
Opcode Fuzzy Hash: db3dfe19d875af0edbae4482d2912d87122a1bf2e4e0e222382aedf7983a9dc1
Instruction Fuzzy Hash: FFD09EA416460AB9FC280B20BC6FBF61189F312B96FE845E97602971C5AAE85CC1A435

Function 00B08A73 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00B086B1), ref: 00B08A93

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: aa1d0d16cf5180e949865c802df9a2d03210115c8c755c7526ffe5bdda2d3220
Instruction ID: da599a790ee8c01b96a2a041ce14fcc6a539f6dd355e1424968b782ee02f6f01
Opcode Fuzzy Hash: aa1d0d16cf5180e949865c802df9a2d03210115c8c755c7526ffe5bdda2d3220
Instruction Fuzzy Hash: 86D05E3226450EABEF018EA8DC01EBE3B69EB04B01F408111FE15C60A1C775D835AB60

Function 00AF215F Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00AF2171

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 68dfb85a983e3aca4248459db90171f8ff63285943378f5c34137b09d5d65446
Instruction ID: 7cae7adb82ed2f67b962a5a9e43d1904b9aa9bd22305905640598f4614f16c38
Opcode Fuzzy Hash: 68dfb85a983e3aca4248459db90171f8ff63285943378f5c34137b09d5d65446
Instruction Fuzzy Hash: B3C04CF580110DDBCB05DF90D988DFE77BCAB04304F204455A101F2100D7749B448B71

Function 00ADA2A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00ADA2AA

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a89028d13a8634f7b5abb3835fc8e628f0da615ab52f61afb9c7ae6942944a35
Instruction ID: 25eac7dd0827dfbcb1274c59807c3e0fb8e88f3ec9810595b793bcc30975824d
Opcode Fuzzy Hash: a89028d13a8634f7b5abb3835fc8e628f0da615ab52f61afb9c7ae6942944a35
Instruction Fuzzy Hash: 17A0123000010DA78B001B41EC044597F5CD6011907004020F40C420218B3254104584

Function 00AC8968 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce720ab73a9d44deb0112907084d8369ccd0ba46aa690cbcc7946a9f510bd8ee
Instruction ID: 3f805d1bc5f23e5abd3c4051a419f736d05a2cb61fd74fdc82ad5dc1e02be7ef
Opcode Fuzzy Hash: ce720ab73a9d44deb0112907084d8369ccd0ba46aa690cbcc7946a9f510bd8ee
Instruction Fuzzy Hash: 062206706045568BDF388B28C494B7EBBE1FF01344F6A80AEE856DB9D5DB389D81CB50

Function 00AD2345 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 8664c8ac4b2917442fd139011191e6841abc9c54b8502a2fd374390c9e7b32fb
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: B5C173722151930ADF2D4739843463EBEA15EA27B231A075FE8B3CB2D5EF24C964D720

Function 00AD277A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 3ecea0283aa28aa99dc4f1f4d0d2f3b9265a41931ae703a1427cc4290cbf8f0e
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 45C1323261519309DB6D473A847423EBFA15BA27B231A176FE4B3DB2D5EF20C924D720

Function 00AD1AF8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 7cab2d126f13e520f43d447b4fc460f4a8616db480024de1c1b53e13e6339241
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 91C1713231919319DF6D473A847453EBFA15AA27B231A076FE4B3CB2C4EF20C964D620

Function 00D19FF0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: cc672af35dcdce598243ea9e6721840c8dfa2381de183a9f6a335ff266a7717e
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 9241D371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB50

Function 00D19EE0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 403e22c94cb62de84028451a32a683cf4bd3c37dabea741c224e536d2b4008cc
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 12019278A01109EFCB44DF98D5A09AEF7B5FF48310F248699E809A7341D730AE82DB90

Function 00D19E80 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 930c298620c6238339b285d5dc0b6e3bd31dff62e2a356f5c48bb90ebd995e69
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 1B019278A01209EFCB48DF98D5A09AEF7F5FB48310F208599E809A7341D730AE81DB90

Function 00D18870 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693834646.0000000000D16000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d16000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00B2791B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B27970
DeleteObject.GDI32(00000000), ref: 00B27982
DestroyWindow.USER32 ref: 00B27990
GetDesktopWindow.USER32 ref: 00B279AA
GetWindowRect.USER32(00000000), ref: 00B279B1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00B27AF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00B27B02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27B4A
GetClientRect.USER32(00000000,?), ref: 00B27B56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B27B90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27BB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27BC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27BD0
GlobalLock.KERNEL32(00000000), ref: 00B27BD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27BE8
GlobalUnlock.KERNEL32(00000000), ref: 00B27BF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27BF8
GlobalFree.KERNEL32(00000000), ref: 00B27C03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27C15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00B42CAC,00000000), ref: 00B27C2B
GlobalFree.KERNEL32(00000000), ref: 00B27C3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00B27C61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00B27C80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27CA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27E8F

Strings

DISPLAY, xrefs: 00B27CF2
static, xrefs: 00B27B8A, 00B27CE1
AutoIt v3, xrefs: 00B27B42
, xrefs: 00B27E15

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: ee57b9600988804010ba19a562a972e056ee0fb1372f85b28f4635720663529f
Instruction ID: 528fffdb3351d7e2ad6fe84a849d050442685d29d1796ea8fa70c3e9a61021db
Opcode Fuzzy Hash: ee57b9600988804010ba19a562a972e056ee0fb1372f85b28f4635720663529f
Instruction Fuzzy Hash: CA027E71900115EFDB14DFA8DD89EAE7BB9FF49310F108199F909AB2A1CB70AD41CB64

Function 00B335D4 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00B3F910), ref: 00B33690
IsWindowVisible.USER32(?), ref: 00B336B4

Strings

GETCURRENTLINE, xrefs: 00B33956
TABLEFT, xrefs: 00B336F0
GETCURRENTSELECTION, xrefs: 00B3384C
ISCHECKED, xrefs: 00B338A2
GETLINECOUNT, xrefs: 00B3392F
ISENABLED, xrefs: 00B336D4
GETLINE, xrefs: 00B33A04
DELSTRING, xrefs: 00B337B2
ISVISIBLE, xrefs: 00B336A0
FINDSTRING, xrefs: 00B337DF
GETCURRENTCOL, xrefs: 00B33991
GETSELECTED, xrefs: 00B3390C
SELECTSTRING, xrefs: 00B3386F
HIDEDROPDOWN, xrefs: 00B33769
UNCHECK, xrefs: 00B338EC
SETCURRENTSELECTION, xrefs: 00B3381F
TABRIGHT, xrefs: 00B33706
CHECK, xrefs: 00B338D6
CURRENTTAB, xrefs: 00B33726
EDITPASTE, xrefs: 00B339C8
SENDCOMMANDID, xrefs: 00B33A43
ADDSTRING, xrefs: 00B3377F
SHOWDROPDOWN, xrefs: 00B33749

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 4fa0562865c6739bf47fe8fe84cd4312bc7ed2159f98a04baf1c654850499562
Instruction ID: 93b493ecf3481f14c132a1c6bdeaa577dc37a8bcf01447e221d046dcba36961a
Opcode Fuzzy Hash: 4fa0562865c6739bf47fe8fe84cd4312bc7ed2159f98a04baf1c654850499562
Instruction Fuzzy Hash: 5BD15D302147019BCB14EF10C591A6F7BE9EF94B84F644599B8965B3E3CB31EE4ACB41

Function 00B3A60C Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00B3A662
GetSysColorBrush.USER32(0000000F), ref: 00B3A693
GetSysColor.USER32(0000000F), ref: 00B3A69F
SetBkColor.GDI32(?,000000FF), ref: 00B3A6B9
SelectObject.GDI32(?,00000000), ref: 00B3A6C8
InflateRect.USER32(?,000000FF,000000FF), ref: 00B3A6F3
GetSysColor.USER32(00000010), ref: 00B3A6FB
CreateSolidBrush.GDI32(00000000), ref: 00B3A702
FrameRect.USER32(?,?,00000000), ref: 00B3A711
DeleteObject.GDI32(00000000), ref: 00B3A718
InflateRect.USER32(?,000000FE,000000FE), ref: 00B3A763
FillRect.USER32(?,?,00000000), ref: 00B3A795
GetWindowLongW.USER32(?,000000F0), ref: 00B3A7C0

Part of subcall function 00B3A8FC: GetSysColor.USER32(00000012), ref: 00B3A935
Part of subcall function 00B3A8FC: SetTextColor.GDI32(?,?), ref: 00B3A939
Part of subcall function 00B3A8FC: GetSysColorBrush.USER32(0000000F), ref: 00B3A94F
Part of subcall function 00B3A8FC: GetSysColor.USER32(0000000F), ref: 00B3A95A
Part of subcall function 00B3A8FC: GetSysColor.USER32(00000011), ref: 00B3A977
Part of subcall function 00B3A8FC: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B3A985
Part of subcall function 00B3A8FC: SelectObject.GDI32(?,00000000), ref: 00B3A996
Part of subcall function 00B3A8FC: SetBkColor.GDI32(?,00000000), ref: 00B3A99F
Part of subcall function 00B3A8FC: SelectObject.GDI32(?,?), ref: 00B3A9AC
Part of subcall function 00B3A8FC: InflateRect.USER32(?,000000FF,000000FF), ref: 00B3A9CB
Part of subcall function 00B3A8FC: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B3A9E2
Part of subcall function 00B3A8FC: GetWindowLongW.USER32(00000000,000000F0), ref: 00B3A9F7
Part of subcall function 00B3A8FC: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B3AA1F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 74f9cce2ea9f5653a40478df8a74c91c79adead2c35326ec5e16b0ed5ac0cc10
Instruction ID: 50920c4a3d8534763401ff55963d7dace85410bdcf265e72755705894f966ece
Opcode Fuzzy Hash: 74f9cce2ea9f5653a40478df8a74c91c79adead2c35326ec5e16b0ed5ac0cc10
Instruction Fuzzy Hash: 03914B72808702FFD7109F64DC48E6F7BE9FB89321F204A29F5A2961A1DB71D944CB52

Function 00AB2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00AB2CA2
DeleteObject.GDI32(00000000), ref: 00AB2CE8
DeleteObject.GDI32(00000000), ref: 00AB2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00AB2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00AB2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00AEC5BB
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00AEC5F4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00AECA1D

Part of subcall function 00AB1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AB2036,?,00000000,?,?,?,?,00AB16CB,00000000,?), ref: 00AB1B9A

SendMessageW.USER32(?,00001053), ref: 00AECA5A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00AECA71
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00AECA87
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00AECA92

Strings

0, xrefs: 00AEC8B1

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 781fd30e59627eb326d49bbae23248bc360667fa91a435ec593401aff5d37a18
Instruction ID: 2076b06173146c235cd100a022b79c573271fb588206f4a27fbffe9e8330618c
Opcode Fuzzy Hash: 781fd30e59627eb326d49bbae23248bc360667fa91a435ec593401aff5d37a18
Instruction Fuzzy Hash: EA128D30600281EFDB25CF25C985BA9BBE5FF06320F54456AF895DB262CB31EC42DB91

Function 00B275C0 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00B275F3
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B276B2
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00B276F0
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00B27702
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00B27748
GetClientRect.USER32(00000000,?), ref: 00B27754
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00B27798
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00B277A7
GetStockObject.GDI32(00000011), ref: 00B277B7
SelectObject.GDI32(00000000,00000000), ref: 00B277BB
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00B277CB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B277D4
DeleteDC.GDI32(00000000), ref: 00B277DD
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00B27809
SendMessageW.USER32(00000030,00000000,00000001), ref: 00B27820
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00B2785B
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00B2786F
SendMessageW.USER32(00000404,00000001,00000000), ref: 00B27880
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00B278B0
GetStockObject.GDI32(00000011), ref: 00B278BB
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00B278C6
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00B278D0

Strings

msctls_progress32, xrefs: 00B27851
DISPLAY, xrefs: 00B2779D
static, xrefs: 00B27792, 00B278AA
AutoIt v3, xrefs: 00B27740

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 09885f5ec87bf31c26b1f3f9e303e4228800abd62500db8617f1f3075cfc227d
Instruction ID: f154e53647de9f9a02fbb4fb1751a04e677ea7895b67c5fcf15c3bde1136abb5
Opcode Fuzzy Hash: 09885f5ec87bf31c26b1f3f9e303e4228800abd62500db8617f1f3075cfc227d
Instruction Fuzzy Hash: 10A15371A40619BFEB14DF64DD4AFAE7BA9EB04710F104154FA15A72E1CBB0AD40CB64

Function 00B1AD9C Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B1ADAA
GetDriveTypeW.KERNEL32(?,00B3FAC0,?,\\.\,00B3F910), ref: 00B1AE87
SetErrorMode.KERNEL32(00000000,00B3FAC0,?,\\.\,00B3F910), ref: 00B1AFE5

Strings

Fixed, xrefs: 00B1AECF
\\.\, xrefs: 00B1ADFC
Virtual, xrefs: 00B1AFAD
SSD, xrefs: 00B1AF12
CDROM, xrefs: 00B1AEBB
Fibre, xrefs: 00B1AF75
FileBackedVirtual, xrefs: 00B1AFB4
MMC, xrefs: 00B1AFA6
Removable, xrefs: 00B1AED9
ATA, xrefs: 00B1AF60
ATAPI, xrefs: 00B1AF59
Unknown, xrefs: 00B1AEA7, 00B1AF4B
iSCSI, xrefs: 00B1AF8A
SAS, xrefs: 00B1AF91
1394, xrefs: 00B1AF67
RAID, xrefs: 00B1AF83
SCSI, xrefs: 00B1AF52
Network, xrefs: 00B1AEC5
SATA, xrefs: 00B1AF98
RAMDisk, xrefs: 00B1AEB1
PhysicalDrive, xrefs: 00B1AE33
SSA, xrefs: 00B1AF6E
USB, xrefs: 00B1AF7C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f99f84600b1721a01e51a1d69346f232ead2f149681996c8de8156147b05977f
Instruction ID: a775262594d953276d2cded4226ef048b9d69830355cc670b5e8918734d85ecf
Opcode Fuzzy Hash: f99f84600b1721a01e51a1d69346f232ead2f149681996c8de8156147b05977f
Instruction Fuzzy Hash: 0651A0B56492059BCB10EB50C9C28FDB3F0EB14700BA441E6E906E72E1CB75ED82DB82

Function 00AB6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00AB6A91
__wcsnicmp.LIBCMT ref: 00AB6AA9
__wcsnicmp.LIBCMT ref: 00AB6AC1
__wcsnicmp.LIBCMT ref: 00AB6AD9
__wcsnicmp.LIBCMT ref: 00AB6AF1
__wcsnicmp.LIBCMT ref: 00AB6B09
__wcsnicmp.LIBCMT ref: 00AB6B21
__wcsnicmp.LIBCMT ref: 00AB6B35
__wcsnicmp.LIBCMT ref: 00AB6B76
__wcsnicmp.LIBCMT ref: 00AB6B8A
__wcsnicmp.LIBCMT ref: 00AB6B9E
__wcsnicmp.LIBCMT ref: 00AB6BB2

Strings

#requireadmin, xrefs: 00AB6ABB
#notrayicon, xrefs: 00AB6AA3
#cs, xrefs: 00AB6B2F, 00AB6B84
#OnAutoItStartRegister, xrefs: 00AB6AD3
#include-once, xrefs: 00AB6AEB
#pragma compile, xrefs: 00AB6A8B
#comments-end, xrefs: 00AB6B98
Unterminated group of comments, xrefs: 00AEE75C
#include, xrefs: 00AB6B03
Cannot parse #include, xrefs: 00AEE749
Bad directive syntax error, xrefs: 00AEE673
#comments-start, xrefs: 00AB6B1B, 00AB6B70
#ce, xrefs: 00AB6BAC

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 503ee01cae417a1ef4e37ab7627285415566eb2ca5ce1d56f2130a620e2622d7
Instruction ID: ad4462a044ce405d5761d680c7f6716702c41f4fb234597ed5864b098745c767
Opcode Fuzzy Hash: 503ee01cae417a1ef4e37ab7627285415566eb2ca5ce1d56f2130a620e2622d7
Instruction Fuzzy Hash: 93811971640205BACF20AF61CD92FFE77BCAF14740F144025F946AB2A3EBA4DA51D2A5

Function 00B3A8FC Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00B3A935
SetTextColor.GDI32(?,?), ref: 00B3A939
GetSysColorBrush.USER32(0000000F), ref: 00B3A94F
GetSysColor.USER32(0000000F), ref: 00B3A95A
CreateSolidBrush.GDI32(?), ref: 00B3A95F
GetSysColor.USER32(00000011), ref: 00B3A977
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B3A985
SelectObject.GDI32(?,00000000), ref: 00B3A996
SetBkColor.GDI32(?,00000000), ref: 00B3A99F
SelectObject.GDI32(?,?), ref: 00B3A9AC
InflateRect.USER32(?,000000FF,000000FF), ref: 00B3A9CB
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B3A9E2
GetWindowLongW.USER32(00000000,000000F0), ref: 00B3A9F7
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B3AA1F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B3AA46
InflateRect.USER32(?,000000FD,000000FD), ref: 00B3AA64
DrawFocusRect.USER32(?,?), ref: 00B3AA6F
GetSysColor.USER32(00000011), ref: 00B3AA7D
SetTextColor.GDI32(?,00000000), ref: 00B3AA85
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00B3AA99
SelectObject.GDI32(?,00B3A62C), ref: 00B3AAB0
DeleteObject.GDI32(?), ref: 00B3AABB
SelectObject.GDI32(?,?), ref: 00B3AAC1
DeleteObject.GDI32(?), ref: 00B3AAC6
SetTextColor.GDI32(?,?), ref: 00B3AACC
SetBkColor.GDI32(?,?), ref: 00B3AAD6

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 3cb9959431241a1893b3718ce9195288dd02c6f5a38069a3f2de4b40a5982418
Instruction ID: 814974e26f747ba64fefc1b42b7f5d7f65a4f3634fc133fa0110d772b9a4b155
Opcode Fuzzy Hash: 3cb9959431241a1893b3718ce9195288dd02c6f5a38069a3f2de4b40a5982418
Instruction Fuzzy Hash: F1512B71D00209FFDB119FA4DD48EAEBBB9EB48320F314665F911BB2A1DA719940DB90

Function 00B38A07 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B38AF3
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B38B04
CharNextW.USER32(0000014E), ref: 00B38B33
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B38B74
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B38B8A
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B38B9B
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00B38BB8
SetWindowTextW.USER32(?,0000014E), ref: 00B38C0A
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00B38C20
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B38C51
_memset.LIBCMT ref: 00B38C76
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00B38CBF
_memset.LIBCMT ref: 00B38D1E
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B38D48
SendMessageW.USER32(?,00001074,?,00000001), ref: 00B38DA0
SendMessageW.USER32(?,0000133D,?,?), ref: 00B38E4D
InvalidateRect.USER32(?,00000000,00000001), ref: 00B38E6F
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B38EB9
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B38EE6
DrawMenuBar.USER32(?), ref: 00B38EF5
SetWindowTextW.USER32(?,0000014E), ref: 00B38F1D

Strings

0, xrefs: 00B38E87

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 45ba3db07dce128d4738695700d8942ed90e445cde19ad9b9ba8d9998e52ecf0
Instruction ID: 2957f75c4b45b553b9bdde9afc762dc8d0b0bcc52d8e6dfb48d94451d61cd851
Opcode Fuzzy Hash: 45ba3db07dce128d4738695700d8942ed90e445cde19ad9b9ba8d9998e52ecf0
Instruction Fuzzy Hash: B9E17F71900309ABDF209F65CC85EFE7BB9EF05750F20819AF915AB290DB709A81DF61

Function 00B348F8 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B34A33
GetDesktopWindow.USER32 ref: 00B34A48
GetWindowRect.USER32(00000000), ref: 00B34A4F
GetWindowLongW.USER32(?,000000F0), ref: 00B34AB1
DestroyWindow.USER32(?), ref: 00B34ADD
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B34B06
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B34B24
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00B34B4A
SendMessageW.USER32(?,00000421,?,?), ref: 00B34B5F
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00B34B72
IsWindowVisible.USER32(?), ref: 00B34B92
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00B34BAD
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00B34BC1
GetWindowRect.USER32(?,?), ref: 00B34BD9
MonitorFromPoint.USER32(?,?,00000002), ref: 00B34BFF
GetMonitorInfoW.USER32(00000000,?), ref: 00B34C19
CopyRect.USER32(?,?), ref: 00B34C30
SendMessageW.USER32(?,00000412,00000000), ref: 00B34C9B

Strings

(, xrefs: 00B34C0C
tooltips_class32, xrefs: 00B34AFF
0, xrefs: 00B349DE

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 294c5b74cb28b8c810c4a889201814072c64a563f3d6cee465a4ce50df95ef9c
Instruction ID: 177a6f8b79cc08ee55e5b7aded492ca7f6617266463c27e9fc7f6346ff4044cd
Opcode Fuzzy Hash: 294c5b74cb28b8c810c4a889201814072c64a563f3d6cee465a4ce50df95ef9c
Instruction Fuzzy Hash: 29B16971604341AFDB44DF64C989B6BBBE4FF88310F108A5CF5999B2A2DB71E804CB95

Function 00AB27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AB28BC
GetSystemMetrics.USER32(00000007), ref: 00AB28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AB28EF
GetSystemMetrics.USER32(00000008), ref: 00AB28F7
GetSystemMetrics.USER32(00000004), ref: 00AB291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00AB2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00AB2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00AB297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00AB2990
GetClientRect.USER32(00000000,000000FF), ref: 00AB29AE
GetStockObject.GDI32(00000011), ref: 00AB29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB29D5

Part of subcall function 00AB2344: GetCursorPos.USER32(?), ref: 00AB2357
Part of subcall function 00AB2344: ScreenToClient.USER32(00B757B0,?), ref: 00AB2374
Part of subcall function 00AB2344: GetAsyncKeyState.USER32(00000001), ref: 00AB2399
Part of subcall function 00AB2344: GetAsyncKeyState.USER32(00000002), ref: 00AB23A7

SetTimer.USER32(00000000,00000000,00000028,00AB1256), ref: 00AB29FC

Strings

AutoIt v3 GUI, xrefs: 00AB2974

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 09b4944de293991aba6cb4405c8042e379e69405ad8a9832697bc083aa971441
Instruction ID: 691ce55aac3ceb8939c7e2acec9c68caa4ee507131e0c40ae72dc7163be13d5d
Opcode Fuzzy Hash: 09b4944de293991aba6cb4405c8042e379e69405ad8a9832697bc083aa971441
Instruction Fuzzy Hash: F2B14071A0024AEFDB14DFA8DD45BED7BB8FB08311F204129FA19972A1DB749851CB51

Function 00B0A844 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B0A885
__swprintf.LIBCMT ref: 00B0A926
_wcscmp.LIBCMT ref: 00B0A939
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B0A98E
_wcscmp.LIBCMT ref: 00B0A9CA
GetClassNameW.USER32(?,?,00000400), ref: 00B0AA01
GetDlgCtrlID.USER32(?), ref: 00B0AA53
GetWindowRect.USER32(?,?), ref: 00B0AA89
GetParent.USER32(?), ref: 00B0AAA7
ScreenToClient.USER32(00000000), ref: 00B0AAAE
GetClassNameW.USER32(?,?,00000100), ref: 00B0AB28
_wcscmp.LIBCMT ref: 00B0AB3C
GetWindowTextW.USER32(?,?,00000400), ref: 00B0AB62
_wcscmp.LIBCMT ref: 00B0AB76

Part of subcall function 00AD37AC: _iswctype.LIBCMT ref: 00AD37B4

Strings

%s%u, xrefs: 00B0A920

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 94718eb240867f6474183c7dd851cdfc768dc326a2c0943aef42316da8d0c4fb
Instruction ID: f2a1b7ae27dd97cb39356d499422a19766bf986ae13c9d69a007fbdb80623388
Opcode Fuzzy Hash: 94718eb240867f6474183c7dd851cdfc768dc326a2c0943aef42316da8d0c4fb
Instruction Fuzzy Hash: 75A1D171604706AFDB14DF24C984FAABBE9FF44354F108A69F999C21D0DB30E945CB92

Function 00B0B196 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00B0B1DA
_wcscmp.LIBCMT ref: 00B0B1EB
GetWindowTextW.USER32(00000001,?,00000400), ref: 00B0B213
CharUpperBuffW.USER32(?,00000000), ref: 00B0B230
_wcscmp.LIBCMT ref: 00B0B24E
_wcsstr.LIBCMT ref: 00B0B25F
GetClassNameW.USER32(00000018,?,00000400), ref: 00B0B297
_wcscmp.LIBCMT ref: 00B0B2A7
GetWindowTextW.USER32(00000002,?,00000400), ref: 00B0B2CE
GetClassNameW.USER32(00000018,?,00000400), ref: 00B0B317
_wcscmp.LIBCMT ref: 00B0B327
GetClassNameW.USER32(00000010,?,00000400), ref: 00B0B34F
GetWindowRect.USER32(00000004,?), ref: 00B0B3B8

Strings

ThumbnailClass, xrefs: 00B0B2A2, 00B0B322
@, xrefs: 00B0B1BB

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: b9364854d76a2982abcbf9872e71ebaa589ec2e81aa8483d7f2c62d0a2a1e770
Instruction ID: aefbda9e2a6393b3388d21e24913e451feb8a24513e1d4fc2aa8677208cb4cf4
Opcode Fuzzy Hash: b9364854d76a2982abcbf9872e71ebaa589ec2e81aa8483d7f2c62d0a2a1e770
Instruction Fuzzy Hash: BE818D724082069BDB01DF14C985FAA7FE8EF44714F1885AAFD869A1E2DB30DE45CB61

Function 00B0AFDF Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00B0B03E

Strings

[LAST, xrefs: 00B0B0EB
[HANDLE:, xrefs: 00B0B04A
CLASSNAME=, xrefs: 00B0B07B
ACTIVE, xrefs: 00B0B019
LAST, xrefs: 00B0B003
ALL, xrefs: 00B0B0D2
REGEXP=, xrefs: 00B0B053
[ALL, xrefs: 00B0B0E4
HANDLE=, xrefs: 00B0B037
[ACTIVE, xrefs: 00B0B02B
[CLASS:, xrefs: 00B0B08E
[REGEXPTITLE:, xrefs: 00B0B066

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: aea085c35475801a10eaeaa300a5b9afc0c660598d36c16e2016a46854321357
Instruction ID: ccbdc51450ce415ef51f32f0944492896103070f62a29974c559c20b2486d3d2
Opcode Fuzzy Hash: aea085c35475801a10eaeaa300a5b9afc0c660598d36c16e2016a46854321357
Instruction Fuzzy Hash: D9316631A88205A6DB24FAA0CE53EEF7BE89F10754F6005A9F452711E3FFA56F04C691

Function 00B0C2C0 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00B0C2D3
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B0C2E5
SetWindowTextW.USER32(?,?), ref: 00B0C2FC
GetDlgItem.USER32(?,000003EA), ref: 00B0C311
SetWindowTextW.USER32(00000000,?), ref: 00B0C317
GetDlgItem.USER32(?,000003E9), ref: 00B0C327
SetWindowTextW.USER32(00000000,?), ref: 00B0C32D
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B0C34E
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B0C368
GetWindowRect.USER32(?,?), ref: 00B0C371
SetWindowTextW.USER32(?,?), ref: 00B0C3DC
GetDesktopWindow.USER32 ref: 00B0C3E2
GetWindowRect.USER32(00000000), ref: 00B0C3E9
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00B0C435
GetClientRect.USER32(?,?), ref: 00B0C442
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00B0C467
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B0C492

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 1c7a1a55040a539a21a11043a76919a3fb079905e3cb100e0a1544a70df27c2d
Instruction ID: 67341d43c4e78ef8f46ff2ab2f93c28d2f4bea57f62680366f34a57f517b2afb
Opcode Fuzzy Hash: 1c7a1a55040a539a21a11043a76919a3fb079905e3cb100e0a1544a70df27c2d
Instruction Fuzzy Hash: D2513C3190070AEFDB209FA8DE86B6EBFF5FF04705F104668E646A35A0CB74A944DB50

Function 00B25113 Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00B25129
LoadCursorW.USER32(00000000,00007F00), ref: 00B25134
LoadCursorW.USER32(00000000,00007F03), ref: 00B2513F
LoadCursorW.USER32(00000000,00007F8B), ref: 00B2514A
LoadCursorW.USER32(00000000,00007F01), ref: 00B25155
LoadCursorW.USER32(00000000,00007F81), ref: 00B25160
LoadCursorW.USER32(00000000,00007F88), ref: 00B2516B
LoadCursorW.USER32(00000000,00007F80), ref: 00B25176
LoadCursorW.USER32(00000000,00007F86), ref: 00B25181
LoadCursorW.USER32(00000000,00007F83), ref: 00B2518C
LoadCursorW.USER32(00000000,00007F85), ref: 00B25197
LoadCursorW.USER32(00000000,00007F82), ref: 00B251A2
LoadCursorW.USER32(00000000,00007F84), ref: 00B251AD
LoadCursorW.USER32(00000000,00007F04), ref: 00B251B8
LoadCursorW.USER32(00000000,00007F02), ref: 00B251C3
LoadCursorW.USER32(00000000,00007F89), ref: 00B251CE
GetCursorInfo.USER32(?), ref: 00B251DE

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 4d699f60acc963caeb95467e3cb896a158dbc6993ae7c580ed93cdf1a0f749b5
Instruction ID: 93df97fcdeacd22e3abe8e2731dfc20b00ad0245f190d5036df38f4b8ac3c068
Opcode Fuzzy Hash: 4d699f60acc963caeb95467e3cb896a158dbc6993ae7c580ed93cdf1a0f749b5
Instruction Fuzzy Hash: EB31E7B0D48319AADB209FB69C8996FFEE8FF04750F50452AE50DE7281DA7865018FA1

Function 00B3A1EB Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B3A28B
DestroyWindow.USER32(?,?), ref: 00B3A305

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B3A37F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B3A3A1
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B3A3B4
DestroyWindow.USER32(00000000), ref: 00B3A3D6
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00AB0000,00000000), ref: 00B3A40D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B3A426
GetDesktopWindow.USER32 ref: 00B3A43F
GetWindowRect.USER32(00000000), ref: 00B3A446
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B3A45E
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B3A476

Part of subcall function 00AB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AB25EC

Strings

0, xrefs: 00B3A2A1
tooltips_class32, xrefs: 00B3A378, 00B3A406

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 7509385a77c3ba56b0892c33a7a6e5501d14b27f895edd230ecef290464a921b
Instruction ID: ea30e86b1374bfe53521c7545d3b45e862a656d9fa64a7f2ea94c8379a5f3761
Opcode Fuzzy Hash: 7509385a77c3ba56b0892c33a7a6e5501d14b27f895edd230ecef290464a921b
Instruction Fuzzy Hash: 2B719C75540245AFD720CF28CC49FAA77E9EB88700F24466DF9D6872A1DBB1E941CF22

Function 00B3C668 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

DragQueryPoint.SHELL32(?,?), ref: 00B3C691

Part of subcall function 00B3AB69: ClientToScreen.USER32(?,?), ref: 00B3AB92
Part of subcall function 00B3AB69: GetWindowRect.USER32(?,?), ref: 00B3AC08
Part of subcall function 00B3AB69: PtInRect.USER32(?,?,00B3C07E), ref: 00B3AC18

SendMessageW.USER32(?,000000B0,?,?), ref: 00B3C6FA
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B3C705
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B3C728
_wcscat.LIBCMT ref: 00B3C758
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B3C76F
SendMessageW.USER32(?,000000B0,?,?), ref: 00B3C788
SendMessageW.USER32(?,000000B1,?,?), ref: 00B3C79F
SendMessageW.USER32(?,000000B1,?,?), ref: 00B3C7C1
DragFinish.SHELL32(?), ref: 00B3C7C8
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B3C8BB

Strings

@GUI_DRAGID, xrefs: 00B3C833
@GUI_DRAGFILE, xrefs: 00B3C86A
@GUI_DROPID, xrefs: 00B3C7E8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: e596eb474e49f9a49e1dba088cbaae3043ecf0017f2b1985b0a16b5abe72a7f5
Instruction ID: 7b1a329fcf0a106f2c7ee75ef4aef1d071c43db8e0038fd442e547e1854081dc
Opcode Fuzzy Hash: e596eb474e49f9a49e1dba088cbaae3043ecf0017f2b1985b0a16b5abe72a7f5
Instruction Fuzzy Hash: FF617D71508301AFC700EF64DD85DAFBBE8EF88710F10096EF595931A2DB70AA49CB52

Function 00B343FB Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B3448D
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B344D8

Strings

UNCHECK, xrefs: 00B346B4
ISCHECKED, xrefs: 00B3465B
COLLAPSE, xrefs: 00B3451E
GETITEMCOUNT, xrefs: 00B345BA
EXPAND, xrefs: 00B3458A
CHECK, xrefs: 00B344F8
SELECT, xrefs: 00B34689
EXISTS, xrefs: 00B34541
GETTEXT, xrefs: 00B3462B
GETTOTALCOUNT, xrefs: 00B344BF
GETSELECTED, xrefs: 00B345E8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 3e7b26b0595eefe980bd4f4755fcbe08459bec5da6f030efd02fbf7c5051682c
Instruction ID: 9d09978f64364c0bb07e3cfbf12bdb7ebaa811fef8a21295eef2e4cee923b62a
Opcode Fuzzy Hash: 3e7b26b0595eefe980bd4f4755fcbe08459bec5da6f030efd02fbf7c5051682c
Instruction Fuzzy Hash: 6A914A342047019BCB14EF20C591AAAB7E5EF95350F5488ADF8965B3A3CB35ED4ACB81

Function 00B3B832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B3B8E8
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00B36B43,?), ref: 00B3B944
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B3B97D
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00B3B9C0
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B3B9F7
FreeLibrary.KERNEL32(?), ref: 00B3BA03
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B3BA13
DestroyIcon.USER32(?), ref: 00B3BA22
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B3BA3F
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B3BA4B

Part of subcall function 00AD307D: __wcsicmp_l.LIBCMT ref: 00AD3106

Strings

.exe, xrefs: 00B3B87E
.icl, xrefs: 00B3B85E
.dll, xrefs: 00B3B8A1

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 32ebc7bf7d4b3e69b2832687166f145f1ba80c76d343e10378e25d4f62280fdc
Instruction ID: ac1c83520258724be081adb38d378cb02ce0bcf3edaf2355232e359220140701
Opcode Fuzzy Hash: 32ebc7bf7d4b3e69b2832687166f145f1ba80c76d343e10378e25d4f62280fdc
Instruction Fuzzy Hash: E661CF71A40619BEEB14DF64CD41FBE77ACFB08710F20425AFA16D61D1DB74AA84CBA0

Function 00B1A3DC Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

CharLowerBuffW.USER32(?,?), ref: 00B1A455
GetDriveTypeW.KERNEL32 ref: 00B1A4A2
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B1A4EA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B1A521
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B1A54F

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

Strings

close, xrefs: 00B1A45B
open , xrefs: 00B1A4B1
open, xrefs: 00B1A47C
type cdaudio alias cd wait, xrefs: 00B1A4CD
close cd wait, xrefs: 00B1A53A
closed, xrefs: 00B1A469, 00B1A472
set cd door , xrefs: 00B1A4F0
wait, xrefs: 00B1A50C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: fe28075c499f6156d625b39893c0942aeb5cf11c1469035b1bc81d46848e86a1
Instruction ID: 6e8eb628e7c9ce52fda7c80f7963f0bf9700a4f5005ef3749e94a6bf80201b72
Opcode Fuzzy Hash: fe28075c499f6156d625b39893c0942aeb5cf11c1469035b1bc81d46848e86a1
Instruction Fuzzy Hash: 30517C711083049FC700EF20C9919AEB7E9FF94758F50496DF896972A2DB71EE06CB42

Function 00B0FBDB Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,00AEE382,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00B0FC10
LoadStringW.USER32(00000000,?,00AEE382,00000001), ref: 00B0FC19

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

GetModuleHandleW.KERNEL32(00000000,00B75310,?,00000FFF,?,?,00AEE382,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00B0FC3B
LoadStringW.USER32(00000000,?,00AEE382,00000001), ref: 00B0FC3E
__swprintf.LIBCMT ref: 00B0FC8E
__swprintf.LIBCMT ref: 00B0FC9F
_wprintf.LIBCMT ref: 00B0FD48
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B0FD5F

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B0FD43
Line %d:, xrefs: 00B0FC99
^ ERROR, xrefs: 00B0FCF4
Error: , xrefs: 00B0FD16
Line %d (File "%s"):, xrefs: 00B0FC88

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: b621152e66835dbcae1f5abb71ba7ff438acee78f46dae1beaa5f074863ab5f3
Instruction ID: 3d52c1e9df18499b5d9a417dd843fcac6df578e4661ed6e96bf5370d22150d77
Opcode Fuzzy Hash: b621152e66835dbcae1f5abb71ba7ff438acee78f46dae1beaa5f074863ab5f3
Instruction Fuzzy Hash: D2414D72904219AACB14FBE0CE86DFE77BCAF54740F5001A5F505720A2DE746F49CAA1

Function 00AEAA4B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00AEAAAB
___wtomb_environ.LIBCMT ref: 00AEAACD

Part of subcall function 00AD8CA8: __getptd_noexit.LIBCMT ref: 00AD8CA8

__malloc_crt.LIBCMT ref: 00AEAAF5
__malloc_crt.LIBCMT ref: 00AEAB12
_free.LIBCMT ref: 00AEAB49
__recalloc_crt.LIBCMT ref: 00AEAB82
__recalloc_crt.LIBCMT ref: 00AEABC7
_strlen.LIBCMT ref: 00AEABF3
__calloc_crt.LIBCMT ref: 00AEABFD
_strlen.LIBCMT ref: 00AEAC0C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00AEAC3A
_free.LIBCMT ref: 00AEAC54
_free.LIBCMT ref: 00AEAC61
_free.LIBCMT ref: 00AEAC73
__invoke_watson.LIBCMT ref: 00AEAC8D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 1dd0756fc12e6c3ef0a317b6fcbe586bb4228011d76a5f8fa5489548900e569d
Instruction ID: d42a1db1a8d190c7de50c25e8b95f5b1e44003b13d08cdd8edc29ee17b5452ea
Opcode Fuzzy Hash: 1dd0756fc12e6c3ef0a317b6fcbe586bb4228011d76a5f8fa5489548900e569d
Instruction Fuzzy Hash: B9610A72500355AFD7205F66DE41B6A77B4EF20B61F20812AE80697291DF78ED81C793

Function 00B3BA67 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00B3BA8A
GetFileSize.KERNEL32(00000000,00000000), ref: 00B3BAA1
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00B3BAAC
CloseHandle.KERNEL32(00000000), ref: 00B3BAB9
GlobalLock.KERNEL32(00000000), ref: 00B3BAC2
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00B3BAD1
GlobalUnlock.KERNEL32(00000000), ref: 00B3BADA
CloseHandle.KERNEL32(00000000), ref: 00B3BAE1
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00B3BAF2
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B42CAC,?), ref: 00B3BB0B
GlobalFree.KERNEL32(00000000), ref: 00B3BB1B
GetObjectW.GDI32(?,00000018,000000FF), ref: 00B3BB3F
CopyImage.USER32(?,00000000,?,?,00002000), ref: 00B3BB6A
DeleteObject.GDI32(00000000), ref: 00B3BB92
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B3BBA8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 34a76e62771babbb365e9b9d95dbbc17c69358a7e857e6008a3fb74faf92af27
Instruction ID: d7c1ade62f3a3c8cffc8d104b4c9ad390fe5cdd091df95a20e2eb741e99e8a3b
Opcode Fuzzy Hash: 34a76e62771babbb365e9b9d95dbbc17c69358a7e857e6008a3fb74faf92af27
Instruction Fuzzy Hash: 2241F975A00209EFDB119F65DC88EBFBBB9EF89711F2040A9F909D7264DB309941DB60

Function 00B1D925 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00B1DA9C
_wcscat.LIBCMT ref: 00B1DAB4
_wcscat.LIBCMT ref: 00B1DAC6
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B1DADB
SetCurrentDirectoryW.KERNEL32(?), ref: 00B1DAEF
GetFileAttributesW.KERNEL32(?), ref: 00B1DB07
SetFileAttributesW.KERNEL32(?,00000000), ref: 00B1DB21
SetCurrentDirectoryW.KERNEL32(?), ref: 00B1DB33

Strings

*.*, xrefs: 00B1DB72

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 9bfda2b1c009f82c79c73aa391a2aa22c3b113e9bfe6227686d6838efb0300c3
Instruction ID: 04f10152509840e8db5808f06c3dbed3916ebf9358f0e5adff1b2676e7953f61
Opcode Fuzzy Hash: 9bfda2b1c009f82c79c73aa391a2aa22c3b113e9bfe6227686d6838efb0300c3
Instruction Fuzzy Hash: 228192725182459FCB24EF24C9849EBB7E8FF88350F5848AEF586D7251D730E984CB92

Function 00B3C216 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B3C266
GetFocus.USER32 ref: 00B3C276
GetDlgCtrlID.USER32(00000000), ref: 00B3C281
_memset.LIBCMT ref: 00B3C3AC
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00B3C3D7
GetMenuItemCount.USER32(?), ref: 00B3C3F7
GetMenuItemID.USER32(?,00000000), ref: 00B3C40A
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00B3C43E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00B3C486
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B3C4BE
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00B3C4F3

Strings

0, xrefs: 00B3C3A4

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 1dff94f38b1d9ecf755e843087166987ff1409be4ab0e08aaff439dcfaa72104
Instruction ID: 0131dc27bd4794e9c7c1769e3d7cb4454d8786412f19b4e3ac925ee4eb28f97b
Opcode Fuzzy Hash: 1dff94f38b1d9ecf755e843087166987ff1409be4ab0e08aaff439dcfaa72104
Instruction Fuzzy Hash: A4818D71608311AFD720DF54D994A7BBBE8EF88314F20456EF999A7291CB70D804CBA2

Function 00B2742F Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B274A4
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00B274B0
CreateCompatibleDC.GDI32(?), ref: 00B274BC
SelectObject.GDI32(00000000,?), ref: 00B274C9
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00B2751D
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00B27559
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00B2757D
SelectObject.GDI32(00000006,?), ref: 00B27585
DeleteObject.GDI32(?), ref: 00B2758E
DeleteDC.GDI32(00000006), ref: 00B27595
ReleaseDC.USER32(00000000,?), ref: 00B275A0

Strings

(, xrefs: 00B27525

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: f0572c18107439b40b125ed3d206c1495217320450b02d2da65e87caa1fa887d
Instruction ID: cecabc44634d004dae12d2fbf6fd9c9c57c0a1dce500fe8c217c647de386a622
Opcode Fuzzy Hash: f0572c18107439b40b125ed3d206c1495217320450b02d2da65e87caa1fa887d
Instruction Fuzzy Hash: A4514971904219AFCB15CFA8DC85EAEBBF9EF48310F14846EF95A97210CB31A940CB50

Function 00AB6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00AD0AD7: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00AB6C6C,?,00008000), ref: 00AD0AF3

Part of subcall function 00AB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB48A1,?,?,00AB37C0,?), ref: 00AB48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00AB6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00AB6E5A

Part of subcall function 00AB59CD: _wcscpy.LIBCMT ref: 00AB5A05

Part of subcall function 00AD37BD: _iswctype.LIBCMT ref: 00AD37C5

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 00AEE77A
EA06, xrefs: 00AEE7AB
Error opening the file, xrefs: 00AEE796, 00AEE811
Bad directive syntax error, xrefs: 00AEEAF6
AU3!, xrefs: 00AB6CC1
Unterminated string, xrefs: 00AEEB3D
>>>AUTOIT SCRIPT<<<, xrefs: 00AEE7EF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 646b68bb3d12ba9baf2c628dbaa29050965e0ba4e63e491c30f1cb8738346c34
Instruction ID: 37392f13eec2398d87caff1cddf5cbea9ca170b53bbe82c117b01309da1da8de
Opcode Fuzzy Hash: 646b68bb3d12ba9baf2c628dbaa29050965e0ba4e63e491c30f1cb8738346c34
Instruction Fuzzy Hash: 52029D315083819FC724EF24C991AAFBBF9BF98354F14491DF48A972A2DB30D949CB52

Function 00AB45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AB45F9
GetMenuItemCount.USER32(00B75890), ref: 00AED6FD
GetMenuItemCount.USER32(00B75890), ref: 00AED7AD
GetCursorPos.USER32(?), ref: 00AED7F1
SetForegroundWindow.USER32(00000000), ref: 00AED7FA
TrackPopupMenuEx.USER32(00B75890,00000000,?,00000000,00000000,00000000), ref: 00AED80D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00AED819

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: c99e76fdeb7843cc13d011a47601c168a514fd8260f2efe10a29fc609eb5da0e
Instruction ID: 3473bb90242716730b223c3524b25e35e91d5cf24b40eacfde3ea21be9378b1f
Opcode Fuzzy Hash: c99e76fdeb7843cc13d011a47601c168a514fd8260f2efe10a29fc609eb5da0e
Instruction Fuzzy Hash: 7671E530600245BFEB209F55DC49FEABFA9FF09364F204216F519AA1E2CBB16C60DB54

Function 00B07B04 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

_memset.LIBCMT ref: 00B07B93
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B07BC8
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B07BE4
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B07C00
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B07C2A
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00B07C52
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B07C5D
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B07C62

Strings

\IPC$, xrefs: 00B07BAA
SOFTWARE\Classes\, xrefs: 00B07B34
\CLSID, xrefs: 00B07B4A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: d0694dd71ed20d39b2cfc751158243950c1c4cfa3bf117ecc53282c77063b30a
Instruction ID: 0132b0302733fa21ee1c1345a65bab8f46583c99db3094ca4eef857cda4479bc
Opcode Fuzzy Hash: d0694dd71ed20d39b2cfc751158243950c1c4cfa3bf117ecc53282c77063b30a
Instruction Fuzzy Hash: 14410B71C54229ABDB25EBA4DC95DFDB7B8FF08740F044169E815A31A2DF709E04CB90

Function 00B30EA5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2FE38,?,?), ref: 00B30EBC

Strings

HKCR, xrefs: 00B30F64
HKEY_CURRENT_CONFIG, xrefs: 00B30F79
HKLM, xrefs: 00B30F3A
HKEY_USERS, xrefs: 00B30FBD
HKU, xrefs: 00B30FCE
HKEY_CURRENT_USER, xrefs: 00B30F9B
HKCC, xrefs: 00B30F8A
HKEY_LOCAL_MACHINE, xrefs: 00B30F25
HKEY_CLASSES_ROOT, xrefs: 00B30F4F
HKCU, xrefs: 00B30FAC

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 4c1446f4ce1a5e4cc92d41ed89d668882323e1f87d2976f4ec7c69ef97725bfb
Instruction ID: e173d4e2e8ee7f9e111e4a34818b583ac981a8d6ca13f54a684ecc8b86fd5b7a
Opcode Fuzzy Hash: 4c1446f4ce1a5e4cc92d41ed89d668882323e1f87d2976f4ec7c69ef97725bfb
Instruction Fuzzy Hash: 5241603112024A8BCF24EF14DAE1AEE37A8FF51340F6444A5FC525B392DB399D5ACB60

Function 00B0FAD2 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00AEE5F9,00000010,?,Bad directive syntax error,00B3F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00B0FAF3
LoadStringW.USER32(00000000,?,00AEE5F9,00000010), ref: 00B0FAFA

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

_wprintf.LIBCMT ref: 00B0FB2D
__swprintf.LIBCMT ref: 00B0FB4F
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B0FBBE

Strings

Line %d:, xrefs: 00B0FB49
., xrefs: 00B0FBA4
Error: , xrefs: 00B0FB8C
%s (%d) : ==> %s.: %s %s, xrefs: 00B0FB28
Line %d (File "%s"):, xrefs: 00B0FB64

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 25c9f0bb439b86065e989e17e633819bd4a1e218b5c96e99043385be817bdc9a
Instruction ID: 877b871ff5d18dc4a1bd8b96dd85c71dbc256b52bb00f292bf8b40269b0fa0f2
Opcode Fuzzy Hash: 25c9f0bb439b86065e989e17e633819bd4a1e218b5c96e99043385be817bdc9a
Instruction Fuzzy Hash: 7F21603294021AEBCF22EFA0CD56EFE77B9BF18300F0444A6F515660A2DA759A18DB51

Function 00B1536E Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

Part of subcall function 00AB7A84: _memmove.LIBCMT ref: 00AB7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B153D7
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B153ED
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B153FE
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B15410
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B15421

Strings

open , xrefs: 00B15386
close PlayMe, xrefs: 00B153E8, 00B15415
play PlayMe wait, xrefs: 00B1540B
play PlayMe, xrefs: 00B1541C
status PlayMe mode, xrefs: 00B153D2
alias PlayMe, xrefs: 00B153B0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: c697a5e9e7610054815a83780513f4308077c11f86169ce16af453f13158a108
Instruction ID: dcb881c6d38f60efcf3250deeba5701b8dc92778afffb3af1432212ea7afd96f
Opcode Fuzzy Hash: c697a5e9e7610054815a83780513f4308077c11f86169ce16af453f13158a108
Instruction Fuzzy Hash: 63119121A50129B9D730B761DD9ADFF7BFCEFD1B40F4005A9B415A20E2DEA05D85C9A0

Function 00B146F8 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B14713
gethostname.WSOCK32(?,00000100), ref: 00B1472D
gethostbyname.WSOCK32(?), ref: 00B1473A
_wcscpy.LIBCMT ref: 00B14762
_memmove.LIBCMT ref: 00B14775
inet_ntoa.WSOCK32(?), ref: 00B14780
_strcat.LIBCMT ref: 00B1478E
_wcscpy.LIBCMT ref: 00B147A5
WSACleanup.WSOCK32 ref: 00B147B3
_wcscpy.LIBCMT ref: 00B147C1

Strings

0.0.0.0, xrefs: 00B1475C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: c2f4db9caf074f8f34cc5091dc9ffe50c353afe70efef9699c5cbbec4c89fc7f
Instruction ID: 012539a113e5866334e5d951f85b9fdc81d945649ed6cca670ecbe6a25e2813b
Opcode Fuzzy Hash: c2f4db9caf074f8f34cc5091dc9ffe50c353afe70efef9699c5cbbec4c89fc7f
Instruction Fuzzy Hash: 52110231904105ABCB24A720DD8AEEE77FCDB16710F5401B6F405971A1EFB09EC187A0

Function 00B1501C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00B15021

Part of subcall function 00AD034A: timeGetTime.WINMM(?,75C0B400,00AC0FDB), ref: 00AD034E

Sleep.KERNEL32(0000000A), ref: 00B1504D
EnumThreadWindows.USER32(?,Function_00064FCF,00000000), ref: 00B15071
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B15093
SetActiveWindow.USER32 ref: 00B150B2
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B150C0
SendMessageW.USER32(00000010,00000000,00000000), ref: 00B150DF
Sleep.KERNEL32(000000FA), ref: 00B150EA
IsWindow.USER32 ref: 00B150F6
EndDialog.USER32(00000000), ref: 00B15107

Strings

BUTTON, xrefs: 00B15085

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 3bd98aa32f00192a3ab8d265259aca1c884ff6e1ed00bcc3a26ad7ae8814521b
Instruction ID: d946c9066ca087bf13083a1c11ddfc16eb4d6e664dd10c8390535fcdbb6963e2
Opcode Fuzzy Hash: 3bd98aa32f00192a3ab8d265259aca1c884ff6e1ed00bcc3a26ad7ae8814521b
Instruction Fuzzy Hash: 4021F670200A09FFE7215F60ED89F7A3BA9E798385FA41068F109932B1EF618CD4D671

Function 00B1D619 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

CoInitialize.OLE32(00000000), ref: 00B1D676
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B1D709
SHGetDesktopFolder.SHELL32(?), ref: 00B1D71D
CoCreateInstance.OLE32(00B42D7C,00000000,00000001,00B68C1C,?), ref: 00B1D769
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B1D7D8
CoTaskMemFree.OLE32(?,?), ref: 00B1D830
_memset.LIBCMT ref: 00B1D86D
SHBrowseForFolderW.SHELL32(?), ref: 00B1D8A9
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B1D8CC
CoTaskMemFree.OLE32(00000000), ref: 00B1D8D3
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00B1D90A
CoUninitialize.OLE32(00000001,00000000), ref: 00B1D90C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 71d911513087a7970ac57a25bc9506b0356a677aa1dd71a926fe1a265473dc25
Instruction ID: 8379e9c7c09fe00f218a89d471d5bf608316f3ca8f3da594f1fb9e8972033ded
Opcode Fuzzy Hash: 71d911513087a7970ac57a25bc9506b0356a677aa1dd71a926fe1a265473dc25
Instruction Fuzzy Hash: CEB1ED75A00109AFDB14DFA4C984EAEBBF9FF49304B1484A9F909EB261DB30ED45CB50

Function 00B1034D Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B103C8
SetKeyboardState.USER32(?), ref: 00B10433
GetAsyncKeyState.USER32(000000A0), ref: 00B10453
GetKeyState.USER32(000000A0), ref: 00B1046A
GetAsyncKeyState.USER32(000000A1), ref: 00B10499
GetKeyState.USER32(000000A1), ref: 00B104AA
GetAsyncKeyState.USER32(00000011), ref: 00B104D6
GetKeyState.USER32(00000011), ref: 00B104E4
GetAsyncKeyState.USER32(00000012), ref: 00B1050D
GetKeyState.USER32(00000012), ref: 00B1051B
GetAsyncKeyState.USER32(0000005B), ref: 00B10544
GetKeyState.USER32(0000005B), ref: 00B10552

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 63555216eb4a807af668fa3ac91025bd31d6aaa9eab52f0f3724c2660e571581
Instruction ID: 12c26ae8a407980061ea27846bcde831caacb8508d326a6a57b0b8a0ee19dd91
Opcode Fuzzy Hash: 63555216eb4a807af668fa3ac91025bd31d6aaa9eab52f0f3724c2660e571581
Instruction Fuzzy Hash: BE51C6209187846AFB34FBA484517EEBFF4DF15380F8885D9D5C2561C2DAA49BCCCB61

Function 00B0C529 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00B0C545
GetWindowRect.USER32(00000000,?), ref: 00B0C557
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00B0C5B5
GetDlgItem.USER32(?,00000002), ref: 00B0C5C0
GetWindowRect.USER32(00000000,?), ref: 00B0C5D2
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00B0C626
GetDlgItem.USER32(?,000003E9), ref: 00B0C634
GetWindowRect.USER32(00000000,?), ref: 00B0C645
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00B0C688
GetDlgItem.USER32(?,000003EA), ref: 00B0C696
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B0C6B3
InvalidateRect.USER32(?,00000000,00000001), ref: 00B0C6C0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d4f6dfe2e1aa31f5091f0c547b682fefd6476a98b0b1c3ef3f91de4f18e21be2
Instruction ID: a9971b6773338ee7f8fed15a9d081b03875f265b36488a1809d1c8d7ec944a33
Opcode Fuzzy Hash: d4f6dfe2e1aa31f5091f0c547b682fefd6476a98b0b1c3ef3f91de4f18e21be2
Instruction Fuzzy Hash: 45513071F00205ABDB18CFA9DD86ABEBBB5EB88310F248269F515D72E0DB709D00CB50

Function 00AB201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AB2036,?,00000000,?,?,?,?,00AB16CB,00000000,?), ref: 00AB1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00AB20D3
KillTimer.USER32(-00000001,?,?,?,?,00AB16CB,00000000,?,?,00AB1AE2,?,?), ref: 00AB216E
DestroyAcceleratorTable.USER32(00000000), ref: 00AEBE26
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AB16CB,00000000,?,?,00AB1AE2,?,?), ref: 00AEBE57
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AB16CB,00000000,?,?,00AB1AE2,?,?), ref: 00AEBE6E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AB16CB,00000000,?,?,00AB1AE2,?,?), ref: 00AEBE8A
DeleteObject.GDI32(00000000), ref: 00AEBE9C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: f022cac529f2152615e9a1e85c2a17c8b1ffd1ecf84a33e7955bde3b155e8f88
Instruction ID: 201e35da425bff9fc544c7d91ca109cbcb01c2bd0844c1d00c96b4ca77843cc7
Opcode Fuzzy Hash: f022cac529f2152615e9a1e85c2a17c8b1ffd1ecf84a33e7955bde3b155e8f88
Instruction Fuzzy Hash: 20618D31510A41DFCB39AF19D948BAAB7F5FF40312F60852EE5464B972CBB1AC80DB91

Function 00AB21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00AB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AB25EC

GetSysColor.USER32(0000000F), ref: 00AB21D3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 2ffac6fe279c4ee28f60c12c19cf73307eb807b75d8ab3ade438a2149774f794
Instruction ID: 2cfa4cd100666c40d50b7cb235ce379d82ea5a2d93d1d29125fcbe44e439c688
Opcode Fuzzy Hash: 2ffac6fe279c4ee28f60c12c19cf73307eb807b75d8ab3ade438a2149774f794
Instruction Fuzzy Hash: E8419A31400544EBDB255F28E889BF93B6AEB06331F284266ED65DB1E6CB318C42DB21

Function 00B1A931 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00B3F910), ref: 00B1A995
GetDriveTypeW.KERNEL32(00000061,00B689A0,00000061), ref: 00B1AA5F
_wcscpy.LIBCMT ref: 00B1AA89

Strings

unknown, xrefs: 00B1AA20
network, xrefs: 00B1A9F3
fixed, xrefs: 00B1A9DD
removable, xrefs: 00B1A9C7
cdrom, xrefs: 00B1A9B1
all, xrefs: 00B1A99B
ramdisk, xrefs: 00B1AA09

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: cdcdda73d63b76ee48376a211aa97f90c9d1e3cb63145ece05c7f275d852fcc6
Instruction ID: b68fbacc3f2448385b5465e6e7e890e4e878ab3aeaec19dbd3b8a678505a5cf1
Opcode Fuzzy Hash: cdcdda73d63b76ee48376a211aa97f90c9d1e3cb63145ece05c7f275d852fcc6
Instruction Fuzzy Hash: 9651B0311183019BC314EF14CAD1AEFB7E9EF84340F9049ADF596572A2DB31A989CA53

Function 00AB9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00AB99C2
__swprintf.LIBCMT ref: 00AB9A0C
__i64tow.LIBCMT ref: 00AEF93F

Strings

False, xrefs: 00AEF907
0x%p, xrefs: 00AEF921
True, xrefs: 00AEF900
%.15g, xrefs: 00AB9A06

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 66045562c3b4c08fe68e1d7f3ed2ee95648e3a079ca53b1dda4ee2bcfee895d4
Instruction ID: e51cd716b6b4e32eb52cbccda6ff1d1a692318bbbac9178fbe03d9153453e08e
Opcode Fuzzy Hash: 66045562c3b4c08fe68e1d7f3ed2ee95648e3a079ca53b1dda4ee2bcfee895d4
Instruction Fuzzy Hash: 4041D431504205AEDB389F35D942FBA77F8EF44300F2044AEE54AD72A2EA319941C711

Function 00B37184 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B3719C
CreateMenu.USER32 ref: 00B371B7
SetMenu.USER32(?,00000000), ref: 00B371C6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B37253
IsMenu.USER32(?), ref: 00B37269
CreatePopupMenu.USER32 ref: 00B37273
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B372A0
DrawMenuBar.USER32 ref: 00B372A8

Strings

0, xrefs: 00B37192
F, xrefs: 00B37294

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 9214a9d16ab465e1298435eed6eb34a817402304e0b683e554c0820e55a53524
Instruction ID: dc964aa7b1dad417c8028640c621d0587095c3fa525d0bb27007f771fd76be93
Opcode Fuzzy Hash: 9214a9d16ab465e1298435eed6eb34a817402304e0b683e554c0820e55a53524
Instruction Fuzzy Hash: 514139B5A01209EFDB20DF64D884AAA7BF5FF49300F244169FD59A7360DB70A910DBA0

Function 00B374ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B37590
CreateCompatibleDC.GDI32(00000000), ref: 00B37597
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B375AA
SelectObject.GDI32(00000000,00000000), ref: 00B375B2
GetPixel.GDI32(00000000,00000000,00000000), ref: 00B375BD
DeleteDC.GDI32(00000000), ref: 00B375C6
GetWindowLongW.USER32(?,000000EC), ref: 00B375D0
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00B375E4
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00B375F0

Strings

static, xrefs: 00B37528

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 28275b2faaa968f4fd1b3d3c2fde4da43c68a1ee35f66a3899265af90ce5540b
Instruction ID: 7b6f31afd50b14cdf2ecb88af66885d0cd3734fc50ba36458b304f3b6b00a48a
Opcode Fuzzy Hash: 28275b2faaa968f4fd1b3d3c2fde4da43c68a1ee35f66a3899265af90ce5540b
Instruction Fuzzy Hash: 2A319E71544116BBDF259F68DC49FEF3BA9FF19320F210224FA15A61A0CB31E810DBA0

Function 00AD6F80 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AD6FBB

Part of subcall function 00AD8CA8: __getptd_noexit.LIBCMT ref: 00AD8CA8

__gmtime64_s.LIBCMT ref: 00AD7054
__gmtime64_s.LIBCMT ref: 00AD708A
__gmtime64_s.LIBCMT ref: 00AD70A7
__allrem.LIBCMT ref: 00AD70FD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD7119
__allrem.LIBCMT ref: 00AD7130
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD714E
__allrem.LIBCMT ref: 00AD7165
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD7183
__invoke_watson.LIBCMT ref: 00AD71F4

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 67f4ed22d15b9a31a8f76a3cf2b6398ae9a578c13b40c325ca72463682c38276
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: DB71C572A00B16ABEB189F69CD42B5EB3A8AF15724F14432BF516D7381F774DA408790

Function 00B1281F Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B1283A
GetMenuItemInfoW.USER32(00B75890,000000FF,00000000,00000030), ref: 00B1289B
SetMenuItemInfoW.USER32(00B75890,00000004,00000000,00000030), ref: 00B128D1
Sleep.KERNEL32(000001F4), ref: 00B128E3
GetMenuItemCount.USER32(?), ref: 00B12927
GetMenuItemID.USER32(?,00000000), ref: 00B12943
GetMenuItemID.USER32(?,-00000001), ref: 00B1296D
GetMenuItemID.USER32(?,?), ref: 00B129B2
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B129F8
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B12A0C
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B12A2D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 0507cf6b67af30eb7d8d52d4926530768aa7279751f4ade47ecde7f5856c68f8
Instruction ID: 1345502f92e1df763916960c9a72e3fb14f71469e8274282bc434ddce4f3d6dd
Opcode Fuzzy Hash: 0507cf6b67af30eb7d8d52d4926530768aa7279751f4ade47ecde7f5856c68f8
Instruction Fuzzy Hash: 9E619070900249AFDF21CF64D9889FE7BF8EF45344F9400A9E842A3251DB31ADA5DB20

Function 00B36F55 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B36FD7
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B36FDA
GetWindowLongW.USER32(?,000000F0), ref: 00B36FFE
_memset.LIBCMT ref: 00B3700F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B37021
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B37099

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: d701b2ed88c6b8e2090f208c5b7a3375b828755eeb8d7a1f90929eedc6b735f1
Instruction ID: 45b10e9506a8dcf0ccfa4e941237d458659118e28ae66fab143a828fa0ece88a
Opcode Fuzzy Hash: d701b2ed88c6b8e2090f208c5b7a3375b828755eeb8d7a1f90929eedc6b735f1
Instruction Fuzzy Hash: 52617F75940608AFDB21DFA4CC81EEE77F8EF09710F24419AFA15AB2A1CB70AD45DB50

Function 00B06EEE Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00B06F15
SafeArrayAllocData.OLEAUT32(?), ref: 00B06F6E
VariantInit.OLEAUT32(?), ref: 00B06F80
SafeArrayAccessData.OLEAUT32(?,?), ref: 00B06FA0
VariantCopy.OLEAUT32(?,?), ref: 00B06FF3
SafeArrayUnaccessData.OLEAUT32(?), ref: 00B07007
VariantClear.OLEAUT32(?), ref: 00B0701C
SafeArrayDestroyData.OLEAUT32(?), ref: 00B07029
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B07032
VariantClear.OLEAUT32(?), ref: 00B07044
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B0704F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 3f678e94dbc638985eb8f554d6967cbeed8446abdd10e365841d8058903aa1d8
Instruction ID: 89e30a730b4ecbdd5ab2c46e8b19e5d99a3a3494e8691e437f646d9540cf97c3
Opcode Fuzzy Hash: 3f678e94dbc638985eb8f554d6967cbeed8446abdd10e365841d8058903aa1d8
Instruction Fuzzy Hash: E7412E35E0021AAFCF00DFA8D8489AEBFF9EF48354F108069E955A7361DB31A955CB90

Function 00B25848 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B258A9
inet_addr.WSOCK32(?,?,?), ref: 00B258EE
gethostbyname.WSOCK32(?), ref: 00B258FA
IcmpCreateFile.IPHLPAPI ref: 00B25908
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B25978
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B2598E
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00B25A03
WSACleanup.WSOCK32 ref: 00B25A09

Strings

Ping, xrefs: 00B2592C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: ab70f8a0a49afd13e30966e02d56477f5e1cf86a78de45acfb33a97ca88ddd3d
Instruction ID: b4e60d1eb9ec73b542771eb299db1a1f02db85ca8242deea2af0eed6324f0869
Opcode Fuzzy Hash: ab70f8a0a49afd13e30966e02d56477f5e1cf86a78de45acfb33a97ca88ddd3d
Instruction Fuzzy Hash: A9518031604711DFD720AF24DD85B6A7BE4EF48720F14456AF99ADB2A1DB70EC40DB41

Function 00B1B54F Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B1B55C
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00B1B5D2
GetLastError.KERNEL32 ref: 00B1B5DC
SetErrorMode.KERNEL32(00000000,READY), ref: 00B1B649

Strings

READY, xrefs: 00B1B622
INVALID, xrefs: 00B1B61B
NOTREADY, xrefs: 00B1B608
READONLY, xrefs: 00B1B614
UNKNOWN, xrefs: 00B1B601

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 52ed4053ac9520a78b21cf1f3b78cca092de464a4fa281453b28913a3c00ac8f
Instruction ID: ad19f1b65bc46e9f529825b3f9d0611e426b7c90bcc4d76f473cccbee1f7ac0e
Opcode Fuzzy Hash: 52ed4053ac9520a78b21cf1f3b78cca092de464a4fa281453b28913a3c00ac8f
Instruction Fuzzy Hash: 50316975A002099BCB10EFA4D995EEEB7F8EF68300F5441A5F501972A2DB719A82CA90

Function 00B09251 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00B0AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AEC7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00B092D6
GetDlgCtrlID.USER32 ref: 00B092E1
GetParent.USER32 ref: 00B092FD
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B09300
GetDlgCtrlID.USER32(?), ref: 00B09309
GetParent.USER32(?), ref: 00B09325
SendMessageW.USER32(00000000,?,?,00000111), ref: 00B09328

Strings

ComboBox, xrefs: 00B0925E
ListBox, xrefs: 00B09293

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 1d6717dce5d869c44850aa28baadb426623b602e90737c0c3fc8408804208cec
Instruction ID: c18709049e97d8aa713e602069851db93c1ea5b79eda1fe390ebfc4e06bf0a8c
Opcode Fuzzy Hash: 1d6717dce5d869c44850aa28baadb426623b602e90737c0c3fc8408804208cec
Instruction Fuzzy Hash: 8621D670D40204BBDF04AB60CC86EFEBBB8EF55310F204199F561972E2DF795815DA20

Function 00B0933C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00B0AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AEC7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00B093BF
GetDlgCtrlID.USER32 ref: 00B093CA
GetParent.USER32 ref: 00B093E6
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B093E9
GetDlgCtrlID.USER32(?), ref: 00B093F2
GetParent.USER32(?), ref: 00B0940E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00B09411

Strings

ComboBox, xrefs: 00B09349
ListBox, xrefs: 00B0937E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 8e4f5a3d7c2aacf120e31095cea11c2f69287cdd2d45ff20aee8517584953e23
Instruction ID: 1784ceb498eb563798c0d02116836001deec2fb98f4baef7950e4ed3a57a52dc
Opcode Fuzzy Hash: 8e4f5a3d7c2aacf120e31095cea11c2f69287cdd2d45ff20aee8517584953e23
Instruction Fuzzy Hash: 87218374E00204BBDF10ABA5CC86EFEBBB8EF55300F2041A5F951972E6DB795915DA20

Function 00B09425 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B09431
GetClassNameW.USER32(00000000,?,00000100), ref: 00B09446
_wcscmp.LIBCMT ref: 00B09458
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B094D3

Strings

SHELLDLL_DefView, xrefs: 00B09452
list, xrefs: 00B094B5
largeicons, xrefs: 00B09467
smallicons, xrefs: 00B0949B
details, xrefs: 00B09481

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: fcb2abe21995b054a1eaf78ed00090defeab93bab9c314dc0b5e5c7a1968c684
Instruction ID: 950f37fbf1e8bb33aa3e6f96a14eac77c4d0d2a3ad7d5982866f5e71393ee22f
Opcode Fuzzy Hash: fcb2abe21995b054a1eaf78ed00090defeab93bab9c314dc0b5e5c7a1968c684
Instruction Fuzzy Hash: F71106B768C307BAFA202620AC07DBE3BDCCF05724B2040A7F905A52F2FE6568528595

Function 00B289C0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B289EC
CoInitialize.OLE32(00000000), ref: 00B28A19
CoUninitialize.OLE32 ref: 00B28A23
GetRunningObjectTable.OLE32(00000000,?), ref: 00B28B23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00B28C50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00B42C0C), ref: 00B28C84
CoGetObject.OLE32(?,00000000,00B42C0C,?), ref: 00B28CA7
SetErrorMode.KERNEL32(00000000), ref: 00B28CBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B28D3A
VariantClear.OLEAUT32(?), ref: 00B28D4A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: f2eff1a1e503a4ee958cea45193f4c0c15d4666414eb627f4288adb959f14e28
Instruction ID: ae9c7a09515c1a32e3c054ad6ed8d3c0ecbaa6a865ee1f24cdd5a1ec053595a2
Opcode Fuzzy Hash: f2eff1a1e503a4ee958cea45193f4c0c15d4666414eb627f4288adb959f14e28
Instruction Fuzzy Hash: 37C157B1609315AFD700DF64D88492BB7E9FF88348F0049ADF58A9B261DB31ED05CB52

Function 00B17A39 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00B17B15

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 2110c374f69835306b3aa491b7a529ac763c7aec30bbf579e3f3983eb0a00f3b
Instruction ID: d47cb14fefff8af43dc9c20788cf95a7c8c136672190b207196e011af12551a6
Opcode Fuzzy Hash: 2110c374f69835306b3aa491b7a529ac763c7aec30bbf579e3f3983eb0a00f3b
Instruction Fuzzy Hash: 3CB1A2B194821A9FDB10DFA8D885BFEB7F4FF09321F6444A9E501E7251DB34A981CB90

Function 00B114FF Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B11521
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B10599,?,00000001), ref: 00B11535
GetWindowThreadProcessId.USER32(00000000), ref: 00B1153C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B10599,?,00000001), ref: 00B1154B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B1155D
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B10599,?,00000001), ref: 00B11576
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B10599,?,00000001), ref: 00B11588
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B10599,?,00000001), ref: 00B115CD
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00B10599,?,00000001), ref: 00B115E2
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00B10599,?,00000001), ref: 00B115ED

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 8e39b1d01db84f35f811e34eb86ebfc7bccd543f30d160b0f0ac280801015819
Instruction ID: 2992a18c70ca91d91329b763909ad0e09803de367b55ad74ee23781e358def73
Opcode Fuzzy Hash: 8e39b1d01db84f35f811e34eb86ebfc7bccd543f30d160b0f0ac280801015819
Instruction Fuzzy Hash: 80319C71D00605BBDB10DF98EC44FB977EAEBA5311F604466FA0ACB1A0DB709DC08B61

Function 00ABFBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00ABFC06
OleUninitialize.OLE32(?,00000000), ref: 00ABFCA5
UnregisterHotKey.USER32(?), ref: 00ABFDFC
DestroyWindow.USER32(?), ref: 00AF492F
FreeLibrary.KERNEL32(?), ref: 00AF4994
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00AF49C1

Strings

close all, xrefs: 00ABFC01

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: bb7c001c9e2fa8671d9f52fc89adb6be99d71a5d2213ea3776ad2020bfa3b43f
Instruction ID: e39d449bc78d8ef30fdc5a191ed47ca82244e1dc062632091cb61a229d7c36b2
Opcode Fuzzy Hash: bb7c001c9e2fa8671d9f52fc89adb6be99d71a5d2213ea3776ad2020bfa3b43f
Instruction Fuzzy Hash: 80A17F31701216CFCB28EF54C995B7AF7A8AF05740F5542ADF90A6B262DB30AD52CF50

Function 00B0A473 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00B0A844), ref: 00B0A782

Strings

CLASS, xrefs: 00B0A501
INSTANCE, xrefs: 00B0A690
NAME, xrefs: 00B0A5B4
REGEXPCLASS, xrefs: 00B0A547
CLASSNN, xrefs: 00B0A524
TEXT, xrefs: 00B0A6B9

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 761bff6bd611ee34d7096e5f93cd1fde3a2896291ba54d9196b7b6b944dc25ae
Instruction ID: 765579b6fd78799d67e0d1be678c3ee1368152caa880bfa7b914bda98ef031a0
Opcode Fuzzy Hash: 761bff6bd611ee34d7096e5f93cd1fde3a2896291ba54d9196b7b6b944dc25ae
Instruction Fuzzy Hash: A1919031A00605AACB18DF60C5D1BE9FFF8FF04304F54859AD85AA7291DF316999CB91

Function 00AB2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00AB2EAE

Part of subcall function 00AB1DB3: GetClientRect.USER32(?,?), ref: 00AB1DDC
Part of subcall function 00AB1DB3: GetWindowRect.USER32(?,?), ref: 00AB1E1D
Part of subcall function 00AB1DB3: ScreenToClient.USER32(?,?), ref: 00AB1E45

GetDC.USER32 ref: 00AECEB2
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00AECEC5
SelectObject.GDI32(00000000,00000000), ref: 00AECED3
SelectObject.GDI32(00000000,00000000), ref: 00AECEE8
ReleaseDC.USER32(?,00000000), ref: 00AECEF0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00AECF7B

Strings

U, xrefs: 00AECE50

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 55fe3874f119b32bfcd8304199fc1474fbca2e1c50d9245df8801472e1b8ae1a
Instruction ID: 337fad1ff531266231979b5832344db6497f3f2d6954e49c5b112e764d86f139
Opcode Fuzzy Hash: 55fe3874f119b32bfcd8304199fc1474fbca2e1c50d9245df8801472e1b8ae1a
Instruction Fuzzy Hash: 0371B031500245DFCF258F65C884AFA7BBAFF48320F14426AFD555A2A6D7319C42DF60

Function 00B21B2B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B21B66
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00B21B92
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00B21BD4
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00B21BE9
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B21BF6
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00B21C26
InternetCloseHandle.WININET(00000000), ref: 00B21C6D

Part of subcall function 00B22599: GetLastError.KERNEL32(?,?,00B2192D,00000000,00000000,00000001), ref: 00B225AE
Part of subcall function 00B22599: SetEvent.KERNEL32(?,?,00B2192D,00000000,00000000,00000001), ref: 00B225C3

Strings

, xrefs: 00B21C17

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 57c988b48051e22ae403dddedae172b9e3ece18d877ecd28432f9c0721f0f5a2
Instruction ID: 1405accc92c6c440830116403890d66dac02c68ca577400e9fac25f6c731f3be
Opcode Fuzzy Hash: 57c988b48051e22ae403dddedae172b9e3ece18d877ecd28432f9c0721f0f5a2
Instruction Fuzzy Hash: EB41A1B1940229BFEB119F54DC89FBF77ACEF18350F104166FA099A151EB709E448BA0

Function 00B28D5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00B3F910), ref: 00B28E3D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00B3F910), ref: 00B28E71
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B28FEB
SysFreeString.OLEAUT32(?), ref: 00B29015

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 89d4d26ad39152e8430b6a9a4c842b04cb4b426d07e975b622302bc1bc17547e
Instruction ID: 2b07e3198bb39956f95d29a3a47d082c62b069f0c6cd881dd7ebe23a1cc22256
Opcode Fuzzy Hash: 89d4d26ad39152e8430b6a9a4c842b04cb4b426d07e975b622302bc1bc17547e
Instruction Fuzzy Hash: 0BF15A31A00219EFCF04DF94D888EAEB7B9FF49315F1084A8F919AB251CB31AE45CB50

Function 00B2F7A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B2F7C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B2F95C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B2F980
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B2F9C0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B2F9E2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B2FB5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00B2FB90
CloseHandle.KERNEL32(?), ref: 00B2FBBF
CloseHandle.KERNEL32(?), ref: 00B2FC36

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 12285ce9bd27f7f960f76547ae2d4f6cb80026a5ead207d049af10196d3a864e
Instruction ID: 63073a50206d8256484e96e73bb1ab34d363f854507a2160052f0e556f40b18a
Opcode Fuzzy Hash: 12285ce9bd27f7f960f76547ae2d4f6cb80026a5ead207d049af10196d3a864e
Instruction Fuzzy Hash: B2E19F316042129FC714EF24D991B6ABBF5EF89350F1485BDF88A9B2A2CB31DC41CB52

Function 00B14D68 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B146AF: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B136DB,?), ref: 00B146CC

Part of subcall function 00B146AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B136DB,?), ref: 00B146E5

Part of subcall function 00B14AD8: GetFileAttributesW.KERNEL32(?,00B1374F), ref: 00B14AD9

lstrcmpiW.KERNEL32(?,?), ref: 00B14DE7
_wcscmp.LIBCMT ref: 00B14E01
MoveFileW.KERNEL32(?,?), ref: 00B14E1C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 0526e6e5062c2c56602e6d9597da05fa86e3685b21fbc483892134a98aeeb239
Instruction ID: bfaf5835382d93d4764ad180b123f6c98ce1cba70e089c7fd9dc8858af008f42
Opcode Fuzzy Hash: 0526e6e5062c2c56602e6d9597da05fa86e3685b21fbc483892134a98aeeb239
Instruction Fuzzy Hash: 735162B24083859BC724EBA0D9819DFB7ECEF85300F50096EB189D3152EF74A688C766

Function 00B38677 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B38731

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 7b7517ea686b5f187cf6225b7ee3a845c87f5e18906f4de14c7341cb9377cb52
Instruction ID: a3809364274dd3b69c68b6d5161a0525da66941c488c24722b6fc9f549dfedff
Opcode Fuzzy Hash: 7b7517ea686b5f187cf6225b7ee3a845c87f5e18906f4de14c7341cb9377cb52
Instruction Fuzzy Hash: 02517F70A00304BAEF249B69CC86BAD7BE5EB05350F704596FA15E61E1CF71AD90CB92

Function 00AB2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00AEC477
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00AEC499
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00AEC4B1
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00AEC4CF
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00AEC4F0
DestroyIcon.USER32(00000000), ref: 00AEC4FF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00AEC51C
DestroyIcon.USER32(?), ref: 00AEC52B

Part of subcall function 00B3A4E1: DeleteObject.GDI32(00000000), ref: 00B3A51A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: df4f15ea7cbe476ca4c427d68be516b523ec4151da5820b159e4802d65fc0748
Instruction ID: 15030115031342a3311816297a8c1e1585d507ca53540835e926a5d63f423a6f
Opcode Fuzzy Hash: df4f15ea7cbe476ca4c427d68be516b523ec4151da5820b159e4802d65fc0748
Instruction Fuzzy Hash: DC515A70A00209EFDB24DF25DC45FAA3BB9EB58720F204529F94697291DB70AD91DB60

Function 00B09930 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0AC37: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B0AC57
Part of subcall function 00B0AC37: GetCurrentThreadId.KERNEL32 ref: 00B0AC5E
Part of subcall function 00B0AC37: AttachThreadInput.USER32(00000000,?,00B09945,?,00000001), ref: 00B0AC65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00B09950
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00B0996D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00B09970
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B09979
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00B09997
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00B0999A
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B099A3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00B099BA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00B099BD

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 602aee1ccc9d9b2b6caa644d5dc6f0f977007acfb05b0d8105edefd2e1458dde
Instruction ID: 462299953dae0571beb83ca70e107a75648d7ac4d4054937a58cb85616d6c9e8
Opcode Fuzzy Hash: 602aee1ccc9d9b2b6caa644d5dc6f0f977007acfb05b0d8105edefd2e1458dde
Instruction Fuzzy Hash: 3F11E1B1950618BFFA106B60DC8AF6A7F6DEB4C751F210429F344AB0E0CDF26C10DAA4

Function 00B08BE3 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00B08864,00000B00,?,?), ref: 00B08BEC
HeapAlloc.KERNEL32(00000000,?,00B08864,00000B00,?,?), ref: 00B08BF3
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B08864,00000B00,?,?), ref: 00B08C08
GetCurrentProcess.KERNEL32(?,00000000,?,00B08864,00000B00,?,?), ref: 00B08C10
DuplicateHandle.KERNEL32(00000000,?,00B08864,00000B00,?,?), ref: 00B08C13
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00B08864,00000B00,?,?), ref: 00B08C23
GetCurrentProcess.KERNEL32(00B08864,00000000,?,00B08864,00000B00,?,?), ref: 00B08C2B
DuplicateHandle.KERNEL32(00000000,?,00B08864,00000B00,?,?), ref: 00B08C2E
CreateThread.KERNEL32(00000000,00000000,00B08C54,00000000,00000000,00000000), ref: 00B08C48

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: cc900cffa92c83295e439c424922e133c6ef5c44a621ff677b608db2eb73a221
Instruction ID: 4e3fcb686ca24c2d147e94188d0681c82729e69001937b33999ad24abee17257
Opcode Fuzzy Hash: cc900cffa92c83295e439c424922e133c6ef5c44a621ff677b608db2eb73a221
Instruction Fuzzy Hash: 3601BBB5640749FFEB10ABA5EC4DF6B3BACEB89711F104421FA05DB1A1CA709804DB20

Function 00B29228 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B2927C
VariantInit.OLEAUT32(?), ref: 00B2934D
VariantInit.OLEAUT32(?), ref: 00B2944E
VariantClear.OLEAUT32(?), ref: 00B29458
VariantClear.OLEAUT32(?), ref: 00B294B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 00B292DD, 00B2940B, 00B294C3
Incorrect Object type in FOR..IN loop, xrefs: 00B29431

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: fc5c5de1e51cf270a53e10465bffc1c6fc89977acfb77c9e30480cddbab329bd
Instruction ID: 917a4471741a36c96c7309156091e21eeb0f4d0dbf9036122444c4291af370bd
Opcode Fuzzy Hash: fc5c5de1e51cf270a53e10465bffc1c6fc89977acfb77c9e30480cddbab329bd
Instruction Fuzzy Hash: E4916F71A00225ABDF24DFA5E884FAEB7F8EF45710F108599F51DAB280D7709945CBA0

Function 00B29872 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00B07432: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?,?,?,00B0777D), ref: 00B0744F
Part of subcall function 00B07432: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?,?), ref: 00B0746A
Part of subcall function 00B07432: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?,?), ref: 00B07478
Part of subcall function 00B07432: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?), ref: 00B07488

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00B2991B
_memset.LIBCMT ref: 00B29928
_memset.LIBCMT ref: 00B29A6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00B29A97
CoTaskMemFree.OLE32(?), ref: 00B29AA2

Strings

NULL Pointer assignment, xrefs: 00B29AF0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 34729d36ad893caa3f325d56d8bcfb445581077a1121aa63f961ba229d3ce16f
Instruction ID: c11b90a65989c60d16b424031ee2feb72cc3c2011c3e708228eccb3422f09de5
Opcode Fuzzy Hash: 34729d36ad893caa3f325d56d8bcfb445581077a1121aa63f961ba229d3ce16f
Instruction Fuzzy Hash: 91912971D00229EBDF10DFA4EC85ADEBBB8EF09710F20419AF519A7291DB715A45CFA0

Function 00B36DB2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B36E56
SendMessageW.USER32(?,00001036,00000000,?), ref: 00B36E6A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B36E84
_wcscat.LIBCMT ref: 00B36EDF
SendMessageW.USER32(?,00001057,00000000,?), ref: 00B36EF6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B36F24

Strings

SysListView32, xrefs: 00B36E28

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: f1fa5dd73f1a2bf07a9a1baad1a1bbfaa5bade03cd3eb4457aa0b4f18bcfdc7a
Instruction ID: c7d3beffaf290f0f60efa01a86229d39a12ab6fbd2b0f219ce1d9cc68b170d97
Opcode Fuzzy Hash: f1fa5dd73f1a2bf07a9a1baad1a1bbfaa5bade03cd3eb4457aa0b4f18bcfdc7a
Instruction Fuzzy Hash: 92418275A00308BBEB219F64CC85BEE77F8EF08350F2044AAF545E7291D6729D84CB60

Function 00B2EA47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00B13C99: CreateToolhelp32Snapshot.KERNEL32 ref: 00B13CBE
Part of subcall function 00B13C99: Process32FirstW.KERNEL32(00000000,?), ref: 00B13CCC
Part of subcall function 00B13C99: CloseHandle.KERNEL32(00000000), ref: 00B13D96

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B2EAB8
GetLastError.KERNEL32 ref: 00B2EACB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B2EAFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00B2EB77
GetLastError.KERNEL32(00000000), ref: 00B2EB82
CloseHandle.KERNEL32(00000000), ref: 00B2EBB7

Strings

SeDebugPrivilege, xrefs: 00B2EAD6

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 59f64a5ebb901f57875f7d034ff6b2bbd2e2a4dfabe861cb6ce32cf3d86e41e6
Instruction ID: 2ffb8ae6d76081b315d8bd2207c97bd533f5a3a79e36ddd8624e93f0202ec0f7
Opcode Fuzzy Hash: 59f64a5ebb901f57875f7d034ff6b2bbd2e2a4dfabe861cb6ce32cf3d86e41e6
Instruction Fuzzy Hash: C44199316002119FDB14EF14DC99FAEBBE5AF40710F18809DF946AB2D2CB74E804CB85

Function 00B1302E Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00B130CD

Strings

blank, xrefs: 00B1304F
question, xrefs: 00B13086
stop, xrefs: 00B1309E
info, xrefs: 00B1306E
warning, xrefs: 00B130B6

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 6ec35c5707bca4ddf88ffbada82b3c5a76ac5c6fd545ce55f5fedb80070c9303
Instruction ID: 349672e8b568b461d376613ea38018e3749dc71b7c8380e6e7a631f3c42bc07a
Opcode Fuzzy Hash: 6ec35c5707bca4ddf88ffbada82b3c5a76ac5c6fd545ce55f5fedb80070c9303
Instruction Fuzzy Hash: 5F110836608347BADB205B14DC86EFA77DCDF19B20F6000ABF50596281FEA55F8045A1

Function 00B14339 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B14353
LoadStringW.USER32(00000000), ref: 00B1435A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B14370
LoadStringW.USER32(00000000), ref: 00B14377
_wprintf.LIBCMT ref: 00B1439D
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B143BB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B14398

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 79685fecb6cbcb739406eb5b783793b1f705ffb3a1fae357b1438ac93c10a752
Instruction ID: c0445670b3bc5130f3fa97f695714bf3ce21cccb2bd04ce6abe003e662702052
Opcode Fuzzy Hash: 79685fecb6cbcb739406eb5b783793b1f705ffb3a1fae357b1438ac93c10a752
Instruction Fuzzy Hash: 65014FF2900209BFE7519BA0AD89EFA77ACD708701F5005B6B705E3051EE749E858B75

Function 00B3D4A8 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

GetSystemMetrics.USER32(0000000F), ref: 00B3D4E6
GetSystemMetrics.USER32(0000000F), ref: 00B3D506
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00B3D741
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B3D75F
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B3D780
ShowWindow.USER32(00000003,00000000), ref: 00B3D79F
InvalidateRect.USER32(?,00000000,00000001), ref: 00B3D7C4
DefDlgProcW.USER32(?,00000005,?,?), ref: 00B3D7E7

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 553d7667a838513b178ca39b615eed1115fbd77387dbeba178cd4577c29b26c3
Instruction ID: 0738dabdd806e74ea40b1623cd20c1b0ec25153f86cf570ef8a42335eaf168db
Opcode Fuzzy Hash: 553d7667a838513b178ca39b615eed1115fbd77387dbeba178cd4577c29b26c3
Instruction Fuzzy Hash: E4B16775A00229EBDF14CF28D9857AD7BF1FF04711F2880A9EC589B295DB34AD90CB50

Function 00AB2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00AEC347,00000004,00000000,00000000,00000000), ref: 00AB2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00AEC347,00000004,00000000,00000000,00000000,000000FF), ref: 00AB2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00AEC347,00000004,00000000,00000000,00000000), ref: 00AEC39A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00AEC347,00000004,00000000,00000000,00000000), ref: 00AEC406

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: f9a14584e08b63859db58ec812e5a1eb9ceb8daf28b03be7d62ff3b017273465
Instruction ID: b222b98f5a5bcab18cf645d16c3b60357f521334ce87b4f1fea32d54132a8bfb
Opcode Fuzzy Hash: f9a14584e08b63859db58ec812e5a1eb9ceb8daf28b03be7d62ff3b017273465
Instruction Fuzzy Hash: BB41D9316047C19BD7359B298D88BFBBBAABB45350F38C81FE047875A2CA75A842D711

Function 00B1716F Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00B17186

Part of subcall function 00AD0F36: std::exception::exception.LIBCMT ref: 00AD0F6C
Part of subcall function 00AD0F36: __CxxThrowException@8.LIBCMT ref: 00AD0F81

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00B171BD
EnterCriticalSection.KERNEL32(?), ref: 00B171D9
_memmove.LIBCMT ref: 00B17227
_memmove.LIBCMT ref: 00B17244
LeaveCriticalSection.KERNEL32(?), ref: 00B17253
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00B17268
InterlockedExchange.KERNEL32(?,000001F6), ref: 00B17287

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 55ed4d23242cf9f7c70cf70f35f60fc3ceab13cede5ca6b428fc9dee086d3027
Instruction ID: f751e988669612658ec64d2194bee8e2186f886ef8f17489950435ee67ea1002
Opcode Fuzzy Hash: 55ed4d23242cf9f7c70cf70f35f60fc3ceab13cede5ca6b428fc9dee086d3027
Instruction Fuzzy Hash: 93318131900205EBCF10DF94DD85EAF77B8EF49710F2441AAF905AB256DB709E55CBA0

Function 00B36205 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B3621D
GetDC.USER32(00000000), ref: 00B36225
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B36230
ReleaseDC.USER32(00000000,00000000), ref: 00B3623C
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B36278
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B36289
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B3905C,?,?,000000FF,00000000,?,000000FF,?), ref: 00B362C3
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B362E3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: cf864c9633810d1676cb07400d8739c0a5f9211e2cf424451b91014b76891ee0
Instruction ID: fe5a8eb860ca5defb6f9373966717665513dff8b01e6a48e4659533e3e13222d
Opcode Fuzzy Hash: cf864c9633810d1676cb07400d8739c0a5f9211e2cf424451b91014b76891ee0
Instruction Fuzzy Hash: 38319C72600210BFEB108F14DC8AFFB3FA9EF09721F144065FE089A291CA759C41CBA4

Function 00B1EBAF Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

Part of subcall function 00ACFE06: _wcscpy.LIBCMT ref: 00ACFE29

_wcstok.LIBCMT ref: 00B1ED20
_wcscpy.LIBCMT ref: 00B1EDAF
_memset.LIBCMT ref: 00B1EDE2

Strings

X, xrefs: 00B1EE1F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 168c05db03abfbbc4b8c28c32d5d491741951c02d1f52f5417ed6fa298108ab9
Instruction ID: ad2595120a914b9bb0d8bef62c2587eb3b336061333e161a3ec3f9cb39058e5b
Opcode Fuzzy Hash: 168c05db03abfbbc4b8c28c32d5d491741951c02d1f52f5417ed6fa298108ab9
Instruction Fuzzy Hash: 13C192315083009FC764EF24C985A9EB7E4FF89310F54496DF8999B2A2DB70ED45CB82

Function 00AB1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19f5d52516e260da85a8f114c2c650210267919020b571f1f4f268ff0ea2bb9
Instruction ID: f458ec0d1102a34fd14756ff974c53e77f076a60926c65e856d7ab8034febc85
Opcode Fuzzy Hash: d19f5d52516e260da85a8f114c2c650210267919020b571f1f4f268ff0ea2bb9
Instruction Fuzzy Hash: 59715770900149EFCB148F99CC99AFFBBB9FF85310F608159F915AA252C734AA51CBA0

Function 00B26C8C Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3024594a0afd01925d0a2bbb6c61334472c8360b3724029bed349c816e1da52
Instruction ID: dd368048a94aca139e5b4ea82d50a0da2f73b4522154f5b519658d70e913089a
Opcode Fuzzy Hash: e3024594a0afd01925d0a2bbb6c61334472c8360b3724029bed349c816e1da52
Instruction Fuzzy Hash: AF619971508310ABD710EF24DD86EAFB7EDEF88710F104959F55A9B2A2DA70ED04CB92

Function 00B3B385 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00C95A08), ref: 00B3B41F
IsWindowEnabled.USER32(00C95A08), ref: 00B3B42B
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00B3B50F
SendMessageW.USER32(00C95A08,000000B0,?,?), ref: 00B3B546
IsDlgButtonChecked.USER32(?,?), ref: 00B3B583
GetWindowLongW.USER32(00C95A08,000000EC), ref: 00B3B5A5
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B3B5BD

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: c63052ed368b71136cfcf2e18f220acc75e53c4f699fcfb83a817a0ae91d76ad
Instruction ID: 14fe32e3756f40416d06fc24a18d694ed047dc1ffada17ab21dd127576961f4f
Opcode Fuzzy Hash: c63052ed368b71136cfcf2e18f220acc75e53c4f699fcfb83a817a0ae91d76ad
Instruction Fuzzy Hash: DA718F35A01204AFDB259F68C895FBABBF9EF19300F2440E9EA5597366C731AD50CB14

Function 00B2F532 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B2F55C
_memset.LIBCMT ref: 00B2F625
ShellExecuteExW.SHELL32(?), ref: 00B2F66A

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

Part of subcall function 00ACFE06: _wcscpy.LIBCMT ref: 00ACFE29

GetProcessId.KERNEL32(00000000), ref: 00B2F6E1
CloseHandle.KERNEL32(00000000), ref: 00B2F710

Strings

@, xrefs: 00B2F639

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 1161050615d1a89f736c56b7218da97a19f62212c598d6eff158095c803bf0dc
Instruction ID: ae4585987a5462de36b46f2e526bf336023a53bed69d49aef42b2c1e91c4d7d1
Opcode Fuzzy Hash: 1161050615d1a89f736c56b7218da97a19f62212c598d6eff158095c803bf0dc
Instruction Fuzzy Hash: D1618175A006299FCF15DF54D5819AEBBF5FF48310F1484ADE85AAB361CB30AD41CB90

Function 00B1127E Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B112BD
GetKeyboardState.USER32(?), ref: 00B112D2
SetKeyboardState.USER32(?), ref: 00B11333
PostMessageW.USER32(?,00000101,00000010,?), ref: 00B11361
PostMessageW.USER32(?,00000101,00000011,?), ref: 00B11380
PostMessageW.USER32(?,00000101,00000012,?), ref: 00B113C6
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B113E9

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 397043c7dbbdddee9c27d579545c1c45c11f76ea3af66ae184272b119c6deee0
Instruction ID: 323730a2a25b7f40b68e207b23aaa4ac18cb0292b7f50a320e13d472d78fd057
Opcode Fuzzy Hash: 397043c7dbbdddee9c27d579545c1c45c11f76ea3af66ae184272b119c6deee0
Instruction Fuzzy Hash: A351E4A09087D23DFB36433C9C45BFA7EE99B06704F8849C9E2E5868C2C6D8ACC4D750

Function 00B11097 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B110D6
GetKeyboardState.USER32(?), ref: 00B110EB
SetKeyboardState.USER32(?), ref: 00B1114C
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B11178
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B11195
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B111D9
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B111FA

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 5d17d9e390712a1ed7dcf841fb66b4379534044ff342c487b4a1ef86557bd1d0
Instruction ID: 127ca15b3605f03d01693349893425e52a4acb971db68979a37b5e4a22c2f5ee
Opcode Fuzzy Hash: 5d17d9e390712a1ed7dcf841fb66b4379534044ff342c487b4a1ef86557bd1d0
Instruction Fuzzy Hash: 4351D5A0A047D63DFB3687288C45BFABEE9DB06300F484DC9E7D5968C2D694ACD8D750

Function 00B156A4 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00B156B1
_wcsncpy.LIBCMT ref: 00B156E6
_wcsncpy.LIBCMT ref: 00B15718
_wcsncpy.LIBCMT ref: 00B1574B
_wcsncpy.LIBCMT ref: 00B1578D
_wcsncpy.LIBCMT ref: 00B157C7
_wcsncpy.LIBCMT ref: 00B157F6

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6b07740dce975bbf8f34b52e0f1c3fd9bb87ab23cfc1fed907853a2e60939341
Instruction ID: 34ff5adb8c6f982bbd612a1f19e495e128ccb2c6e6bd9c3ca5bc62ae2114c544
Opcode Fuzzy Hash: 6b07740dce975bbf8f34b52e0f1c3fd9bb87ab23cfc1fed907853a2e60939341
Instruction Fuzzy Hash: 0341A5A6C20914BACB11EBB49C86ADFB7BCAF05310F508467F51AE3261E6349744C3E6

Function 00B136B5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B146AF: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B136DB,?), ref: 00B146CC

Part of subcall function 00B146AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B136DB,?), ref: 00B146E5

lstrcmpiW.KERNEL32(?,?), ref: 00B136FB
_wcscmp.LIBCMT ref: 00B13717
MoveFileW.KERNEL32(?,?), ref: 00B1372F
_wcscat.LIBCMT ref: 00B13777
SHFileOperationW.SHELL32(?), ref: 00B137E3

Strings

\*.*, xrefs: 00B13771

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 2daeadb5717e8184a7800af7539b2a13bb4a08f01cd15590071e6df6a7080a04
Instruction ID: 6dfcca600759e546990942308638a8e161cb1a28a9fb5644736dc2eddb73e958
Opcode Fuzzy Hash: 2daeadb5717e8184a7800af7539b2a13bb4a08f01cd15590071e6df6a7080a04
Instruction Fuzzy Hash: C4416FB2508345AAC751EF64D441ADFB7ECEF89780F50096EB48AC31A1EB34D788C756

Function 00B372C3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B372DC
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B37383
IsMenu.USER32(?), ref: 00B3739B
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B373E3
DrawMenuBar.USER32 ref: 00B373F6

Strings

0, xrefs: 00B372D0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: b78583b9cc94f2109868b6b64a89e689c2d6218d4f6cc28cdb9efd9d78a33ccf
Instruction ID: 5a0645db28e75899d680f2696719b10735319e687996df9c811463a9043237b6
Opcode Fuzzy Hash: b78583b9cc94f2109868b6b64a89e689c2d6218d4f6cc28cdb9efd9d78a33ccf
Instruction Fuzzy Hash: 1C4128B5A04209EFDB20DF50D884EAABBF8FB08354F248069ED5597360DB70AD55DF90

Function 00B3102D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00B3105C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B31086
FreeLibrary.KERNEL32(00000000), ref: 00B3113D

Part of subcall function 00B3102D: RegCloseKey.ADVAPI32(?), ref: 00B310A3
Part of subcall function 00B3102D: FreeLibrary.KERNEL32(?), ref: 00B310F5
Part of subcall function 00B3102D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00B31118

RegDeleteKeyW.ADVAPI32(?,?), ref: 00B310E0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 1622d0b856e5f3efe337a8fe5b440744dd66ab3953fd3fadceb2e7e0ad0ce999
Instruction ID: 721891a368dd168ee53bc2e7d5b18d0434856cad18a9bab0654a0a6b9fdf1be8
Opcode Fuzzy Hash: 1622d0b856e5f3efe337a8fe5b440744dd66ab3953fd3fadceb2e7e0ad0ce999
Instruction Fuzzy Hash: DB312BB5D01119BFDB19DF98DC89EFFB7BCEF08340F2005A9E501A2151EA749E859BA0

Function 00B362FF Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00B3631E
GetWindowLongW.USER32(00C95A08,000000F0), ref: 00B36351
GetWindowLongW.USER32(00C95A08,000000F0), ref: 00B36386
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00B363B8
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00B363E2
GetWindowLongW.USER32(00000000,000000F0), ref: 00B363F3
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00B3640D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 239f4218f32095547cc263b4a254d4728992111f77538cd57c73a14f63f6260b
Instruction ID: 46b55de07a51ca86cad8e2edc18b5ff18b76cedc06897ab7e17e5529d177a553
Opcode Fuzzy Hash: 239f4218f32095547cc263b4a254d4728992111f77538cd57c73a14f63f6260b
Instruction Fuzzy Hash: C331D431A44255AFDB21CF1CDC85F6937E1FB4A710F2981A4F5158F2B2CB72A880DB55

Function 00B26289 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B27EA0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00B27ECB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00B262DC
WSAGetLastError.WSOCK32(00000000), ref: 00B262EB
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00B26324
connect.WSOCK32(00000000,?,00000010), ref: 00B2632D
WSAGetLastError.WSOCK32 ref: 00B26337
closesocket.WSOCK32(00000000), ref: 00B26360
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00B26379

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 3b8bbe810e9b2e4754cf4067a4c3c5c728453bff3604ea4af9fcd0af95f0affb
Instruction ID: 2749dbe7418b556a41031535145e4da77867389780c6f6d1f95ea41bf0dd9088
Opcode Fuzzy Hash: 3b8bbe810e9b2e4754cf4067a4c3c5c728453bff3604ea4af9fcd0af95f0affb
Instruction Fuzzy Hash: B531A431600129EFDB10DF64DD85BBE7BEDEB45760F1440A9F90997291DB70AC048BA5

Function 00B0F98F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00B0F9A2
__wcsnicmp.LIBCMT ref: 00B0F9C3
__wcsnicmp.LIBCMT ref: 00B0F9DD

Strings

#requireadmin, xrefs: 00B0F9BD
#notrayicon, xrefs: 00B0F99A
#OnAutoItStartRegister, xrefs: 00B0F9D7

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 788440deb733e9ab21999d926374fd8aa1957b2454349dec2fa03c5768b4c34c
Instruction ID: 8bc0174cb668972704eaa430d110a2181d6abb0febf090b313e2bde7e8cd4189
Opcode Fuzzy Hash: 788440deb733e9ab21999d926374fd8aa1957b2454349dec2fa03c5768b4c34c
Instruction Fuzzy Hash: E9217C333081127AC630EB249D12FB777E8EF95310F504076F886875D2E7909E42D395

Function 00B375FF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AB1D73
Part of subcall function 00AB1D35: GetStockObject.GDI32(00000011), ref: 00AB1D87
Part of subcall function 00AB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B37664
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B37671
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B3767C
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B3768B
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B37697

Strings

Msctls_Progress32, xrefs: 00B37635

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 19b9baf6d6646d6cfb194b56b05eba55e105b5a51c152b429609cbce6af85726
Instruction ID: 4d15931634a424a30eb3c16ff4bb2790aa85564958263581c6efa1d8785e8770
Opcode Fuzzy Hash: 19b9baf6d6646d6cfb194b56b05eba55e105b5a51c152b429609cbce6af85726
Instruction Fuzzy Hash: 4211B6B2150219BFEF159F64CC86EE77FADEF08758F114115B604A6051CA71AC21DBA0

Function 00AD4109 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00AD41D2,?), ref: 00AD4123
GetProcAddress.KERNEL32(00000000), ref: 00AD412A
EncodePointer.KERNEL32(00000000), ref: 00AD4136
DecodePointer.KERNEL32(00000001,00AD41D2,?), ref: 00AD4153

Strings

RoInitialize, xrefs: 00AD4112
combase.dll, xrefs: 00AD411E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 29b0a7753e7e80c4cb60632f72c6f75d52e3f27244a0f7106be0e0dd84c34bbe
Instruction ID: e1413d232803f9d9d7199e0a44809a249afd88af6ac539c931779ca886d53122
Opcode Fuzzy Hash: 29b0a7753e7e80c4cb60632f72c6f75d52e3f27244a0f7106be0e0dd84c34bbe
Instruction Fuzzy Hash: 08E0E570AA0301ABEB105B70EC49B283AE4AB16B02FA08474B406E79B0CEB54284BE04

Function 00AD41DE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00AD40F8), ref: 00AD41F8
GetProcAddress.KERNEL32(00000000), ref: 00AD41FF
EncodePointer.KERNEL32(00000000), ref: 00AD420A
DecodePointer.KERNEL32(00AD40F8), ref: 00AD4225

Strings

RoUninitialize, xrefs: 00AD41E7
combase.dll, xrefs: 00AD41F3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 3280f3bf9ee92b12b7da80a046c551806fdb145c0d2711be1aafb6e5f33e59e8
Instruction ID: 8e23ba3b7b4b7ae9a58243ddd332851092707c1aef997fef6e8dd3068fe42bf3
Opcode Fuzzy Hash: 3280f3bf9ee92b12b7da80a046c551806fdb145c0d2711be1aafb6e5f33e59e8
Instruction Fuzzy Hash: E5E09270A81201AFEB109B61EC4DB593BE4BB08B43FA04035F115E35B0CFB64644AA15

Function 00B16561 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B166B4
_memmove.LIBCMT ref: 00B165EF

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

_memmove.LIBCMT ref: 00B16662
_memmove.LIBCMT ref: 00B16749
_memmove.LIBCMT ref: 00B16762
_memmove.LIBCMT ref: 00B1677E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 315611e33a001a930c176ee637cfb43f2d7621e662e44577b942eeaf6dd46d17
Instruction ID: e261b3f7a6e52a27469dd93043cb62be73156d6582486d828840f873762162d0
Opcode Fuzzy Hash: 315611e33a001a930c176ee637cfb43f2d7621e662e44577b942eeaf6dd46d17
Instruction Fuzzy Hash: D861AC3050065A9BCF11EF60CD82FFE7BA9EF48308F444599F95A5B2A2DB34AD45CB90

Function 00B3026F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00B30EA5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2FE38,?,?), ref: 00B30EBC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B30348
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B30388
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00B303AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B303D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B30417
RegCloseKey.ADVAPI32(00000000), ref: 00B30424

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: a7e1a190d4a8f5cd4662a2ca4edfb44a10d77f43d709ee7423f07b8577dac717
Instruction ID: 5aee33291e3f4ce99eec173ee1eb8a2e58e330df50df7410c6d15c178143fd1a
Opcode Fuzzy Hash: a7e1a190d4a8f5cd4662a2ca4edfb44a10d77f43d709ee7423f07b8577dac717
Instruction Fuzzy Hash: AC516731618200AFC714EF64C995EAFBBE9FF88314F14496DF585872A2DB31EA04CB52

Function 00B35802 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00B35864
GetMenuItemCount.USER32(00000000), ref: 00B3589B
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B358C3
GetMenuItemID.USER32(?,?), ref: 00B35932
GetSubMenu.USER32(?,?), ref: 00B35940
PostMessageW.USER32(?,00000111,?,00000000), ref: 00B35991

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: e0b2d512c41b385a72cb76140faf0787ffff30adfcad0549834aefd8997b6d71
Instruction ID: 1c6f6cd2329b31fbf2ff773bf9afae99ce293dec4369aced4cbc687d969ca799
Opcode Fuzzy Hash: e0b2d512c41b385a72cb76140faf0787ffff30adfcad0549834aefd8997b6d71
Instruction Fuzzy Hash: E5515B35A00615EFCF25DFA4C945AAEB7F5EF48720F2044A9E946BB351CB70AE41CB90

Function 00B0F1FE Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B0F218
VariantClear.OLEAUT32(00000013), ref: 00B0F28A
VariantClear.OLEAUT32(00000000), ref: 00B0F2E5
_memmove.LIBCMT ref: 00B0F30F
VariantClear.OLEAUT32(?), ref: 00B0F35C
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B0F38A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 46a529e996c23c52eacbdecf78d9668ead6faac3821d1d6cbd5d52b7a656b6c3
Instruction ID: 1989691cb02121a8de214be9360c1c9afd6b2aebdd455617c38362c48ed73a72
Opcode Fuzzy Hash: 46a529e996c23c52eacbdecf78d9668ead6faac3821d1d6cbd5d52b7a656b6c3
Instruction Fuzzy Hash: C8513CB5A0020ADFCB24CF58D884AAABBF8FF4C314B158569E959DB341D730E911CFA0

Function 00B12502 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B12550
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B1259B
IsMenu.USER32(00000000), ref: 00B125BB
CreatePopupMenu.USER32 ref: 00B125EF
GetMenuItemCount.USER32(000000FF), ref: 00B1264D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00B1267E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 1bb5c883daad070e058619d515d75c11c1e16e95e15e3b8f361a57f0248fde16
Instruction ID: b7cbaecc099f4ba5aabf7a8a93df4f011f2ecb48d330eb0aa1a3f3a2e6fe7a26
Opcode Fuzzy Hash: 1bb5c883daad070e058619d515d75c11c1e16e95e15e3b8f361a57f0248fde16
Instruction Fuzzy Hash: 2251CE30A0024ADFCF20CF68D888AEEBBF5EF14314F5441A9E811972D4EB709DA4CB11

Function 00AB1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00AB179A
GetWindowRect.USER32(?,?), ref: 00AB17FE
ScreenToClient.USER32(?,?), ref: 00AB181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00AB182C
EndPaint.USER32(?,?), ref: 00AB1876

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: d316319784efe4fd5e040aac200b70242164058ce70f1d84ef3e1c05efdf746d
Instruction ID: b984954f0ed0419531c3a426204809d92877e7509903b89e9e1ab13a18a9ec98
Opcode Fuzzy Hash: d316319784efe4fd5e040aac200b70242164058ce70f1d84ef3e1c05efdf746d
Instruction Fuzzy Hash: 3141AE30500601AFD720DF65DC94FBA7BF8FB45724F140669FAA98B1B2CB709845DB62

Function 00B3B6D2 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00B757B0,00000000,00C95A08,?,?,00B757B0,?,00B3B5DC,?,?), ref: 00B3B746
EnableWindow.USER32(00000000,00000000), ref: 00B3B76A
ShowWindow.USER32(00B757B0,00000000,00C95A08,?,?,00B757B0,?,00B3B5DC,?,?), ref: 00B3B7CA
ShowWindow.USER32(00000000,00000004,?,00B3B5DC,?,?), ref: 00B3B7DC
EnableWindow.USER32(00000000,00000001), ref: 00B3B800
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00B3B823

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 7ab838e186ef696973b55ee1d75c2819dd9e089b3ea1c7874aab04dbac928633
Instruction ID: 2b9af5f4fb2283a7e8d53c8a2a0003454dc624d968e8a701a52d19f5bc52f808
Opcode Fuzzy Hash: 7ab838e186ef696973b55ee1d75c2819dd9e089b3ea1c7874aab04dbac928633
Instruction Fuzzy Hash: A3412C34A00145EFDB26CF24C48AFA47BE5FB45315F2841F9EA498F2A6CB31AC45CB91

Function 00B271B3 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00B24F57,?,?,00000000,00000001), ref: 00B271C1

Part of subcall function 00B23AB6: GetWindowRect.USER32(?,?), ref: 00B23AC9

GetDesktopWindow.USER32 ref: 00B271EB
GetWindowRect.USER32(00000000), ref: 00B271F2
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00B27224

Part of subcall function 00B152EB: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B15363

GetCursorPos.USER32(?), ref: 00B27250
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B272AE

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: f12767c655d0d21ca332359c1247fbd580da0f10307fd4725c8ea9f719569989
Instruction ID: 9d1cab569b7bb85e2451a84f0e8a628f0f95c9bb2c93fe69d5a20bf0f4ff2664
Opcode Fuzzy Hash: f12767c655d0d21ca332359c1247fbd580da0f10307fd4725c8ea9f719569989
Instruction Fuzzy Hash: E431F232508316ABC720DF14D849F9FB7E9FF89304F100929F488A7191CB30E908CB92

Function 00B08B3B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B083D1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B083E8
Part of subcall function 00B083D1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B083F2
Part of subcall function 00B083D1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B08401
Part of subcall function 00B083D1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B08408
Part of subcall function 00B083D1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B0841E

GetLengthSid.ADVAPI32(?,00000000,00B08757), ref: 00B08B8C
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B08B98
HeapAlloc.KERNEL32(00000000), ref: 00B08B9F
CopySid.ADVAPI32(00000000,00000000,?), ref: 00B08BB8
GetProcessHeap.KERNEL32(00000000,00000000,00B08757), ref: 00B08BCC
HeapFree.KERNEL32(00000000), ref: 00B08BD3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: c53a3113f98edf715c54e843ffdde52c4798a4a72388ca09c6920a988d0f6a8c
Instruction ID: bed5b4d5b0944b2465fcb6934b1192302044034b327ae5f1a454e0c1557646c3
Opcode Fuzzy Hash: c53a3113f98edf715c54e843ffdde52c4798a4a72388ca09c6920a988d0f6a8c
Instruction Fuzzy Hash: 9C11B1B5900605FFDB149F64DC09FBE7BA9EB45355F2040A8E885A7190DB329A04DB60

Function 00B088D9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B0890A
OpenProcessToken.ADVAPI32(00000000), ref: 00B08911
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B08920
CloseHandle.KERNEL32(00000004), ref: 00B0892B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B0895A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00B0896E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5d1df041e485af45a3e13a982724b7cf6203328bb736e5afce74e885efce3f44
Instruction ID: dc98a4445c8956aa54fcce3c8a095553ba9be5992f925d028c1fe1780d2f87e3
Opcode Fuzzy Hash: 5d1df041e485af45a3e13a982724b7cf6203328bb736e5afce74e885efce3f44
Instruction Fuzzy Hash: 66115C7250020EEBDF018FA8DD49BEE7BE9FF08308F144065FE44A21A0CB718E609B61

Function 00B0BA52 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B0BA77
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B0BA88
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B0BA8F
ReleaseDC.USER32(00000000,00000000), ref: 00B0BA97
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B0BAAE
MulDiv.KERNEL32(000009EC,?,?), ref: 00B0BAC0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 039cb217c1f4003513e518a39c8499f8219b4e12178797d2cfa0c797bdabc2bc
Instruction ID: af9d75ff1294e90efe978aa4534a0b3703e0194eecd869856177474653479ffa
Opcode Fuzzy Hash: 039cb217c1f4003513e518a39c8499f8219b4e12178797d2cfa0c797bdabc2bc
Instruction Fuzzy Hash: 63014475E40319BBEB109BA59D46E5EBFB8EB48751F1040A5FA04A7391DA709D10CF90

Function 00AD02E2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AD0313
MapVirtualKeyW.USER32(00000010,00000000), ref: 00AD031B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AD0326
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AD0331
MapVirtualKeyW.USER32(00000011,00000000), ref: 00AD0339
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AD0341

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: f260602a0655bdafd55ec74e78fb8cf93afc60650e15b2185f2014e78f696762
Instruction ID: be386ff6b070f692ff649095ef26535213fda1bd3c3491f0d6655f8e57064cb0
Opcode Fuzzy Hash: f260602a0655bdafd55ec74e78fb8cf93afc60650e15b2185f2014e78f696762
Instruction Fuzzy Hash: 870148B090175A7DE3008F5A8C85A56FEA8FF19354F00411BA15847941C7B5A864CBE5

Function 00B15490 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B154A0
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B154B6
GetWindowThreadProcessId.USER32(?,?), ref: 00B154C5
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B154D4
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B154DE
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B154E5

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 56958882e1bbe52b56b8294946f3bdb178773fb204e2d83bf427dc0517905f18
Instruction ID: bae9fc5d676354b51bcb20c18c01cac7f4f360c743221dd0aaa824bf3e41f3dd
Opcode Fuzzy Hash: 56958882e1bbe52b56b8294946f3bdb178773fb204e2d83bf427dc0517905f18
Instruction Fuzzy Hash: DFF06231540519BBD7215B929C0EEFF7A7CEBC6B11F100169F904D20609BA01A01C6B5

Function 00B172D9 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00B172EC
EnterCriticalSection.KERNEL32(?,?,00AC1044,?,?), ref: 00B172FD
TerminateThread.KERNEL32(00000000,000001F6,?,00AC1044,?,?), ref: 00B1730A
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00AC1044,?,?), ref: 00B17317

Part of subcall function 00B16CDE: CloseHandle.KERNEL32(00000000,?,00B17324,?,00AC1044,?,?), ref: 00B16CE8

InterlockedExchange.KERNEL32(?,000001F6), ref: 00B1732A
LeaveCriticalSection.KERNEL32(?,?,00AC1044,?,?), ref: 00B17331

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 353bfb792aca92eadc48b68b99dd3fa65ee0f0872e23f69df359ce466ec46246
Instruction ID: 4732b3ebf8cbc51921cc9a5139d8b426ed12283cf5f34f03bbd096eebd0df936
Opcode Fuzzy Hash: 353bfb792aca92eadc48b68b99dd3fa65ee0f0872e23f69df359ce466ec46246
Instruction Fuzzy Hash: B3F0303A980613EBDB111B64ED489EF7779EF45302B600571F502920A1CF755955CE90

Function 00B08C54 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B08C5F
UnloadUserProfile.USERENV(?,?), ref: 00B08C6B
CloseHandle.KERNEL32(?), ref: 00B08C74
CloseHandle.KERNEL32(?), ref: 00B08C7C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B08C85
HeapFree.KERNEL32(00000000), ref: 00B08C8C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: e55c435d6fce5e10c21be17de31b2a8f507d8258478397541727919e466ce434
Instruction ID: d6f86e8e1a8f83234e612d13f4d39545f33f268f41bcb6a62cfdcbb30d74ac19
Opcode Fuzzy Hash: e55c435d6fce5e10c21be17de31b2a8f507d8258478397541727919e466ce434
Instruction Fuzzy Hash: FAE0C236404402FBDB011FE2EC0CD2ABB69FB89322B208230F22992070CF329424DB50

Function 00B28702 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B28728
CharUpperBuffW.USER32(?,?), ref: 00B28837
VariantClear.OLEAUT32(?), ref: 00B289AF

Part of subcall function 00B1760B: VariantInit.OLEAUT32(00000000), ref: 00B1764B
Part of subcall function 00B1760B: VariantCopy.OLEAUT32(00000000,?), ref: 00B17654
Part of subcall function 00B1760B: VariantClear.OLEAUT32(00000000), ref: 00B17660

Strings

Incorrect Parameter format, xrefs: 00B28760, 00B28922
AUTOIT.ERROR, xrefs: 00B2883D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 2563aa7d9b4a8b0fa32ff952b30695184492259973a6394eddbf2f3b0bad5d1b
Instruction ID: 72b23992674c93d63048b9399b8a7188434a02fa2fdce5cb47e34fc56b75a5e4
Opcode Fuzzy Hash: 2563aa7d9b4a8b0fa32ff952b30695184492259973a6394eddbf2f3b0bad5d1b
Instruction Fuzzy Hash: 73918D756083019FC710DF24D58496BBBE8EF88350F1489ADF89A8B362DB31ED45CB52

Function 00B12D8E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ACFE06: _wcscpy.LIBCMT ref: 00ACFE29

_memset.LIBCMT ref: 00B12E7F
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B12EAE
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B12F61
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B12F8F

Strings

0, xrefs: 00B12E6B

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 8b77412c753dc6c29da8325ee3157663a28496e2cacccabe7e5532eeb1a2d046
Instruction ID: 08a49b82b5dda9056c538ec7f3cd9c7af978e5e3a90abfbb485cffcc29167085
Opcode Fuzzy Hash: 8b77412c753dc6c29da8325ee3157663a28496e2cacccabe7e5532eeb1a2d046
Instruction Fuzzy Hash: BB51C0315083019FD7249F28D841BABB7F8EB99310F544AAEF895D32A1DB60CDA58792

Function 00B0D87B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B0D8E3
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B0D919
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B0D92A
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B0D9AC

Strings

DllGetClassObject, xrefs: 00B0D91F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 1906f75f640dd63de4a724d8ddcf994a940ef4820b669200ef3aecab7c92dbcb
Instruction ID: b766fe80f84fa78e2b7ac8632277932961436f0e002013328e2f4af04ac6f24d
Opcode Fuzzy Hash: 1906f75f640dd63de4a724d8ddcf994a940ef4820b669200ef3aecab7c92dbcb
Instruction Fuzzy Hash: 2F418B72600204EFDB05CF94D8C4AAABFE9EF45314B1181E9E9059F286DBB1DE40DBA0

Function 00B12A4B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B12AB8
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B12AD4
DeleteMenu.USER32(?,00000007,00000000), ref: 00B12B1A
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B75890,00000000), ref: 00B12B63

Strings

0, xrefs: 00B12AAD

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: f810943b61cf079e1bf71df31a5951cfc3733733ed8d45e2db47b23360a1e1aa
Instruction ID: 5f30bfb06f3098754748b1114c90569267aaa6520de32cc7ca2972fcf30d514b
Opcode Fuzzy Hash: f810943b61cf079e1bf71df31a5951cfc3733733ed8d45e2db47b23360a1e1aa
Instruction Fuzzy Hash: 0E41C3302083029FD720DF24D885BABBBE8EF85320F50469DF566972D1D770E954CB52

Function 00B2D8B9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00B2D8D9

Part of subcall function 00AB79AB: _memmove.LIBCMT ref: 00AB79F9

Strings

cdecl, xrefs: 00B2D930
winapi, xrefs: 00B2D94A
stdcall, xrefs: 00B2D95B
none, xrefs: 00B2D9B4

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 8efdd2b6b740c47dd370e7cb88d086f36c5a5a8c52946ef25bc70c5d005d3490
Instruction ID: ba477025ad986478ab9e2c1749ec87f8057c37270e17d53daae109e5cbf54474
Opcode Fuzzy Hash: 8efdd2b6b740c47dd370e7cb88d086f36c5a5a8c52946ef25bc70c5d005d3490
Instruction Fuzzy Hash: AE31B271504615AFCF10EF64C9909EEB3F8FF05310B1086AAF86AA73D1CB71A945CB80

Function 00B09152 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00B0AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AEC7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B091D6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B091E9
SendMessageW.USER32(?,00000189,?,00000000), ref: 00B09219

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

Strings

ComboBox, xrefs: 00B09160
ListBox, xrefs: 00B09195

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 0132176739d9691bd923ae07c16febd61226d2d4865178198c7a0db83c1af1ee
Instruction ID: 50077d2aecd1cf90dd22e4dc4b4a1b910d17434dfca260d6361fdb7c3e1af361
Opcode Fuzzy Hash: 0132176739d9691bd923ae07c16febd61226d2d4865178198c7a0db83c1af1ee
Instruction Fuzzy Hash: E721F371A00104BADB14AB75CC8ADFEBBBDDF45360F2041A9F825A72E2DB795D0AD610

Function 00B21943 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B21962
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B21988
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B219B8
InternetCloseHandle.WININET(00000000), ref: 00B219FF

Part of subcall function 00B22599: GetLastError.KERNEL32(?,?,00B2192D,00000000,00000000,00000001), ref: 00B225AE
Part of subcall function 00B22599: SetEvent.KERNEL32(?,?,00B2192D,00000000,00000000,00000001), ref: 00B225C3

Strings

, xrefs: 00B219A9

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 94183cbaef9f74f76eaa1ed557c92f6232d72432f466e491f235d3e53ca66fb5
Instruction ID: 20862d352243a5f25b610538e444ff25f71eb2a9786d35ec94c9481695f6d322
Opcode Fuzzy Hash: 94183cbaef9f74f76eaa1ed557c92f6232d72432f466e491f235d3e53ca66fb5
Instruction Fuzzy Hash: B421FFB2500218BFEB21DF68EC95EBF77ECEB58744F10456AF409D3200EB249E4697A1

Function 00B36419 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AB1D73
Part of subcall function 00AB1D35: GetStockObject.GDI32(00000011), ref: 00AB1D87
Part of subcall function 00AB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B36493
LoadLibraryW.KERNEL32(?), ref: 00B3649A
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B364AF
DestroyWindow.USER32(?), ref: 00B364B7

Strings

SysAnimate32, xrefs: 00B3646E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3627582f9856f0a4ab78e64cbc19ee86b893c93f63c658754244271cc6ff274a
Instruction ID: 2ad040bc831cd55fd5dd4c8aa3d56fd3acaa82de00426cba0555b250326f27b3
Opcode Fuzzy Hash: 3627582f9856f0a4ab78e64cbc19ee86b893c93f63c658754244271cc6ff274a
Instruction Fuzzy Hash: E5218B71A00205BBEF104E64DC91EBA37EDEF49364F30C669FA54932A0DB71DC519760

Function 00B16E45 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00B16E65
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B16E98
GetStdHandle.KERNEL32(0000000C), ref: 00B16EAA
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00B16EE4

Strings

nul, xrefs: 00B16EDF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 222c379cfbb7b0fa6e8dcc5608d7658b57cb69f3327c490034b3ff44b1f26da3
Instruction ID: 9d82d0ad9742b7c63ab3bab68b12539f9c92a5333f187446398e82e0681ccfa3
Opcode Fuzzy Hash: 222c379cfbb7b0fa6e8dcc5608d7658b57cb69f3327c490034b3ff44b1f26da3
Instruction Fuzzy Hash: 54217779500206ABDF209F69DC45AEA77F4EF44720F6047A9FCA1D72D0DB709890CB90

Function 00B16F13 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00B16F32
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B16F64
GetStdHandle.KERNEL32(000000F6), ref: 00B16F75
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00B16FAF

Strings

nul, xrefs: 00B16FAA

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: ed4e7a3e748eacefe6955fc24e5f794f6fd080209c9957d57994219d48b7b511
Instruction ID: 7c8020c975452605c263bc2d4aec17a930decfc6faf3ad12c0f6025e642839f1
Opcode Fuzzy Hash: ed4e7a3e748eacefe6955fc24e5f794f6fd080209c9957d57994219d48b7b511
Instruction Fuzzy Hash: 26218675A04305EBDB209F69AC44AEA77E8EF45720F704699FCA1D72D0DB709892CB50

Function 00B1ACCA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B1ACDE
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B1AD32
__swprintf.LIBCMT ref: 00B1AD4B
SetErrorMode.KERNEL32(00000000,00000001,00000000,00B3F910), ref: 00B1AD89

Strings

%lu, xrefs: 00B1AD45

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 06ffb5ee1efed6a41b233049ea771147c50c380ccd160c3a23fb4254b5e32942
Instruction ID: 387114b19de86e22f8b3568c7beb6be557dbd98c98fc8ca0d121e21419b00c36
Opcode Fuzzy Hash: 06ffb5ee1efed6a41b233049ea771147c50c380ccd160c3a23fb4254b5e32942
Instruction Fuzzy Hash: 72214435A00109AFCB10DF65D985EEE77F8EF49704B1040A9F505EB262DB31EA41DB61

Function 00B0A30F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

Part of subcall function 00B0A15C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00B0A179
Part of subcall function 00B0A15C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B0A18C
Part of subcall function 00B0A15C: GetCurrentThreadId.KERNEL32 ref: 00B0A193
Part of subcall function 00B0A15C: AttachThreadInput.USER32(00000000), ref: 00B0A19A

GetFocus.USER32 ref: 00B0A334

Part of subcall function 00B0A1A5: GetParent.USER32(?), ref: 00B0A1B3

GetClassNameW.USER32(?,?,00000100), ref: 00B0A37D
EnumChildWindows.USER32(?,00B0A3F5), ref: 00B0A3A5
__swprintf.LIBCMT ref: 00B0A3BF

Strings

%s%d, xrefs: 00B0A3B9

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 065f52fadc3c0415ce3db826234848b1821a384ccc3f8c51e8182d9191d948a9
Instruction ID: 15f1ccb5ca1edd36d985267e67c7b0a2b627577f59d8fabd952d35aa7e84ed84
Opcode Fuzzy Hash: 065f52fadc3c0415ce3db826234848b1821a384ccc3f8c51e8182d9191d948a9
Instruction Fuzzy Hash: 8F116A71600309ABDF11BFA0DD86FEE3BADAF49700F1044B5BA09AA1D2CA7059459B76

Function 00B2EC69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B2ED1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B2ED4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00B2EE7E
CloseHandle.KERNEL32(?), ref: 00B2EEFF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: ab0e393463f89b4935b8d3c340570a4dd8ec3c4a63cd1b2a6714f915d6ee1bfd
Instruction ID: d55666056857c2c0fc072d3d6c37de2ed6833d35ebe4966b818a3706fcf60a22
Opcode Fuzzy Hash: ab0e393463f89b4935b8d3c340570a4dd8ec3c4a63cd1b2a6714f915d6ee1bfd
Instruction Fuzzy Hash: 1C8181716003119FD720EF29D986F6AB7E9EF48710F14885DFA99DB292DA70EC01CB51

Function 00B300C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00B30EA5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2FE38,?,?), ref: 00B30EBC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B30188
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B301C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B3020E
RegCloseKey.ADVAPI32(?,?), ref: 00B3023A
RegCloseKey.ADVAPI32(00000000), ref: 00B30247

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: d34e5497aa3ec579ea5b3ce11c8beebcd48a318e65bb322662c70e6b259cbf6d
Instruction ID: d5a969545a1309e322b40c7d3577e4bf5dbce764fb3f07282328ca3364ed934a
Opcode Fuzzy Hash: d34e5497aa3ec579ea5b3ce11c8beebcd48a318e65bb322662c70e6b259cbf6d
Instruction Fuzzy Hash: 4B513931218205AFD704EF68CD95FAFB7E8EF88704F14896DB595972A2DB30E904CB52

Function 00B2D9DC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B2DA3B
GetProcAddress.KERNEL32(00000000,?), ref: 00B2DABE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00B2DADA
GetProcAddress.KERNEL32(00000000,?), ref: 00B2DB1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B2DB35

Part of subcall function 00AB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B1793F,?,?,00000000), ref: 00AB5B8C
Part of subcall function 00AB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B1793F,?,?,00000000,?,?), ref: 00AB5BB0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 60730062fd82f0eee5b371a75a8223f54c4d4f98e492754ec277057a40604ca7
Instruction ID: cb206065395acdd8bdc4d97106fbc8e1a943ba0aaf77bb5074f7bc3a4e5d2bdb
Opcode Fuzzy Hash: 60730062fd82f0eee5b371a75a8223f54c4d4f98e492754ec277057a40604ca7
Instruction Fuzzy Hash: 9D513B35A00615DFCB00EFA8D594DADB7F8FF49310B1580A9E919AB362DB30ED45CB91

Function 00B1E5FD Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B1E6AB
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00B1E6D4
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B1E713

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B1E738
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B1E740

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 00ab76c322abc23d8792d68516e67cde7543ca6ceddc071874ba7b02f7b3f1b4
Instruction ID: 56c0261516e6719d744d535e9e805d815a38cd0cd7f0648ff067366a2d2f6b1a
Opcode Fuzzy Hash: 00ab76c322abc23d8792d68516e67cde7543ca6ceddc071874ba7b02f7b3f1b4
Instruction Fuzzy Hash: A0512F35A00605DFCF05EF64CA81AAEBBF9EF0D314B148099E959AB362CB31ED51DB50

Function 00B3A088 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9740c603e5802e2598d18204d37b2ee5b195b2bdcfc3c1bf3dc5dcc689084a
Instruction ID: a201202e8f9312d3e4d3366a9f5d838b983724af0dddf44630e937a89a23c417
Opcode Fuzzy Hash: 5d9740c603e5802e2598d18204d37b2ee5b195b2bdcfc3c1bf3dc5dcc689084a
Instruction Fuzzy Hash: 8F41D735D00904AFD724DF28CC45FA9BBE9EB0A360F3502A5F895B72E1CB70AD41DA51

Function 00AB2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00AB2357
ScreenToClient.USER32(00B757B0,?), ref: 00AB2374
GetAsyncKeyState.USER32(00000001), ref: 00AB2399
GetAsyncKeyState.USER32(00000002), ref: 00AB23A7

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 8f524da34554d7a05469b8910edd2a6fe73c94895175f021127a401f932788c3
Instruction ID: 4e9a32f1528cff7dbdd6cc4d4107451cdf211e6285bd55384f4ec57f8d660435
Opcode Fuzzy Hash: 8f524da34554d7a05469b8910edd2a6fe73c94895175f021127a401f932788c3
Instruction Fuzzy Hash: BC419235904105FBDF159F69C844BEDBBB4FB05360F20436AF828962A2C734A995DF90

Function 00B06700 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B0673D
TranslateAcceleratorW.USER32(?,?,?), ref: 00B06789
TranslateMessage.USER32(?), ref: 00B067B2
DispatchMessageW.USER32(?), ref: 00B067BC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B067CB

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: d5bc06473805831fd7724a5ffb89ed5dc95a71fc57bec1d277357f23b0ff7359
Instruction ID: 8fa1ce30b9b9ffee3b3bd29a58f2d1e5047f477c26b25adf4b3afa91662258b0
Opcode Fuzzy Hash: d5bc06473805831fd7724a5ffb89ed5dc95a71fc57bec1d277357f23b0ff7359
Instruction Fuzzy Hash: 7631B271900606AFDB248F748C84FB67FECEB01308F1441A9E825D70E1EB65ECA5D7A0

Function 00B08CE1 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B08CF2
PostMessageW.USER32(?,00000201,00000001), ref: 00B08D9C
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00B08DA4
PostMessageW.USER32(?,00000202,00000000), ref: 00B08DB2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00B08DBA

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 597b28c1c019a666151a4665ab1ddfc0c61240783f71103e245554d3df138a23
Instruction ID: ea5fdde80e0b13b69e642a75f8224d8ff3c069896ab1328ec0b84fae3072b676
Opcode Fuzzy Hash: 597b28c1c019a666151a4665ab1ddfc0c61240783f71103e245554d3df138a23
Instruction Fuzzy Hash: E231C07190021AEBDF14CF68D94DAAE3FB5EB14315F104369F965EB1D0CBB09A14DB90

Function 00B0B4AE Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B0B4C6
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B0B4E3
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B0B51B
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B0B541
_wcsstr.LIBCMT ref: 00B0B54B

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 97f056c9f0aeefaf7e81b0a95ac84296abfc1fdd19d9728524276e645eff4d73
Instruction ID: 274db7a3c5efc76ee419164f80bfb744b37b0fcd5054fb29d4603954f1060fe9
Opcode Fuzzy Hash: 97f056c9f0aeefaf7e81b0a95ac84296abfc1fdd19d9728524276e645eff4d73
Instruction Fuzzy Hash: 0E210A32604101BAEB255B399C45E7F7FD8DF59750F1080AAF805DB2A1EF61DD00D3A0

Function 00B3B17F Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

GetWindowLongW.USER32(?,000000F0), ref: 00B3B1C6
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00B3B1EB
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B3B203
GetSystemMetrics.USER32(00000004), ref: 00B3B22C
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00B20FA5,00000000), ref: 00B3B24A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 0ae793922135c3d4a742c94e5a54c3b4363c04d0497ce80b649189e0289be12f
Instruction ID: 1fa7b0c4f32e5ba2954c275379f59b3412e7e130227421ec8516b1153a109f2d
Opcode Fuzzy Hash: 0ae793922135c3d4a742c94e5a54c3b4363c04d0497ce80b649189e0289be12f
Instruction Fuzzy Hash: 41216271914616AFCB209F398C44F6E7BE4EB05721F214779BA36D71E4DB309850DB90

Function 00B095C9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B095E2

Part of subcall function 00AB7D2C: _memmove.LIBCMT ref: 00AB7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B09614
__itow.LIBCMT ref: 00B0962C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B09654
__itow.LIBCMT ref: 00B09665

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: e78a8a3377d81e016efbc4f3f8f8f01cb797d532ee5961cac8c1c629a18720a7
Instruction ID: a56a5a80c3ed1675f888ac8d96ac9c5db1d132fb30904a5fbcbc5515470e1c2e
Opcode Fuzzy Hash: e78a8a3377d81e016efbc4f3f8f8f01cb797d532ee5961cac8c1c629a18720a7
Instruction Fuzzy Hash: 0221A131A00218BBDB10AA648D8AEEE7FEDDB59710F140065F90597292DA719D418791

Function 00B25B63 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B25B84
GetForegroundWindow.USER32 ref: 00B25B9B
GetDC.USER32(00000000), ref: 00B25BD7
GetPixel.GDI32(00000000,?,00000003), ref: 00B25BE3
ReleaseDC.USER32(00000000,00000003), ref: 00B25C1E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 0d4e394611d8e594dc7cc1f931ba507ed81b6375198cc6676fe63f4f273df124
Instruction ID: 16ee38d2a241d0033b0ff5b168d6e7a1f9d8e29f248ab60facdc5a3e390f9c64
Opcode Fuzzy Hash: 0d4e394611d8e594dc7cc1f931ba507ed81b6375198cc6676fe63f4f273df124
Instruction Fuzzy Hash: DA219F35A00514AFD710EF64DD89AAEBBE9FF48310F1484B9F84AD7262CA30AC00CB50

Function 00AB12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AB134D
SelectObject.GDI32(?,00000000), ref: 00AB135C
BeginPath.GDI32(?), ref: 00AB1373
SelectObject.GDI32(?,00000000), ref: 00AB139C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b3671ccd77004de06a0c0bdb9812aeb43d9a8e33f4dfe853135d5d5e6375a891
Instruction ID: cb6d8fad6b36ebf2dd21587a7ccd5dffd30bd1378cc217bcb747c49d0178b1c5
Opcode Fuzzy Hash: b3671ccd77004de06a0c0bdb9812aeb43d9a8e33f4dfe853135d5d5e6375a891
Instruction Fuzzy Hash: C9215130C10609EBDB208F59DD447AD7BECEB00311F684226F4159B5B2EBB19991DF51

Function 00B14B3A Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B14B61
__beginthreadex.LIBCMT ref: 00B14B7F
MessageBoxW.USER32(?,?,?,?), ref: 00B14B94
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B14BAA
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B14BB1

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 764ff823f9e78f9ea0ec897bcfb69ab4e6ebce8d24f916fa46899e7ff7a473d3
Instruction ID: ed5037082bcf662d30ffdd714dd1b8355190fc8134a47c3c95352aede0839872
Opcode Fuzzy Hash: 764ff823f9e78f9ea0ec897bcfb69ab4e6ebce8d24f916fa46899e7ff7a473d3
Instruction Fuzzy Hash: 4A110872908605BBC7109BA8DC44AEF7FFCEB49320F2442A9F818D3251DBB1CD8487A0

Function 00B0852A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B08546
GetLastError.KERNEL32(?,00B0800A,?,?,?), ref: 00B08550
GetProcessHeap.KERNEL32(00000008,?,?,00B0800A,?,?,?), ref: 00B0855F
HeapAlloc.KERNEL32(00000000,?,00B0800A,?,?,?), ref: 00B08566
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B0857D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 9172af82c5a9fdff3f45cc3af44f403553663bf732097ab615d83a5b9d77ff82
Instruction ID: b4c90b9867a7991c260aff1372653e1dbeff3f1d8c9049fbaecfe35bb05fa104
Opcode Fuzzy Hash: 9172af82c5a9fdff3f45cc3af44f403553663bf732097ab615d83a5b9d77ff82
Instruction Fuzzy Hash: 9E014B75A00215EFDB214FA6EC48D6B7FACEF99355724056AF949D3260DE328D00CA60

Function 00B152EB Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B15307
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00B15315
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B1531D
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00B15327
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B15363

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 435ab2e7937454fc6c62dee5bb95b9d5690a45bd6a34410662d2f02d2d63019c
Instruction ID: c14bb1a950219d766a3d4d831c0c25b25064e13ba610c0687b46d05105df2954
Opcode Fuzzy Hash: 435ab2e7937454fc6c62dee5bb95b9d5690a45bd6a34410662d2f02d2d63019c
Instruction Fuzzy Hash: 8B015B31C01A1EDBCF109FA4FC885EDBBB8FB48741F55049AE952B3140CF70569487A5

Function 00B07432 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?,?,?,00B0777D), ref: 00B0744F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?,?), ref: 00B0746A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?,?), ref: 00B07478
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?), ref: 00B07488
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B0736C,80070057,?,?), ref: 00B07494

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 298380431895c0c80aef0b2c3edc9162bbc645ace47d5e4129ff13bc5df6ebab
Instruction ID: ecb826fa3311cea16cf719703421af65e44b01203215110912f292239395dc7b
Opcode Fuzzy Hash: 298380431895c0c80aef0b2c3edc9162bbc645ace47d5e4129ff13bc5df6ebab
Instruction Fuzzy Hash: 24015A76A01209BBDB105F64DC84AAEBFEDEB44762F244065F908D3260EF31ED409AA0

Function 00B083D1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B083E8
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B083F2
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B08401
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B08408
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B0841E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: aca77db3be5de7c124a147e8c5f01ba0f0fce7f6ffc137b902c51ef0e0dff597
Instruction ID: d22b3d2071dd3627289cc3ffdce57e6a16e8c360c2d10e4856f9b7f6503bf80d
Opcode Fuzzy Hash: aca77db3be5de7c124a147e8c5f01ba0f0fce7f6ffc137b902c51ef0e0dff597
Instruction Fuzzy Hash: D0F0AF34604206BFEB101FA4EC88E7F3FACEF89764B500025F985C72A0CE609C45DA60

Function 00B08432 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B08449
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B08453
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B08462
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B08469
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B0847F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: f8271a87e0452cf3bfea73f48e6c043d48a0cb3102db16ec809be6893a8f0824
Instruction ID: 24f6b7e2fb4027f7cd9e60d80169cb02452f431b65f4b2056c6ec1f48f082d5f
Opcode Fuzzy Hash: f8271a87e0452cf3bfea73f48e6c043d48a0cb3102db16ec809be6893a8f0824
Instruction Fuzzy Hash: 50F08C34600206AFEB111FA4ECC8E7F3FACEF49654B140025F985832A0CE609904DA60

Function 00B0C4A5 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00B0C4B9
GetWindowTextW.USER32(00000000,?,00000100), ref: 00B0C4D0
MessageBeep.USER32(00000000), ref: 00B0C4E8
KillTimer.USER32(?,0000040A), ref: 00B0C504
EndDialog.USER32(?,00000001), ref: 00B0C51E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: ab363f459016113b8d2e91f0ecb98aecbfd1a7de3a022c95af56393decf761cc
Instruction ID: 3d1282e33e0d3fef60adaeaf28b27c6a507122753be7f30a2a0e58fc94f7de29
Opcode Fuzzy Hash: ab363f459016113b8d2e91f0ecb98aecbfd1a7de3a022c95af56393decf761cc
Instruction Fuzzy Hash: 93016D30900705ABEB205F20DD8FBAA7FF8FF10705F1006A9E582A21E1DBF4A954CA80

Function 00AB13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00AB13BF
StrokeAndFillPath.GDI32(?,?,00AEBA08,00000000,?), ref: 00AB13DB
SelectObject.GDI32(?,00000000), ref: 00AB13EE
DeleteObject.GDI32 ref: 00AB1401
StrokePath.GDI32(?), ref: 00AB141C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: dd5823382173a9ee61e751557e7d5b7fe6e95cca6eb422e325c6a9bfd852bb20
Instruction ID: 302da277d303949a66f722359c1d966617a84cb980ae570a26a5def04d1362b2
Opcode Fuzzy Hash: dd5823382173a9ee61e751557e7d5b7fe6e95cca6eb422e325c6a9bfd852bb20
Instruction Fuzzy Hash: 01F0CD31404A09DBDB255F5AED4C7A83FA9E701326F588225E42A4A0F2CB7145A5DF51

Function 00B1C423 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B1C4BE
CoCreateInstance.OLE32(00B42D6C,00000000,00000001,00B42BDC,?), ref: 00B1C4D6

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

CoUninitialize.OLE32 ref: 00B1C743

Strings

.lnk, xrefs: 00B1C452, 00B1C47A, 00B1C484

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: bbc7e1a570d9241aad63137bdae5447f7ab9089204aab72e3b8918befba7240c
Instruction ID: 1da618c9d77b5cfe11722e7315e387e98883baf382186a84bdc48a82c8289dc0
Opcode Fuzzy Hash: bbc7e1a570d9241aad63137bdae5447f7ab9089204aab72e3b8918befba7240c
Instruction Fuzzy Hash: 20A12B71108205AFD700EF64C991EAFB7ECEF85744F00495CF2569B2A2DB71EA49CB52

Function 00AC2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00AD0F36: std::exception::exception.LIBCMT ref: 00AD0F6C
Part of subcall function 00AD0F36: __CxxThrowException@8.LIBCMT ref: 00AD0F81

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00AB7BB1: _memmove.LIBCMT ref: 00AB7C0B

__swprintf.LIBCMT ref: 00AC302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00AC2EC6

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 09aeee9c82b701a0f30763ac54cfa532c0beac54458aca770705d29fa096a67c
Instruction ID: ceae94b97e043b7f46aeb28e08f01c239743b1790b1b608989a0643c6e0ef4cc
Opcode Fuzzy Hash: 09aeee9c82b701a0f30763ac54cfa532c0beac54458aca770705d29fa096a67c
Instruction Fuzzy Hash: 96916E725082059FCB18EF24D995DAFB7B8EF85710F01491DF5829B2A2DA70EE44CB92

Function 00B1B9C7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB48A1,?,?,00AB37C0,?), ref: 00AB48CE

CoInitialize.OLE32(00000000), ref: 00B1BA47
CoCreateInstance.OLE32(00B42D6C,00000000,00000001,00B42BDC,?), ref: 00B1BA60
CoUninitialize.OLE32 ref: 00B1BA7D

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

Strings

.lnk, xrefs: 00B1BA29, 00B1BA37

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: e0d51a86d34d55a70252fae78856aca644acaf8b0281d14b8b82cd5d61169e24
Instruction ID: 1846de7d58a5837bdb8c7e92b22d4a939230281b3882182f2a79a20cdc840ddd
Opcode Fuzzy Hash: e0d51a86d34d55a70252fae78856aca644acaf8b0281d14b8b82cd5d61169e24
Instruction Fuzzy Hash: 38A156756043019FCB10DF14C584EAABBE9FF89314F548998F89A9B3A2CB31ED45CB91

Function 00AD518D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00AD521D

Part of subcall function 00AE0270: __87except.LIBCMT ref: 00AE02AB

Strings

pow, xrefs: 00AD51F5, 00AD5212

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 8abac50382277a47eb2e499744ad6b0714fb85c7b64fa8dc15ad7d9efdeba080
Instruction ID: 65c52b6411376b7a8c0bf721ad7316991e20c02d504ccd3a890c6f09db991da0
Opcode Fuzzy Hash: 8abac50382277a47eb2e499744ad6b0714fb85c7b64fa8dc15ad7d9efdeba080
Instruction Fuzzy Hash: 66515B70E0CA4297DB11A735C9517AE3BE4EB00710F244D5AF0E64A3E9EFB48DC89646

Function 00AD017B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00AD01B7
#, xrefs: 00AD01C0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: d410878d1dba6e52c5a4cb1a0a9346ab9e46bace770c7a7e420cd2a41afff27a
Instruction ID: 6859dc23b7194f349570da3575475a39f86ef83d7df1631f862824fca59d708f
Opcode Fuzzy Hash: d410878d1dba6e52c5a4cb1a0a9346ab9e46bace770c7a7e420cd2a41afff27a
Instruction Fuzzy Hash: 61510F7550524A9FDF25DF28C489BFA7FB4EF59310F144096E9929B2E1C730AC86CB60

Function 00AC62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AC63A8
_memmove.LIBCMT ref: 00AC6444
_memset.LIBCMT ref: 00AC6468

Strings

ERCP, xrefs: 00AC6313

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: cb93c2d0b21a35e2d0f8f8cf739dde351e49592b1acd25728433e829a65df5d6
Instruction ID: 9717800387020bbcc8fc9b548028706aea5d6f34a4247f8fcbd48d5c41fe3f84
Opcode Fuzzy Hash: cb93c2d0b21a35e2d0f8f8cf739dde351e49592b1acd25728433e829a65df5d6
Instruction Fuzzy Hash: 3E51A571900305DBDB28CF55CA81BAABBF4FF04714F2085AEE55ACB281E775E984CB40

Function 00B09AB7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B117ED: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B09558,?,?,00000034,00000800,?,00000034), ref: 00B11817

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B09B01

Part of subcall function 00B117B8: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B09587,?,?,00000800,?,00001073,00000000,?,?), ref: 00B117E2

Part of subcall function 00B1170F: GetWindowThreadProcessId.USER32(?,?), ref: 00B1173A
Part of subcall function 00B1170F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B0951C,00000034,?,?,00001004,00000000,00000000), ref: 00B1174A
Part of subcall function 00B1170F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B0951C,00000034,?,?,00001004,00000000,00000000), ref: 00B11760

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B09B6E
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B09BBB

Strings

@, xrefs: 00B09BD3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 6810f136827d8b2c058ee6e8b7ba0badedf2b91592328a68956638200c3197cf
Instruction ID: 33ab17597093d84929bbe9ef5f76c99e5f35d8367728e6bad1b6acd7faf980ca
Opcode Fuzzy Hash: 6810f136827d8b2c058ee6e8b7ba0badedf2b91592328a68956638200c3197cf
Instruction Fuzzy Hash: AA414F76901218BFDB10DFA8CD81EEEBBB8EB09310F104095FA55B7291DA706E85CB61

Function 00B37978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00B3F910,00000000,?,?,?,?), ref: 00B37A11
GetWindowLongW.USER32 ref: 00B37A2E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B37A3E

Strings

SysTreeView32, xrefs: 00B379E3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 5dbdc854e99d3bab7e45f33765ea1fc270e20845d5dfcecf7693a2e6f14a52c8
Instruction ID: 5c0fb4f8341da07ce7ac574eb58d52016725bbaccb12a4847afec44c5fa4aa9b
Opcode Fuzzy Hash: 5dbdc854e99d3bab7e45f33765ea1fc270e20845d5dfcecf7693a2e6f14a52c8
Instruction Fuzzy Hash: 5A31CD71644606ABDB218E38CC45BEA7BE9EB09324F344765F8B5A32E1CB30ED508B50

Function 00B3740B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B37493
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B374A7
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B374CB

Strings

SysMonthCal32, xrefs: 00B3745E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: bb43c9cfb4489047acddff7459b836ed47fa09f917b4cab7073f40a21caa41db
Instruction ID: 1760332f45b6c332b234aa0a93a60c85e8edb60835b03041388de2d645b0c7ff
Opcode Fuzzy Hash: bb43c9cfb4489047acddff7459b836ed47fa09f917b4cab7073f40a21caa41db
Instruction Fuzzy Hash: 5621A332540219BBDF218F94DC82FEA3BB9EF48724F210154FE546B191DA75B855CB90

Function 00B37BC5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B37C7C
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B37C8A
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B37C91

Strings

msctls_updown32, xrefs: 00B37BF6

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 19dbd3e9da0013b40798232cd50d9ad1c68f704757b0d88c654a0c04daa739f1
Instruction ID: 88a840f38d7cb794d572f35c4bca4c4307c1c40e6d6840e98e6031578f56da95
Opcode Fuzzy Hash: 19dbd3e9da0013b40798232cd50d9ad1c68f704757b0d88c654a0c04daa739f1
Instruction Fuzzy Hash: DE217CB5600209AFDB20DF14DC91DA737EDEF4A354F540499FA049B2A1CB71EC41CBA0

Function 00B36CE2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B36D6D
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B36D7D
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B36DA2

Strings

Listbox, xrefs: 00B36D3A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: a12c398c6d18b1a35f4468880856c3b5a717704777560988cdbaeafe1ab6fd66
Instruction ID: ae264b6fc169a802b7af3efa0fe1e67c2563021f8b06c2ee90452566f245be3f
Opcode Fuzzy Hash: a12c398c6d18b1a35f4468880856c3b5a717704777560988cdbaeafe1ab6fd66
Instruction Fuzzy Hash: 4B219F32610118BFEF118F54DC85FBB3BFAEF89764F218164FA049B1A0CA71AC5187A0

Function 00B37740 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B377A4
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B377B9
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B377C6

Strings

msctls_trackbar32, xrefs: 00B3777B

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: b4e150b6c64ba0fe9f74f22cfcf95042b2d4493eac56edd9a39cfc3c0bdf3254
Instruction ID: e0aa637c2f9c60ac3ecf5d56669916379a242e5b5cbad79d4d793b3f36cdecb0
Opcode Fuzzy Hash: b4e150b6c64ba0fe9f74f22cfcf95042b2d4493eac56edd9a39cfc3c0bdf3254
Instruction Fuzzy Hash: 6F11E772244208BAEF245F60CC45FEB77EDEF89714F110118F641960E0DA71A851DB20

Function 00AB4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00AB4C2E), ref: 00AB4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00AB4CB5

Strings

kernel32.dll, xrefs: 00AB4C9E
GetNativeSystemInfo, xrefs: 00AB4CAF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: a7612e847d08e79374e0de3ce1710b56b9c9f70b85a95c2b002d94385436f22a
Instruction ID: 2f6236805ed88bddd0b2d8bcf617ac72ad686f8f33b5e6c9814798b817a2f340
Opcode Fuzzy Hash: a7612e847d08e79374e0de3ce1710b56b9c9f70b85a95c2b002d94385436f22a
Instruction Fuzzy Hash: 53D01270910727DFD7205F31D958656B6D9AF06B51F218879D885D6161EB70D480C650

Function 00AB4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00AB4CE1,?), ref: 00AB4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AB4DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00AB4DAE
kernel32.dll, xrefs: 00AB4D9D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 8747e81116d65257586baa36808ef52da595c8cf53413b6143191468a5df2cca
Instruction ID: 3ffdea9ff9c439ca979c2af031c8fa5b6163c61b77e7bb841ad9ea04f2b5f49e
Opcode Fuzzy Hash: 8747e81116d65257586baa36808ef52da595c8cf53413b6143191468a5df2cca
Instruction Fuzzy Hash: 98D01271950B13CFD7205F31D809B9676D8AF15355F21887AD8C6D6161EB74D480C650

Function 00AB4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00AB4D2E,?,00AB4F4F,?,00B752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AB4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AB4D81

Strings

kernel32.dll, xrefs: 00AB4D6A
Wow64DisableWow64FsRedirection, xrefs: 00AB4D7B

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 7d4822d96c8792cb2829ba62408af079323c831a06a4fc4626eb44c0c751899d
Instruction ID: 0779f2689c7990c6d6a1d16c2c0bef252f9cbbaf4177350104758c8fc2121b22
Opcode Fuzzy Hash: 7d4822d96c8792cb2829ba62408af079323c831a06a4fc4626eb44c0c751899d
Instruction Fuzzy Hash: 83D01270910B13CFD7205F31D80876A77D8BF19351F21897A9486D6261EA74D480CA50

Function 00B30E72 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00B310C1), ref: 00B30E80
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B30E92

Strings

advapi32.dll, xrefs: 00B30E7B
RegDeleteKeyExW, xrefs: 00B30E8C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: b79b78b02af7c7eff16029d1da730fc5bda2cd306559518e5557d4e0fd30cb98
Instruction ID: c7949e23c410eed5b58afe0716ff7bfdd9fa094f3d838eb4ccd687f349ad5bb9
Opcode Fuzzy Hash: b79b78b02af7c7eff16029d1da730fc5bda2cd306559518e5557d4e0fd30cb98
Instruction Fuzzy Hash: 97D01270910723CFD7205F35D91865776D8EF15351F218C7AA486D2160DB78C480CA51

Function 00B291F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00B28E09,?,00B3F910), ref: 00B29203
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00B29215

Strings

kernel32.dll, xrefs: 00B291FE
GetModuleHandleExW, xrefs: 00B2920F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 5a84b36d675da0474696c9ee3e2370eb6abaa78fb11c3b22ea71961ba86d2325
Instruction ID: 42704e2944dde38b6ff722b530ae0359c34f0f425538238fa4ee1394b8dfd36b
Opcode Fuzzy Hash: 5a84b36d675da0474696c9ee3e2370eb6abaa78fb11c3b22ea71961ba86d2325
Instruction Fuzzy Hash: 93D01270954723DFDB205F31ED0861676D5EF05351F218C799889D6561EAB4C480C650

Function 00AF1A6D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00AF1A71
__swprintf.LIBCMT ref: 00AF1AA2

Strings

WIN_XPe, xrefs: 00AF1AE1
%.3d, xrefs: 00AF1A7C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: caa039af81e017336f5a457b3f7c2b5b20c0cbc616e1e88f221dad3a2b3de235
Instruction ID: 386493d847bf83f8e9794a00de51b8b11328cc2bc4c311154798b27dea97c559
Opcode Fuzzy Hash: caa039af81e017336f5a457b3f7c2b5b20c0cbc616e1e88f221dad3a2b3de235
Instruction Fuzzy Hash: D3D01772C0511DEACB00EBD18D85CFEB3BCAB08350F644452FA06A2040E675CB84AB21

Function 00B074A5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755c0a17feb185d2bb9581b0254b0992858bbb832e5b0a57983f8afd00ac0b80
Instruction ID: d59fd8c3cfeb14e882bff8069c5a3070048fe711c7f76baade17d89f87df44a3
Opcode Fuzzy Hash: 755c0a17feb185d2bb9581b0254b0992858bbb832e5b0a57983f8afd00ac0b80
Instruction Fuzzy Hash: 73C11875E04216EFCB14CF98C884AAAFBF5FF48714B158598E806EB291DB31ED41CB90

Function 00B2E13E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00B2E1D2
CharLowerBuffW.USER32(?,?), ref: 00B2E215

Part of subcall function 00B2D8B9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00B2D8D9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00B2E415
_memmove.LIBCMT ref: 00B2E428

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: e4f78005cb98e0658bca473e75e4ffdc640128aa1f808d55fc96b81d86b6e2d4
Instruction ID: 97e23bc6accb80caf98f57b8c2d1f0f7aafc7eb36a5996ae8b93ac58a2e46a87
Opcode Fuzzy Hash: e4f78005cb98e0658bca473e75e4ffdc640128aa1f808d55fc96b81d86b6e2d4
Instruction Fuzzy Hash: 97C14C71A08311DFC704DF25D480A6ABBE4FF89714F1489AEF8AA9B351D731E945CB82

Function 00B281A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B281D8
CoUninitialize.OLE32 ref: 00B281E3

Part of subcall function 00B0D87B: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B0D8E3

VariantInit.OLEAUT32(?), ref: 00B281EE
VariantClear.OLEAUT32(?), ref: 00B284BF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: c2a62773b9bface5f85e80e579c20e5b961c801254abaca12c82d0686be34229
Instruction ID: 8d535b8985cb086824e3c0204cc8215bde7de608c6b1fee500caa86aad3a2f06
Opcode Fuzzy Hash: c2a62773b9bface5f85e80e579c20e5b961c801254abaca12c82d0686be34229
Instruction Fuzzy Hash: FEA148356047119FCB10EF14D581A6AB7E4FF88760F14848DFA9A9B3A2CB30ED05CB86

Function 00B07858 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B42C7C,?), ref: 00B07A12
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B42C7C,?), ref: 00B07A2A
CLSIDFromProgID.OLE32(?,?,00000000,00B3FB80,000000FF,?,00000000,00000800,00000000,?,00B42C7C,?), ref: 00B07A4F
_memcmp.LIBCMT ref: 00B07A70

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 30b8d48606eb0d7c9c7870d1c16acaa751696de118a96aba9e4ac6eb784aae08
Instruction ID: a741df486b05b72fd2eb829add84b1ec30f26eb5da1738baa85799a0a40d83c8
Opcode Fuzzy Hash: 30b8d48606eb0d7c9c7870d1c16acaa751696de118a96aba9e4ac6eb784aae08
Instruction Fuzzy Hash: 9981EA75E00109EFCB04DF94C984EEEBBB9FF89315F204599E515AB250DB71AE05CB60

Function 00B06BD3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B06BE4
SysAllocString.OLEAUT32(00000000), ref: 00B06C8D
VariantCopy.OLEAUT32 ref: 00B06CBC
VariantClear.OLEAUT32(?), ref: 00B06CE3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 2d36cbaf15705b8b2e2e5ceb8eca2523bf17f5b4a6fb5e8fadc87d6bc896e62d
Instruction ID: 80f4a7d82aef3e76993ccdf030df76aaeeef266e139821f9baaa5df260f46b25
Opcode Fuzzy Hash: 2d36cbaf15705b8b2e2e5ceb8eca2523bf17f5b4a6fb5e8fadc87d6bc896e62d
Instruction Fuzzy Hash: 1851B4307443029BDB24AF65D895A6EFBE9EF08310F20997FE596CB2D1DF7098908715

Function 00B39826 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00C9E9D0,?), ref: 00B39895
ScreenToClient.USER32(00000002,00000002), ref: 00B398C8
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00B39935

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 602e6453e919f9335c2e5aee565bac9f0f74d9ea235d78bb791b88dc0c3b1415
Instruction ID: 9ebe4c6138accfff5c2a028dcf3ccd76dd743949ae9a041b75062539dc37ce13
Opcode Fuzzy Hash: 602e6453e919f9335c2e5aee565bac9f0f74d9ea235d78bb791b88dc0c3b1415
Instruction Fuzzy Hash: 74514335900109EFDF24DF58D980AAE7BF5FF85360F248299F8559B2A0D771AD81CB90

Function 00B26AC0 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00B26AE7
WSAGetLastError.WSOCK32(00000000), ref: 00B26AF7

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00B26B5B
WSAGetLastError.WSOCK32(00000000), ref: 00B26B67

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 43651898abe9ceb07cb9d4b501b1269b02839721ccbb54e2502bd9da1662cef1
Instruction ID: d762407e363d0da2cf580227cdcfdf1b5a421135bd8b3b59d8af650ee7e87a0c
Opcode Fuzzy Hash: 43651898abe9ceb07cb9d4b501b1269b02839721ccbb54e2502bd9da1662cef1
Instruction Fuzzy Hash: DA41B135740210AFEB24AF28DD8BF7A77EDEB08B10F548058FA599B2D3DA749C018791

Function 00B26530 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00B3F910), ref: 00B265BD
_strlen.LIBCMT ref: 00B265EF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: e580882922a1d200fa43230ee3309835a4c6653bab93eb9b1c4bf0ae5dafadd7
Instruction ID: f22df243c28b5935c0e93dacc4426a23e2d806cc6b004ad2b92aecf2ce674b90
Opcode Fuzzy Hash: e580882922a1d200fa43230ee3309835a4c6653bab93eb9b1c4bf0ae5dafadd7
Instruction Fuzzy Hash: 3A416031A00114AFCB15EBA4E9D5FEEB7E9EF58310F148199F91A9B292DB30AD40C751

Function 00B1B880 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B1B92A
GetLastError.KERNEL32(?,00000000), ref: 00B1B950
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B1B975
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B1B9A1

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 556b21b81cfbb4ab4d23fd1283e282552ff6cc5d35ed215d9ae07873b45c6278
Instruction ID: 3ae71b7aedc69152d99d7baa1e904561b9dd510e46670fa2b33d75b669a591fc
Opcode Fuzzy Hash: 556b21b81cfbb4ab4d23fd1283e282552ff6cc5d35ed215d9ae07873b45c6278
Instruction Fuzzy Hash: E8412839600651DFCB11EF15C684E9EBBE5EF89310B198088E94AAB772CB30FD41CB91

Function 00B38883 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B38910

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: bec30f9068a09dd9d5f5207c1d0828f2f7f70091f025f498507f5434ab08e965
Instruction ID: 9e6949471e95bbc3ed00e6d1c099bf84fa50cfa0e86a51e2640f92c641435463
Opcode Fuzzy Hash: bec30f9068a09dd9d5f5207c1d0828f2f7f70091f025f498507f5434ab08e965
Instruction Fuzzy Hash: 6631D230601308BFEF219A58CC89BBC37E5EB06310F745295FA51E72E1CF70A9808A93

Function 00B3AB69 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00B3AB92
GetWindowRect.USER32(?,?), ref: 00B3AC08
PtInRect.USER32(?,?,00B3C07E), ref: 00B3AC18
MessageBeep.USER32(00000000), ref: 00B3AC89

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2bd89ef4d0d7cb3e111d60ae289adea232eada42a334003c5c01563c6666f636
Instruction ID: e50cea4a8555e0c84f84e3d95255d85207ef1d0f2e1def57ce535e3e470c3707
Opcode Fuzzy Hash: 2bd89ef4d0d7cb3e111d60ae289adea232eada42a334003c5c01563c6666f636
Instruction Fuzzy Hash: 3A416E30A00115DFCF11CF59CC84AA9BBF5FB59310F7891E9E4989B261D730E945CB52

Function 00B10E07 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00B10E58
SetKeyboardState.USER32(00000080,?,00000001), ref: 00B10E74
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00B10EDA
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00B10F2C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 741415c0ee74315d57aa86b7a50b1bdc27f55373b0cf52bfccf008672651f923
Instruction ID: 48e9b6f91b24681ef77d10e28a8cd8267ae39850aaf5746fea7fb69fb93cfe20
Opcode Fuzzy Hash: 741415c0ee74315d57aa86b7a50b1bdc27f55373b0cf52bfccf008672651f923
Instruction Fuzzy Hash: 75316B32D60208AEFF30AB268C09BFE7BE5EB58310F98469AF4C0521D1C7F589C19751

Function 00B10F42 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00B10F97
SetKeyboardState.USER32(00000080,?,00008000), ref: 00B10FB3
PostMessageW.USER32(00000000,00000101,00000000), ref: 00B11012
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00B11064

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 68406c5f32448ff3b7d5056977d8f7f41b23dedd08dabbaa61bba4b5869563a4
Instruction ID: 8ffb34c15df20a36bafbd69c8a22d733b3689ff08c151ae208e1681925d53b39
Opcode Fuzzy Hash: 68406c5f32448ff3b7d5056977d8f7f41b23dedd08dabbaa61bba4b5869563a4
Instruction Fuzzy Hash: 2F315C30D00288DEFF309A298C0DBFE7BE9EB5C311F94469AE581921D1C37589C19761

Function 00AE6345 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00AE637B
__isleadbyte_l.LIBCMT ref: 00AE63A9
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00AE63D7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00AE640D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9a3d9282597c240774de56e655902bab1b667ffddd7ae13c22ba4ada1f445b63
Instruction ID: d9796aa2e15d52e9908785237722b31e04a63752cefe52209a5440e8c4284f2b
Opcode Fuzzy Hash: 9a3d9282597c240774de56e655902bab1b667ffddd7ae13c22ba4ada1f445b63
Instruction Fuzzy Hash: 0A31B031600286EFDB21CF66C944BBE7FB5FF55390F154829E8258B191EB31E850DB50

Function 00B34F57 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00B34F6B

Part of subcall function 00B13685: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B1369F
Part of subcall function 00B13685: GetCurrentThreadId.KERNEL32 ref: 00B136A6
Part of subcall function 00B13685: AttachThreadInput.USER32(00000000,?,00B150AC), ref: 00B136AD

GetCaretPos.USER32(?), ref: 00B34F7C
ClientToScreen.USER32(00000000,?), ref: 00B34FB7
GetForegroundWindow.USER32 ref: 00B34FBD

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: b3ef02cd555d386917b91c5671788fd09f2efc49a972e8ddf9714763f6606c16
Instruction ID: 124f24131a4dabc06d80550d17c22e81c048e7fc04d41afa033933ef543e022e
Opcode Fuzzy Hash: b3ef02cd555d386917b91c5671788fd09f2efc49a972e8ddf9714763f6606c16
Instruction Fuzzy Hash: B9314171D00108AFDB00EFA5C9859EFB7FDEF99300F11406AE515E7252EA759E41CBA0

Function 00B3C502 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

GetCursorPos.USER32(?), ref: 00B3C53C
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00AEBB2B,?,?,?,?,?), ref: 00B3C551
GetCursorPos.USER32(?), ref: 00B3C59E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00AEBB2B,?,?,?), ref: 00B3C5D8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b22f0597cf8734a0fdb9536d91409bc0818646371d4125cec8f0beb33c17155e
Instruction ID: 5d7d12bc3af83d9ddc2ae80d62f1a316de38f3c88ffea4a5ed247a98f97fff15
Opcode Fuzzy Hash: b22f0597cf8734a0fdb9536d91409bc0818646371d4125cec8f0beb33c17155e
Instruction Fuzzy Hash: 07318536600418AFCB25CF94C859EFE7FF9EB59310F1540A9F9059B262DB31AD50DBA0

Function 00B0897E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08432: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B08449
Part of subcall function 00B08432: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B08453
Part of subcall function 00B08432: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B08462
Part of subcall function 00B08432: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B08469
Part of subcall function 00B08432: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B0847F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00B089CB
_memcmp.LIBCMT ref: 00B089EE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B08A24
HeapFree.KERNEL32(00000000), ref: 00B08A2B

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: c527d46f720533a72f3df5f0888a096829d3f435bc8e9f636bb9ee6ccddc5428
Instruction ID: 4398c4ecc7d68c6daddbaf76ead58a54650099619c4c969515c2561a526bb0b2
Opcode Fuzzy Hash: c527d46f720533a72f3df5f0888a096829d3f435bc8e9f636bb9ee6ccddc5428
Instruction Fuzzy Hash: 9F217A71E40109EFDF10DFA4C945BEEBBF8EF44315F15409AE495A7291DB30AA05CB51

Function 00AD0B0C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00AD0B2E

Part of subcall function 00AB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B1793F,?,?,00000000), ref: 00AB5B8C
Part of subcall function 00AB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B1793F,?,?,00000000,?,?), ref: 00AB5BB0

_fprintf.LIBCMT ref: 00AD0B65
OutputDebugStringW.KERNEL32(?), ref: 00B06111

Part of subcall function 00AD4C1A: _flsall.LIBCMT ref: 00AD4C33

__setmode.LIBCMT ref: 00AD0B9A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: f3faa09d0a7bbcd737cb0ff15f3af92c153308429bb5b022fcb06d3bf92f55a1
Instruction ID: 01c0701fe520162cf51c0e4afa10c398085eed7597bcb21485dcc5a334e06e1e
Opcode Fuzzy Hash: f3faa09d0a7bbcd737cb0ff15f3af92c153308429bb5b022fcb06d3bf92f55a1
Instruction Fuzzy Hash: F011D2329086047BDB04B7B49D42EFE7BADAF49320F14006BF106A72E2EE7159915795

Function 00B2187D Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B218B9

Part of subcall function 00B21943: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B21962
Part of subcall function 00B21943: InternetCloseHandle.WININET(00000000), ref: 00B219FF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: b642d95d4cdf0707c0a49468ba5929a0b09602371ef64c6daa416da5ef0aa050
Instruction ID: 77995f8b69dcf8d0474170aee78649caa0ff7aef6b7cae11fd0a4a873e360b11
Opcode Fuzzy Hash: b642d95d4cdf0707c0a49468ba5929a0b09602371ef64c6daa416da5ef0aa050
Instruction Fuzzy Hash: 86210131200725BFEB119F64AC11F7AB7E9FFA8700F10446AFA1996250CB31D85297A0

Function 00B13A6E Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00B3FAC0), ref: 00B13AA8
GetLastError.KERNEL32 ref: 00B13AB7
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B13AC6
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00B3FAC0), ref: 00B13B23

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: e2fb023bcaa14d436fbd5dcfbc4880df8b41024b2a08f7bc7b8b6d53eb9abc4c
Instruction ID: 55d2b6ae6ea1d693da226159779f4f89bc257166a90f2bf3b517241054779d93
Opcode Fuzzy Hash: e2fb023bcaa14d436fbd5dcfbc4880df8b41024b2a08f7bc7b8b6d53eb9abc4c
Instruction Fuzzy Hash: 822176709092019F8310DF24C9849EFB7E8EE55B54F544A9DF499C72A2FB30DE85CB82

Function 00AE5262 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00AE5281

Part of subcall function 00AD588C: __FF_MSGBANNER.LIBCMT ref: 00AD58A3
Part of subcall function 00AD588C: __NMSG_WRITE.LIBCMT ref: 00AD58AA
Part of subcall function 00AD588C: RtlAllocateHeap.NTDLL(00C80000,00000000,00000001,00000000,?,?,?,00AD0F53,?), ref: 00AD58CF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a91587236a6b920163c09ba4289e97a05093c0cdf68a68b802842fd1fbc15540
Instruction ID: e5e017930a126507a9edd71d18b4c275d25c06cfee99ff2291ea294bd18dd65b
Opcode Fuzzy Hash: a91587236a6b920163c09ba4289e97a05093c0cdf68a68b802842fd1fbc15540
Instruction Fuzzy Hash: 3511CA32D01A569FCF202F76BD056AE3798AF00764B20452AFA069B251DE3889409B95

Function 00AB4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AB4560

Part of subcall function 00AB410D: _memset.LIBCMT ref: 00AB418D
Part of subcall function 00AB410D: _wcscpy.LIBCMT ref: 00AB41E1
Part of subcall function 00AB410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AB41F1

KillTimer.USER32(?,00000001,?,?), ref: 00AB45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AB45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AED5FE

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 23e0fbdda6de3e84db372698011ddc0460ac2facc378767ba8287f322a98b93e
Instruction ID: 8b6814c77df9c4c55486693eae701d9506ad370f0773f865994df5db41c1c1ed
Opcode Fuzzy Hash: 23e0fbdda6de3e84db372698011ddc0460ac2facc378767ba8287f322a98b93e
Instruction Fuzzy Hash: 5321D7709047849FEB328B24D855BE7BBEC9F15308F14009EE69E57243DB745E84CB51

Function 00B2647F Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B1793F,?,?,00000000), ref: 00AB5B8C
Part of subcall function 00AB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B1793F,?,?,00000000,?,?), ref: 00AB5BB0

gethostbyname.WSOCK32(?,?,?), ref: 00B264AF
WSAGetLastError.WSOCK32(00000000), ref: 00B264BA
_memmove.LIBCMT ref: 00B264E7
inet_ntoa.WSOCK32(?), ref: 00B264F2

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: a156022fdb48cd84dbf414547da861aaa351193972d79b07f2e48424e3df2b3d
Instruction ID: 24a5a9e9715a659517e779a9bf335f4c97869e2ef7475697d99347c45ec730d9
Opcode Fuzzy Hash: a156022fdb48cd84dbf414547da861aaa351193972d79b07f2e48424e3df2b3d
Instruction Fuzzy Hash: 5F11FE35900109AFCB04FBA4DE96DEEB7BDAF18310B144165F506A7262DF31AE14DB61

Function 00B08E03 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00B08E23
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B08E35
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B08E4B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B08E66

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2683280f07b0a96b612b2487b48ea6ee0d0c63324b69bc976f8f5dbd9f253809
Instruction ID: 91517625df7ed9207d1a0f8ca8b2ff83ef03838f5391d5732c29452ba06beecb
Opcode Fuzzy Hash: 2683280f07b0a96b612b2487b48ea6ee0d0c63324b69bc976f8f5dbd9f253809
Instruction Fuzzy Hash: 82112A79901218FFEB11DFA5CD85EADBBB8FB48710F204095EA04B7290DA716F11DB94

Function 00AB1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623

DefDlgProcW.USER32(?,00000020,?), ref: 00AB12D8
GetClientRect.USER32(?,?), ref: 00AEB77B
GetCursorPos.USER32(?), ref: 00AEB785
ScreenToClient.USER32(?,?), ref: 00AEB790

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: b5878f983054784af5402fbcd1538947ebea458b6abfeb1a4e5309fe3838483e
Instruction ID: a32c44899e4883ec2948c379b994f518b1e84c6ef13676986e79a2425d4b134b
Opcode Fuzzy Hash: b5878f983054784af5402fbcd1538947ebea458b6abfeb1a4e5309fe3838483e
Instruction Fuzzy Hash: C6112B35A00119EBCB14DF94D995DFE77BCEB05301F600466F951E7151CB30BA518BA5

Function 00B11473 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00B1001E,?,00B11071,?,00008000), ref: 00B11490
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00B1001E,?,00B11071,?,00008000), ref: 00B114B5
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00B1001E,?,00B11071,?,00008000), ref: 00B114BF
Sleep.KERNEL32(?,?,?,?,?,?,?,00B1001E,?,00B11071,?,00008000), ref: 00B114F2

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 1ac6ce51df1c3c82f262ca3d15d6577d1aeea62f2f38a5c077b451e0d02e2c5b
Instruction ID: 31cf7ab9c2fe0490218987c26f99cf15ffa933a4be9134c4876ef14ba91f40a0
Opcode Fuzzy Hash: 1ac6ce51df1c3c82f262ca3d15d6577d1aeea62f2f38a5c077b451e0d02e2c5b
Instruction Fuzzy Hash: C3113031C0092ED7CF009FA9E984AEDBBB8FF09B11F514595EA41B6340CF3495908B95

Function 00AE7137 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00AE715B

Part of subcall function 00AE7842: __fltout2.LIBCMT ref: 00AE786B

__cftog_l.LIBCMT ref: 00AE7181
__cftoe_l.LIBCMT ref: 00AE71B3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 757faac6cbf9b1cab2b66e184f4163f7559d23b43775b9dbbc30e990004ece13
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 1901483204828ABBCF165F86CC058EE3F26BF28394B598615FE5858131D336C9B1AB81

Function 00B3B2F9 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B3B318
ScreenToClient.USER32(?,?), ref: 00B3B330
ScreenToClient.USER32(?,?), ref: 00B3B354
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B3B36F

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: be3364a3998807b545a4ce30116d9ee8853a5d2279e1fe2d97d7197c042c545f
Instruction ID: f775f76f43e9c08841b84363d95488f80fb8242652e48d5fb6e7b73763cf87bb
Opcode Fuzzy Hash: be3364a3998807b545a4ce30116d9ee8853a5d2279e1fe2d97d7197c042c545f
Instruction Fuzzy Hash: 69113479D0020AEFDB41CF98C4459EEBBF5FF08210F104166E914E3224D735AA55CF50

Function 00B3B669 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B3B678
_memset.LIBCMT ref: 00B3B687
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00B76F20,00B76F64), ref: 00B3B6B6
CloseHandle.KERNEL32 ref: 00B3B6C8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 9a3f7331a9eb18725cf17275a599928134ebb6a3632faf64ce29b292d87c1957
Instruction ID: a26db54412711e7050f6df7c933fded5275a0afab7c1317198aba4cac40dc033
Opcode Fuzzy Hash: 9a3f7331a9eb18725cf17275a599928134ebb6a3632faf64ce29b292d87c1957
Instruction Fuzzy Hash: 48F05EB2640704BEE3102B61BC06FBB7B9CEB19354F004425FA0DDB1A2DB715C108BA8

Function 00B16C83 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00B16C8F

Part of subcall function 00B1776D: _memset.LIBCMT ref: 00B177A2

_memmove.LIBCMT ref: 00B16CB2
_memset.LIBCMT ref: 00B16CBF
LeaveCriticalSection.KERNEL32(?), ref: 00B16CCF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 45f3a3d2629517c439a044ea3de906e43e2e93d994aec9f7ba62691d01ed9741
Instruction ID: 2b0840c5fe110a07cd766ba6ea471111c605786e02a679db251f88f2b46f906c
Opcode Fuzzy Hash: 45f3a3d2629517c439a044ea3de906e43e2e93d994aec9f7ba62691d01ed9741
Instruction Fuzzy Hash: 75F0543A100104BBCF016F55DD85E8ABB69FF49320F148065FE095F26ACB71A851CBB4

Function 00B0A15C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00B0A179
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B0A18C
GetCurrentThreadId.KERNEL32 ref: 00B0A193
AttachThreadInput.USER32(00000000), ref: 00B0A19A

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 2e47372eedbe6b46dcbc1b51316288f5ab4de2c6e97c18b42dac423f643c6a53
Instruction ID: 46f35bc5980ad77c371dbd2448db7f5fb676d7019d32c29c2ba2332830d48954
Opcode Fuzzy Hash: 2e47372eedbe6b46dcbc1b51316288f5ab4de2c6e97c18b42dac423f643c6a53
Instruction Fuzzy Hash: 9EE0ED31945329BBDB205FA2DC0DEEB7F5CEF277A1F508465F509A60A0CB719540CBA1

Function 00AB2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00AB2231
SetTextColor.GDI32(?,000000FF), ref: 00AB223B
SetBkMode.GDI32(?,00000001), ref: 00AB2250
GetStockObject.GDI32(00000005), ref: 00AB2258
GetWindowDC.USER32(?,00000000), ref: 00AEC003
GetPixel.GDI32(00000000,00000000,00000000), ref: 00AEC010
GetPixel.GDI32(00000000,?,00000000), ref: 00AEC029
GetPixel.GDI32(00000000,00000000,?), ref: 00AEC042
GetPixel.GDI32(00000000,?,?), ref: 00AEC062
ReleaseDC.USER32(?,00000000), ref: 00AEC06D

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: a9f881111848cad4a216756d7becb7fa1eeb7f457a2b4db5dde2d153a6f63e89
Instruction ID: f90ab3b46b03f5b123398fb313548f2c90af2c82ec3c30ce52dd23ff0019fbe6
Opcode Fuzzy Hash: a9f881111848cad4a216756d7becb7fa1eeb7f457a2b4db5dde2d153a6f63e89
Instruction Fuzzy Hash: 13E03032500545EADB215F64FC0D7E83B10EB15332F108366FA69580E18B714590DB11

Function 00B08A3A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00B08A43
OpenThreadToken.ADVAPI32(00000000,?,?,?,00B0860E), ref: 00B08A4A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B0860E), ref: 00B08A57
OpenProcessToken.ADVAPI32(00000000,?,?,?,00B0860E), ref: 00B08A5E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 189400b2b4557a97fe7f58920064e16b330ad23e7f806df2de56901666252353
Instruction ID: 513b1b16c42e436e39a53b135d450be606733e8b91815be1e8ea8a247464b57c
Opcode Fuzzy Hash: 189400b2b4557a97fe7f58920064e16b330ad23e7f806df2de56901666252353
Instruction Fuzzy Hash: BEE08636B01222EFD7205FB46D0CB6B3BACEF50792F244869B285DB090DE349541C750

Function 00AF20B6 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00AF20B6
GetDC.USER32(00000000), ref: 00AF20C0
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00AF20E0
ReleaseDC.USER32(?), ref: 00AF2101

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 5ea222f370ec5fa958402d59868e3d5524b366b2fbcf1b070d62f86bcf9260be
Instruction ID: 3b6cc3f79df14788e8460da7a142146f4629f76d55edd7cd20122a56de496cfe
Opcode Fuzzy Hash: 5ea222f370ec5fa958402d59868e3d5524b366b2fbcf1b070d62f86bcf9260be
Instruction Fuzzy Hash: 75E0E575C00205EFCB019FA0C909AAE7BB5EB4C350F208029F95AA7221CF388582DF40

Function 00AF20CA Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00AF20CA
GetDC.USER32(00000000), ref: 00AF20D4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00AF20E0
ReleaseDC.USER32(?), ref: 00AF2101

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: cb49e38abfe0697307debeb19e5077fa927d4a69fc413927dbb124aec14dc18b
Instruction ID: 0ee7eb5821443c441465dba49695532c99278f9b29e40ccc277be84c3efa3c18
Opcode Fuzzy Hash: cb49e38abfe0697307debeb19e5077fa927d4a69fc413927dbb124aec14dc18b
Instruction Fuzzy Hash: 3AE01A75C00205AFCB019F70C909AAD7BF5EB4C350F208029F95AE7221CF389141DF40

Function 00B0B5B5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00B0B780

Strings

Container, xrefs: 00B0B6FD
AutoIt3GUI, xrefs: 00B0B6F8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: a77c87d37ad5ac6547e641300ef9e118dbb05b43656222006169b5c173fbbbd2
Instruction ID: 2adaa961de36c7f040a00e38d081840eaed55852fc6055b10e22f907ab93b988
Opcode Fuzzy Hash: a77c87d37ad5ac6547e641300ef9e118dbb05b43656222006169b5c173fbbbd2
Instruction Fuzzy Hash: F6912871600601AFDB14DF64C894F6ABBE8FF48710F2485ADF94ACB6A1DBB1E840CB50

Function 00B1B038 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00ACFE06: _wcscpy.LIBCMT ref: 00ACFE29

Part of subcall function 00AB9997: __itow.LIBCMT ref: 00AB99C2
Part of subcall function 00AB9997: __swprintf.LIBCMT ref: 00AB9A0C

__wcsnicmp.LIBCMT ref: 00B1B0B9
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00B1B182

Strings

LPT, xrefs: 00B1B0B3

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 94f3485edaa8dbac2299439b17124dfa4342ddbbcdcb01cbc3995a20a83d071d
Instruction ID: 8f68b97fe33a75b8b1012d7c314e05a125895cf508eb3369466c9412b37d14ba
Opcode Fuzzy Hash: 94f3485edaa8dbac2299439b17124dfa4342ddbbcdcb01cbc3995a20a83d071d
Instruction Fuzzy Hash: B461A175A10215AFCB14DF94C995EEEB7F5EF08310F5140AAF546AB3A1DB30AE84CB90

Function 00AC2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00AC2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00AC2AE1

Strings

@, xrefs: 00AC2AD5

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: f83c6c20672bb81024816ca3a1ca906d7be150b7f8fcee9c515b9eef5a39fd2a
Instruction ID: ff5cc4986fbea0cf55b361115e0c7d7659ae0ab42b012bc383a0d9e7c8898035
Opcode Fuzzy Hash: f83c6c20672bb81024816ca3a1ca906d7be150b7f8fcee9c515b9eef5a39fd2a
Instruction Fuzzy Hash: 295155724187449BD320AF10DD86BAFBBFCFB86314F41885DF2D9521A2DB308569CB66

Function 00B197DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00AB506B: __fread_nolock.LIBCMT ref: 00AB5089

_wcscmp.LIBCMT ref: 00B198CD
_wcscmp.LIBCMT ref: 00B198E0

Strings

FILE, xrefs: 00B19819

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: c7f60b0005cd2155fb47cb3289540d0ad5b8cb901d74d1fc41961de56f787926
Instruction ID: 59dc0e159166b08eb0eea6a4815cdec1bc94fc36c2d9a432dd45cb75833b2d23
Opcode Fuzzy Hash: c7f60b0005cd2155fb47cb3289540d0ad5b8cb901d74d1fc41961de56f787926
Instruction Fuzzy Hash: B841D871A00649BEDF21ABA0CC85FEF77FDDF45710F4004B9B901B7181DA71AA4587A1

Function 00B226A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B226B4
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00B226EA

Strings

|, xrefs: 00B226BB

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 0d5778ccd9bc846061efb3bbd0912d9fe7e190d50cfd67111a5fa18a31720acb
Instruction ID: 5f48be65109bf9b19328e079f776bd77d9201463864d00820f86bb2f302a384d
Opcode Fuzzy Hash: 0d5778ccd9bc846061efb3bbd0912d9fe7e190d50cfd67111a5fa18a31720acb
Instruction Fuzzy Hash: 63311771804119AFDF01EFA4DD85EEEBFB9FF08310F100069F819A6266EB715A56DB60

Function 00B37AA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00B37B93
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B37BA8

Strings

', xrefs: 00B37AFC

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 3489e34ec3ea617c2224262500d4622f26e36141858c33bc6a32ee42e0af61ed
Instruction ID: 673ee262ff5cf39e2b393ed6c740442fee90294f2f0ed8850133071957bf95b5
Opcode Fuzzy Hash: 3489e34ec3ea617c2224262500d4622f26e36141858c33bc6a32ee42e0af61ed
Instruction Fuzzy Hash: EE410BB4A452099FDB24CF65D991BDABBF5FF09300F2441AAE904EB351EB70A941CF90

Function 00B36A95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00B36B49
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B36B85

Strings

static, xrefs: 00B36AE5

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c0e0d3e72507b367e624da9e51325702eaa8f1250296c644308cad0f7af18625
Instruction ID: b5a8518d788bd0825267c895a8afa6edea3234115f075095050cdf7cdc2367c0
Opcode Fuzzy Hash: c0e0d3e72507b367e624da9e51325702eaa8f1250296c644308cad0f7af18625
Instruction Fuzzy Hash: F5317C71100604AAEB109F64CC81AFBB7F9FF48720F208619F9A9D71A0DB30AC81CB60

Function 00B12B9A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B12C09
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B12C44

Strings

0, xrefs: 00B12C02

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 98f42cf787a8bfd40b9fe4d290ce7e9eb91c0e518da3a2c9fb69c9cd2060955d
Instruction ID: 0ffda901540bd8fe4873102638116e0660ff977d432d5c99ab4e3e2cf84a9fa3
Opcode Fuzzy Hash: 98f42cf787a8bfd40b9fe4d290ce7e9eb91c0e518da3a2c9fb69c9cd2060955d
Instruction Fuzzy Hash: 4531D731A002059FDF348F58D985BEEBBF5EF09350F6440A9EA85971A4D7709AA4CB90

Function 00B23AFF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00B23B7C

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Strings

, $, xrefs: 00B23BBC
AUTOITCALLVARIABLE%d, xrefs: 00B23B6E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 01ff9059dc95075cc762b1fb63695e0797f4ce634911ae861325dc33addb7aa9
Instruction ID: fe73fbbc05386efe125c49a30cb64e8c63686d30d8c7a6fd26bdda6cb979d1ba
Opcode Fuzzy Hash: 01ff9059dc95075cc762b1fb63695e0797f4ce634911ae861325dc33addb7aa9
Instruction Fuzzy Hash: EF215231A00129AACF10EF64DD86EEE77F9FF45700F4044D5F505A7182DA78EA45CBA1

Function 00B36706 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B36793
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B3679E

Strings

Combobox, xrefs: 00B36760

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 554bcec0c116a2437a5b54ab2da281bda8190b47cf977d6e6c8f2898940d14f7
Instruction ID: 4a79cd5125b2375da0017a36f8dd107af90fbd6b8ee3d90925c31605c9bf9b6a
Opcode Fuzzy Hash: 554bcec0c116a2437a5b54ab2da281bda8190b47cf977d6e6c8f2898940d14f7
Instruction Fuzzy Hash: 1B11B675300108BFEF258F14CC81EBB37AAEB44368F608164F91497290DA319C5187A0

Function 00B36C39 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00AB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AB1D73
Part of subcall function 00AB1D35: GetStockObject.GDI32(00000011), ref: 00AB1D87
Part of subcall function 00AB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB1D91

GetWindowRect.USER32(00000000,?), ref: 00B36CA3
GetSysColor.USER32(00000012), ref: 00B36CBD

Strings

static, xrefs: 00B36C80

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 023ad820d41064d677e551e669e534f22101af29efb822ebdd5da3aea68315c9
Instruction ID: 15364b399439b59211d214fa90c390728f876cfe98b5bffd2a69a82618ff8d77
Opcode Fuzzy Hash: 023ad820d41064d677e551e669e534f22101af29efb822ebdd5da3aea68315c9
Instruction Fuzzy Hash: 5B21297291020AAFDB04DFA8DC45EFABBF8FB08314F115669F995D3250DA35E850DB50

Function 00B36952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00B369D4
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B369E3

Strings

edit, xrefs: 00B369B8

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 1b41c07ed3c2f5728adb1288c8d58b91e365e483cecddfdccc6a4f4d63651abc
Instruction ID: ad69cf65e2a320057011dc703a4193b86f996271d1bffd89ed187b4b269ddbc5
Opcode Fuzzy Hash: 1b41c07ed3c2f5728adb1288c8d58b91e365e483cecddfdccc6a4f4d63651abc
Instruction Fuzzy Hash: A8116A71500205BBEF108E64DC85BFB37A9EB19368F718764FAA4971E0CA71EC909B60

Function 00B12CA7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B12D1A
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00B12D39

Strings

0, xrefs: 00B12D10

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: b346af7e2ed1e8d18b8daa3881d850752934444dfdec599a42a8898bab43f5d1
Instruction ID: e54bb61660b7ffb3f8afdb5dd1b0aa7b467b6140876d09fd7d8431c0b0fca242
Opcode Fuzzy Hash: b346af7e2ed1e8d18b8daa3881d850752934444dfdec599a42a8898bab43f5d1
Instruction Fuzzy Hash: DE11E231D01124ABCF20DB58E884BED77F9EB16300F9401B5ED15AB2A0E770AEA5C7D1

Function 00B222EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B22342
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B2236B

Strings

<local>, xrefs: 00B22333

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 986b9a9407ebf5c1ba1d90117cf94986861181d4468631e4a5dbdf4a5313b6e0
Instruction ID: d1c7adbc7302d547f801283955a66628c4ece04ff5af0be6f818c575adb61ea3
Opcode Fuzzy Hash: 986b9a9407ebf5c1ba1d90117cf94986861181d4468631e4a5dbdf4a5313b6e0
Instruction Fuzzy Hash: BF11CE70501235BEDB28CF119CC5EFAFBE8EB05351F1082AAF94996000D2786980C6F4

Function 00B090C7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00B0AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AEC7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B09135

Strings

ComboBox, xrefs: 00B090D4
ListBox, xrefs: 00B090FF

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: d8d153a4996e6d3ea2b3fffb9fac2054884f89c01bd18c635dcee29f7dbfc0b7
Instruction ID: c5b61a23fa27dcff3c7aeecf0f7d8a9ac1ce0fbe059757850648ee5e1a8b1ea0
Opcode Fuzzy Hash: d8d153a4996e6d3ea2b3fffb9fac2054884f89c01bd18c635dcee29f7dbfc0b7
Instruction Fuzzy Hash: 2501B171A45215ABCB04FBB4CC968FE7BADEF46360B140A99F832672D3DE356908C650

Function 00B08FBF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00B0AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AEC7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00B0902D

Strings

ComboBox, xrefs: 00B08FCC
ListBox, xrefs: 00B08FF7

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 2b8797696d677b3ab8d3da452f0c9867da1968d65f13b951a64db1e7573efa01
Instruction ID: 79bce74e69ab9c3ae5831708a92bccd49ae400ec82e39aa4185422eaef9dc83d
Opcode Fuzzy Hash: 2b8797696d677b3ab8d3da452f0c9867da1968d65f13b951a64db1e7573efa01
Instruction Fuzzy Hash: 8C01F771A41204ABCB14EBB0CD96EFE77ECDF05340F240099B802632D3EE656E08D271

Function 00B09044 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB7F41: _memmove.LIBCMT ref: 00AB7F82

Part of subcall function 00B0AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AEC7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00B090B0

Strings

ComboBox, xrefs: 00B09051
ListBox, xrefs: 00B0907C

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: c2ff9a4a60a4975d1ea1d0fa38fdce24974ac0e00cf58d14ba558f4347071fa9
Instruction ID: 53161fb6ce32a842c27df7e85aef18e8a4b1420d4a6dcf5e2744e7aa3545ea1d
Opcode Fuzzy Hash: c2ff9a4a60a4975d1ea1d0fa38fdce24974ac0e00cf58d14ba558f4347071fa9
Instruction Fuzzy Hash: A801A771A45215A7CB04EA64CD86AFE77EC9F15340F2400957802632D3EE655E089271

Function 00B14FCF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B14FED
_wcscmp.LIBCMT ref: 00B14FFF

Strings

#32770, xrefs: 00B14FF9

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 3230a23a85c101072fbc78999128450e56337b00dc5895907b4838f2a3057e81
Instruction ID: 38ca0c57cbb06be6bf96cc17ae7a6fad72276c3d6000361c8f62cd8d7f7070ae
Opcode Fuzzy Hash: 3230a23a85c101072fbc78999128450e56337b00dc5895907b4838f2a3057e81
Instruction Fuzzy Hash: 7DE0D873A0022D6BD7209B99AC49FA7FBECEB55770F000167FD04D3151E960DA4587E5

Function 00AEB441 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00AEB494: _memset.LIBCMT ref: 00AEB4A1

Part of subcall function 00AD0AC0: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00AEB470,?,?,?,00AB100A), ref: 00AD0AC5

IsDebuggerPresent.KERNEL32(?,?,?,00AB100A), ref: 00AEB474
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00AB100A), ref: 00AEB483

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00AEB47E

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 656c4806e95a9fa82af15635f40c75ad8e47a9a9573857ac1e1d5bf09d69a1c9
Instruction ID: f9400932f01c04b2dc71ab2e0c91f369f3c0dfbef9ad1e0824804d64c37ffdf0
Opcode Fuzzy Hash: 656c4806e95a9fa82af15635f40c75ad8e47a9a9573857ac1e1d5bf09d69a1c9
Instruction Fuzzy Hash: 83E06D746107528FD3309F29D9087477BE4AB04304F0189ADE886C37A2EBB4D448CBA1

Function 00B359CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B359D7
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B359EA

Part of subcall function 00B152EB: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B15363

Strings

Shell_TrayWnd, xrefs: 00B359D0

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 6ec23254df1ab296c6122a29300590c02b66f8860d4fe33dbcb475d7e30d5f0a
Instruction ID: 158a516478ef8d8c953b28c53e552b34ec171946dfddf4604895c5d77c6ffd2f
Opcode Fuzzy Hash: 6ec23254df1ab296c6122a29300590c02b66f8860d4fe33dbcb475d7e30d5f0a
Instruction Fuzzy Hash: 69D0A932780302B6E274AB309C0BFEB2A50FB20B00F100834B246AB0E0CCE0A840C660

Function 00B35A01 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B35A17
PostMessageW.USER32(00000000), ref: 00B35A1E

Part of subcall function 00B152EB: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B15363

Strings

Shell_TrayWnd, xrefs: 00B35A10

Memory Dump Source

Source File: 00000000.00000002.1693515013.0000000000AB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AB0000, based on PE: true

Associated: 00000000.00000002.1693499253.0000000000AB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693563251.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693605618.0000000000B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693623268.0000000000B77000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab0000_z37CurriculumVitaeIsabelGonzalez.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: afe236ba7e14d52cad90f4b7dc29b22b7ef2a4093b8e9fc73c136fb7bf1cbbc0
Instruction ID: 9fe367f1eccd1bd7970ca2fa5f12e777dae690a62f315c2088e1caad4c3cb269
Opcode Fuzzy Hash: afe236ba7e14d52cad90f4b7dc29b22b7ef2a4093b8e9fc73c136fb7bf1cbbc0
Instruction Fuzzy Hash: 01D0C932780712BAE674AB709C0BFEB6655FB64B50F110975B256EB1E0CDE4A840C664

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z37CurriculumVitaeIsabelGonzalez.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Archimago

C:\Users\user\AppData\Local\Temp\aut69DA.tmp

C:\Users\user\AppData\Local\Temp\aut6A77.tmp

C:\Users\user\AppData\Local\Temp\teres

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

Windows Analysis Report
z37CurriculumVitaeIsabelGonzalez.exe

Function 00AB3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00AB4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00AB4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00B191FE Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00AB3023 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 66
windowregistryCOMMON

Function 00AB3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00AB71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00AB3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00AB3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00AB3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 00D18FD0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00AB39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00D18DB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Function 00AB410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00AD558D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE