Edit tour

Windows Analysis Report
1.exe

Overview

General Information

Sample name:	1.exe
Analysis ID:	1582637
MD5:	a2eccd0ac68e32f1763ff60e5b151304
SHA1:	ee8cb670f183d9c38a8c2b40085d160f11fd547b
SHA256:	f29ac22ca60872b1edd94e2411007f37b5cf814a3b3a85df6b162c94c92a3dd5
Tags:	DonutLoaderexeValleyRATuser-lontze7
Infos:

Detection

GhostRat

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected GhostRat

AI detected suspicious sample

Contain functionality to detect virtual machines

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Sigma detected: Potentially Suspicious Malware Callback Communication

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a global mouse hook

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

1.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\1.exe" MD5: A2ECCD0AC68E32F1763FF60E5B151304)

WerFault.exe (PID: 7520 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1416 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1.exe	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x18a1b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1658022811.00000000001AE000.00000008.00000001.01000000.00000003.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2d3b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x283b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: 1.exe PID: 7344	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.1.exe.50000.0.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x18a1b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0.2.1.exe.50000.0.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x18a1b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 124.156.117.13, DestinationIsIpv6: false, DestinationPort: 7777, EventID: 3, Image: C:\Users\user\Desktop\1.exe, Initiated: true, ProcessId: 7344, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1.exe	Virustotal: Detection: 45%			Perma Link
Source: 1.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\1.exe

Unpacked PE file: 0.2.1.exe.3160000.1.unpack

Source: 1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0006939A __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,

0_2_0006939A

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 124.156.117.13:7777

Source: Joe Sandbox View

ASN Name: TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN

Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_031615C0 recv,select,recv,

0_2_031615C0

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_000B6712 __EH_prolog3_catch_GS,CreateCompatibleDC,CreateCompatibleBitmap,FillRect,OpenClipboard,EmptyClipboard,CloseClipboard,SetClipboardData,CloseClipboard,

0_2_000B6712

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0316AA00 CreateMutexW,GetLastError,_memset,lstrlenW,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,_memmove,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,lstrlenW,_memset,wsprintfW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

0_2_0316AA00

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_03167F30 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,_memmove,DeleteObject,DeleteObject,ReleaseDC,_memmove,DeleteObject,DeleteObject,ReleaseDC,

0_2_03167F30

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_000FC056 GetParent,KillTimer,KillTimer,SetRectEmpty,GetAsyncKeyState,ScreenToClient,KillTimer,

0_2_000FC056

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0316A6D0 CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,

0_2_0316A6D0

Source: C:\Users\user\Desktop\1.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000E8144 ScreenToClient,_memset,_free,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,	0_2_000E8144
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000805D8 SendMessageW,UpdateWindow,GetKeyState,GetKeyState,GetKeyState,GetParent,PostMessageW,	0_2_000805D8
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000D87A3 __EH_prolog3_GS,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetParent,SendMessageW,_memset,ScreenToClient,_memset,GetCursorPos,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetWindowPos,SendMessageW,_memset,_free,SendMessageW,GetParent,	0_2_000D87A3
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000AC98F GetParent,GetKeyState,GetKeyState,GetKeyState,SendMessageW,SendMessageW,SendMessageW,	0_2_000AC98F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0008AB3A IsWindow,SendMessageW,GetCapture,GetKeyState,GetKeyState,GetKeyState,ImmGetContext,ImmGetOpenStatus,ImmReleaseContext,GetFocus,IsWindow,IsWindow,IsWindow,ClientToScreen,IsWindow,ClientToScreen,	0_2_0008AB3A
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C4C24 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	0_2_000C4C24
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00088CC8 IsWindow,SendMessageW,GetCapture,GetKeyState,GetKeyState,GetKeyState,ImmGetContext,ImmGetOpenStatus,ImmReleaseContext,GetFocus,IsWindow,IsWindow,IsWindow,ClientToScreen,IsWindow,ClientToScreen,	0_2_00088CC8
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0005F717 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,	0_2_0005F717
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000F373B GetWindowRect,GetKeyState,GetKeyState,GetKeyState,KillTimer,GetFocus,SetTimer,	0_2_000F373B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000D7C12 GetKeyState,GetKeyState,GetKeyState,GetTickCount,SetCapture,PeekMessageW,GetCapture,PeekMessageW,PeekMessageW,PtInRect,GetTickCount,ReleaseCapture,	0_2_000D7C12
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000DDC2D GetKeyState,GetKeyState,GetKeyState,	0_2_000DDC2D
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000ABDCF MessageBeep,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,	0_2_000ABDCF

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.exe, type: SAMPLE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0.0.1.exe.50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0.2.1.exe.50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000000.1658022811.00000000001AE000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_03164110 lstrlenW,CoInitialize,CoCreateInstance,NtProtectVirtualMemory,swprintf,

0_2_03164110

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03167941 ExitWindowsEx,	0_2_03167941
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03167972 ExitWindowsEx,	0_2_03167972
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_031679A3 ExitWindowsEx,	0_2_031679A3

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0014C0F3	0_2_0014C0F3
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000CE3B0	0_2_000CE3B0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00090A4A	0_2_00090A4A
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00076D33	0_2_00076D33
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000E2E0B	0_2_000E2E0B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C0EBB	0_2_000C0EBB
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0009F174	0_2_0009F174
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00149416	0_2_00149416
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000CF621	0_2_000CF621
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0015798C	0_2_0015798C
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000BFE1F	0_2_000BFE1F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0006DE82	0_2_0006DE82
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000CFF70	0_2_000CFF70
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03163D60	0_2_03163D60
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_031803A1	0_2_031803A1
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03180A7D	0_2_03180A7D
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0317AF11	0_2_0317AF11
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03165530	0_2_03165530
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03179A63	0_2_03179A63
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0316D850	0_2_0316D850
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0317F8FF	0_2_0317F8FF
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0317FE50	0_2_0317FE50
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03181DB1	0_2_03181DB1
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AC6AB0	0_2_02AC6AB0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AC29A0	0_2_02AC29A0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AD37E1	0_2_02AD37E1
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AD7541	0_2_02AD7541
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AD7A92	0_2_02AD7A92
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AD1916	0_2_02AD1916
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AD995C	0_2_02AD995C
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AD7FE3	0_2_02AD7FE3
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0356D20F	0_2_0356D20F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0357F2BE	0_2_0357F2BE
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0357F80F	0_2_0357F80F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0357A8D0	0_2_0357A8D0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03581770	0_2_03581770
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0356371F	0_2_0356371F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03564EEF	0_2_03564EEF
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0357FD60	0_2_0357FD60
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03579422	0_2_03579422

Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00148B33 appears 521 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 03174D50 appears 31 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00148D20 appears 42 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00148B9C appears 170 times

Source: C:\Users\user\Desktop\1.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1416

Source: 1.exe, 00000000.00000000.1658049777.00000000001E6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTODO: <360>8 vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenameTODO: <360>8 vs 1.exe

Source: 1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.exe, type: SAMPLE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0.0.1.exe.50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0.2.1.exe.50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000000.1658022811.00000000001AE000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal92.troj.evad.winEXE@2/5@0/2

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03164640 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	0_2_03164640
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03164520 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	0_2_03164520
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03164A70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_03164A70

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_03163D60 MultiByteToWideChar,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

0_2_03163D60

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_00051410 CreateToolhelp32Snapshot,Process32FirstW,__wcsicoll,Process32NextW,CloseHandle,

0_2_00051410

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_00066D30 CoInitialize,CoCreateInstance,

0_2_00066D30

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0005810C FindResourceW,LoadResource,LockResource,FreeResource,

0_2_0005810C

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7344
Source: C:\Users\user\Desktop\1.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12.25

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\11e2ced0-b9ce-4e4b-b789-2c23ce048de8

Jump to behavior

Source: 1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1.exe	Virustotal: Detection: 45%
Source: 1.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\1.exe

File read: C:\Users\user\Desktop\1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"
Source: C:\Users\user\Desktop\1.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1416

Source: C:\Users\user\Desktop\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dxcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7B70EE0-4340-11CF-B063-0020AFC2CD35}\InprocServer32

Jump to behavior

Source: 1.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 1.exe

Static file information: File size 1874432 > 1048576

Source: 1.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x11ac00

Source: 1.exe

Static PE information: More than 200 imports for USER32.dll

Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\1.exe

Unpacked PE file: 0.2.1.exe.3160000.1.unpack

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0014FAAC DecodePointer,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,GetLastError,EncodePointer,InterlockedExchange,FreeLibrary,

0_2_0014FAAC

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00148C0B push ecx; ret	0_2_00148C1E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00148D65 push ecx; ret	0_2_00148D78
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0318443D push ebp; retf	0_2_031844F4
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_031844BC push ebp; retf	0_2_031844F4
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_031844F0 push ebp; retf	0_2_031844F4
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03174D95 push ecx; ret	0_2_03174DA8
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02ACD495 push ecx; ret	0_2_02ACD4A8
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03574754 push ecx; ret	0_2_03574767
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03576C69 push esp; iretd	0_2_03576C70

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00086268 SetForegroundWindow,IsIconic,	0_2_00086268
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0008630C IsIconic,	0_2_0008630C
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C659B IsWindow,IsWindowVisible,GetWindowRect,PtInRect,GetAsyncKeyState,ScreenToClient,IsWindow,IsWindow,IsWindow,GetWindowRect,PtInRect,SendMessageW,PtInRect,SendMessageW,ScreenToClient,PtInRect,GetParent,SendMessageW,GetFocus,WindowFromPoint,SendMessageW,GetSystemMenu,IsMenu,EnableMenuItem,EnableMenuItem,EnableMenuItem,IsZoomed,IsIconic,EnableMenuItem,TrackPopupMenu,SendMessageW,	0_2_000C659B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000F094D GetParent,GetParent,IsIconic,GetParent,	0_2_000F094D
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00080DD9 IsWindowVisible,IsIconic,	0_2_00080DD9
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C7160 IsIconic,PostMessageW,	0_2_000C7160
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C51EF IsWindow,GetFocus,IsChild,SendMessageW,IsChild,SendMessageW,IsIconic,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,IsWindowVisible,	0_2_000C51EF
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00071906 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	0_2_00071906
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C5C7E GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_000C5C7E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C5C7E GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_000C5C7E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C5C7E GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_000C5C7E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_000C5F7E IsWindowVisible,ScreenToClient,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetSystemMetrics,PtInRect,GetSystemMetrics,PtInRect,GetSystemMetrics,PtInRect,	0_2_000C5F7E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0009BFF7 GetClientRect,IsRectEmpty,IsIconic,BeginDeferWindowPos,GetClientRect,IsRectEmpty,IsRectEmpty,EqualRect,GetWindowRect,GetParent,EndDeferWindowPos,	0_2_0009BFF7

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_03167893 OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_03167893

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_00067E35 __EH_prolog3_GS,GetDeviceCaps,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,_memset,GetTextCharsetInfo,lstrcpyW,lstrcpyW,EnumFontFamiliesW,EnumFontFamiliesW,lstrcpyW,EnumFontFamiliesW,lstrcpyW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,GetSystemMetrics,lstrcpyW,CreateFontIndirectW,GetStockObject,GetStockObject,GetObjectW,GetObjectW,lstrcpyW,CreateFontIndirectW,CreateFontIndirectW,GetStockObject,GetObjectW,CreateFontIndirectW,CreateFontIndirectW,__EH_prolog3_GS,GetVersionExW,KiUserCallbackDispatcher,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00067E35

Source: C:\Users\user\Desktop\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\1.exe

Code function: C:\Program Files\VMware\VMware Tools\ VMware

0_2_03164420

Source: C:\Users\user\Desktop\1.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-127830

Source: C:\Users\user\Desktop\1.exe

API coverage: 5.5 %

Source: C:\Users\user\Desktop\1.exe TID: 7436

Thread sleep time: -50000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\1.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0006939A __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,

0_2_0006939A

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0014CA47 VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

0_2_0014CA47

Source: C:\Users\user\Desktop\1.exe

Thread delayed: delay time: 50000

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 1.exe, 00000000.00000002.1954328767.00000000034B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\VMware\VMware Tools\
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 1.exe, 00000000.00000002.1953694777.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 1.exe, 00000000.00000002.1954328767.00000000034B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ~/%s%d/None/%sHDD:%dWW %d Gb Free %d Gb Mem: %d Gb %sFree%d Gb %s-%d8herrorDriverDescSYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000%s >fX[:%d MGetNativeSystemInfontdll.dllRtlGetNtVersionNumbers%d.%d.%dSOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameC:\Program Files\VMware\VMware Tools\VMwareSeDebugPrivilegeNtSetInformationProcessNtDll.dllWindows\SysWOW64\svchost.exe%s%sWindows\System32\svchost.exeOpenProcessKernel32.dllExitProcessWinExecWaitForSingleObjectwininet.dllInternetOpenWMSIE 6.0InternetOpenUrlWInternetReadFileInternetCloseHandleinvalid string positionstring too long
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\1.exe	API call chain: ExitProcess graph end node			graph_0-127469
Source: C:\Users\user\Desktop\1.exe	API call chain: ExitProcess graph end node			graph_0-126446

Source: C:\Users\user\Desktop\1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0014F4CB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0014F4CB

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0014CA47 VirtualProtect ?,-00000001,00000104,?

0_2_0014CA47

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0014FAAC DecodePointer,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,GetLastError,EncodePointer,InterlockedExchange,FreeLibrary,

0_2_0014FAAC

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_035600CD mov eax, dword ptr fs:[00000030h]

0_2_035600CD

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_031837A9 GetProcessHeap,

0_2_031837A9

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0014F4CB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0014F4CB
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00147629 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00147629
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0317403B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0317403B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_03169DF0 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,Sleep,EnumWindows,EnumWindows,Sleep,EnumWindows,CreateEventA,Sleep,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,	0_2_03169DF0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0317112F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0317112F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AC3840 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	0_2_02AC3840
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02ACA37F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02ACA37F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02ACC8AB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02ACC8AB
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02ACF749 SetUnhandledExceptionFilter,	0_2_02ACF749

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_031646E0 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,

0_2_031646E0

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\1.exe

0_2_031646E0

Source: C:\Users\user\Desktop\1.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe		0_2_031646E0
Source: C:\Users\user\Desktop\1.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe		0_2_031646E0

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_03162320 _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetSystemInfo,wsprintfW,wsprintfW,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,GetLocalTime,wsprintfW,GetLocaleInfoW,_memset,EnumDisplayMonitors,GetSystemDirectoryW,GetCurrentHwProfileW,

0_2_03162320

Source: C:\Users\user\Desktop\1.exe	Code function: GetLocaleInfoW,__snwprintf_s,LoadLibraryW,	0_2_000549C6
Source: C:\Users\user\Desktop\1.exe	Code function: __EH_prolog3_GS,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetNumberFormatW,GetLocaleInfoW,lstrlenW,	0_2_000A18C0
Source: C:\Users\user\Desktop\1.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetSystemInfo,wsprintfW,wsprintfW,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,GetLocalTime,wsprintfW,GetLocaleInfoW,_memset,EnumDisplayMonitors,GetSystemDirectoryW,GetCurrentHwProfileW,	0_2_03162320

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0014E528 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0014E528

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_001547F0 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_001547F0

Source: C:\Users\user\Desktop\1.exe

0_2_00067E35

Source: 1.exe	Binary or memory string: acs.exe
Source: 1.exe	Binary or memory string: vsserv.exe
Source: 1.exe	Binary or memory string: kxetray.exe
Source: 1.exe	Binary or memory string: avcenter.exe
Source: 1.exe	Binary or memory string: KSafeTray.exe
Source: 1.exe	Binary or memory string: cfp.exe
Source: 1.exe	Binary or memory string: avp.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: 1.exe	Binary or memory string: 360Safe.exe
Source: 1.exe	Binary or memory string: 360tray.exe
Source: 1.exe	Binary or memory string: rtvscan.exe
Source: 1.exe	Binary or memory string: ashDisp.exe
Source: 1.exe	Binary or memory string: TMBMSRV.exe
Source: 1.exe	Binary or memory string: 360Tray.exe
Source: 1.exe	Binary or memory string: avgwdsvc.exe
Source: 1.exe	Binary or memory string: AYAgent.aye
Source: 1.exe	Binary or memory string: QUHLPSVC.EXE
Source: 1.exe	Binary or memory string: RavMonD.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe
Source: 1.exe	Binary or memory string: Mcshield.exe
Source: 1.exe	Binary or memory string: K7TSecurity.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: 1.exe PID: 7344, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: 1.exe PID: 7344, type: MEMORYSTR

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0316EBA0 bind,htons,bind,		0_2_0316EBA0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AC7DF0 bind,htons,bind,		0_2_02AC7DF0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	41 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	211 Process Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	41 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	16 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Indicator Removal	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1.exe	45%	Virustotal		Browse
1.exe	63%	ReversingLabs	Win32.Exploit.DonutMarte

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
124.156.117.13	unknown	Singapore		132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true

Private

IP
192.168.1.2

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582637
Start date and time:	2024-12-31 08:20:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@2/5@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 123 Number of non-executed functions: 314
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 40.126.32.133, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
02:20:56	API Interceptor	2x Sleep call for process: 1.exe modified
02:21:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	botx.sh4.elf	Get hash	malicious	Mirai	Browse	129.226.178.103
	DOTA2#U89c6#U8ddd#U63d2#U4ef6.exe	Get hash	malicious	Unknown	Browse	203.205.136.80
	xd.mips.elf	Get hash	malicious	Mirai	Browse	162.63.47.5
	armv5l.elf	Get hash	malicious	Mirai	Browse	101.32.4.151
	Audio02837498.html	Get hash	malicious	HTMLPhisher	Browse	170.106.97.198
	splarm5.elf	Get hash	malicious	Unknown	Browse	101.33.176.214
	splmips.elf	Get hash	malicious	Unknown	Browse	162.63.67.56
	jklx86.elf	Get hash	malicious	Unknown	Browse	101.32.48.91
	nabarm5.elf	Get hash	malicious	Unknown	Browse	101.48.142.50
	armv7l.elf	Get hash	malicious	Unknown	Browse	124.157.210.224

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1.exe_2262233b1c4a664c14445ff2c18db8ed6a66_c1a861f5_ce72d914-4322-4cd4-93a0-02a51ba4f189\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0634783812485191
Encrypted:	false
SSDEEP:	192:mSp9hd66Zc0HR6iCjjeLZrHkFrgKzuiFVZ24IO8Y:DzhgcXHR6iCj0KzuiFVY4IO8Y
MD5:	23B0671AC439F643AEA1A13C1ABDBC51
SHA1:	087A71BADC91C38B3326FD05831BAAE658333FDB
SHA-256:	A4A931DAC9DBB9A0F6C7F53AC4EA8B1047D4FF73F74F4F71B4FA44945873638A
SHA-512:	B45902215595AA141482BEC6183928B74551807DB344397A23DBF7EE0B2DDE15FFE59D7116432B79245011E21138B346A47726215070ACC89303884D59CF12BF
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.1.0.3.2.6.2.9.8.7.4.4.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.1.0.3.2.6.3.4.6.6.4.5.0.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.e.7.2.d.9.1.4.-.4.3.2.2.-.4.c.d.4.-.9.3.a.0.-.0.2.a.5.1.b.a.4.f.1.8.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.7.c.c.7.f.2.-.a.2.2.d.-.4.a.b.e.-.a.b.8.f.-.a.c.2.f.9.0.2.2.c.c.c.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.O.D.O.:. .<.3.6.0.>.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.b.0.-.0.0.0.1.-.0.0.1.4.-.5.9.5.a.-.5.1.8.8.5.4.5.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.6.5.5.2.7.c.4.c.b.4.3.8.d.c.6.2.5.a.4.4.8.1.e.3.a.9.6.8.3.0.6.0.0.0.0.0.4.0.8.!.0.0.0.0.e.e.8.c.b.6.7.0.f.1.8.3.d.9.c.3.8.a.8.c.2.b.4.0.0.8.5.d.1.6.0.f.1.1.f.d.5.4.7.b.!.1...e.x.e.....T.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CE9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Dec 31 07:21:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	152582
Entropy (8bit):	1.83683695026491
Encrypted:	false
SSDEEP:	768:ilHGwUfJBZb0sBgm/qK2zft50u2ZhZj+Bp8UgXnXGK/:qm39v/q3zf/8WK
MD5:	FE8AECC572A7FEC7092876C67BCF3844
SHA1:	6AC408E0840CAADC367077E8089C998048C6F492
SHA-256:	E3757EA72FAEEF20B7957F5927F73F7D861794CEAE6273BCA2DCA06939E2DD56
SHA-512:	92A072306F38CB2DD582B03D4C3535DB447D046BAB441D2DB20EE48D4DEB0148721E7931CEA25CB57320E35018CE8C4BD8235F8F66A16F78481CB4D92AD79227
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ......._.sg....................................$....$......d....[..........`.......8...........T............6..F............%...........&..............................................................................eJ.......'......GenuineIntel............T...........W.sg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E04.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.6963346370593766
Encrypted:	false
SSDEEP:	192:R6l7wVeJkR666Y9FSUwTgmf2ttWprS89boKsfV4m:R6lXJi666YfSUwTgmf2tSopfP
MD5:	C12DB8F132ED2D776E2E0BBBC510C123
SHA1:	CA2C68ED79E91166C70C951D36F0C4B839C1120B
SHA-256:	935EA047C4D833F254D585E9EFC16C4012286FBE2D56592D0AC526C8CCC5B0E6
SHA-512:	6598C26879FF03412C34D8181571DA555669B30CB98A538F457EB5C3FF5154AA9925EAABE05C7CACC5CF2A2EAA4C9A3742DEB06A96D01B8F811271C61586306F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E33.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4745
Entropy (8bit):	4.461088465802109
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnkJg77aI9V/SWpW8VYNYm8M4JuoF0+q8vG/R8qT1Wrd:uIjfiI7r77VRJCKi8eErd
MD5:	2285A95A418DA37CC9045F63167B6750
SHA1:	381DFD3219B8F6CF1D72879AFBBB2B8AFD0123B3
SHA-256:	C2B76753DCAC8E358CB3237A9F81EA15F71547DB33AE6280B55ADF444CE1D981
SHA-512:	2A7EED98053EF00E32409FAA5FB01B9A8AFC9869C159B2CEB746EF915918820B1003FB4C9BEDF14C1FEC1B1A24FCD161E3373DC7E32D7F60910533FC623E6E1F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="655103" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465520975444696
Encrypted:	false
SSDEEP:	6144:3IXfpi67eLPU9skLmb0b4gWSPKaJG8nAgejZMMhA2gX4WABl0uNkdwBCswSb2:4XD94gWlLZMM6YFH6+2
MD5:	CB661BA798BF3EEA112BC295EF72515F
SHA1:	7416E7BDCF2E0F623CBEE980867C2EB169CB6937
SHA-256:	EDBA5535E971702B3E19F4B7A5D82958C4AC4B62F1A9B4FFE112D4274A9C70AF
SHA-512:	F24A944A931EFAF9E9918B72759B90DEAFBFE7AFB68A58A6504AF1A27940CDB20F7A2220D6FFABA2B06240CD6E3B2326B0362FB30C8B60064BEA1584F0D61BFE
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..o.T[..............................................................................................................................................................................................................................................................................................................................................dhx.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.649482194453071
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1.exe
File size:	1'874'432 bytes
MD5:	a2eccd0ac68e32f1763ff60e5b151304
SHA1:	ee8cb670f183d9c38a8c2b40085d160f11fd547b
SHA256:	f29ac22ca60872b1edd94e2411007f37b5cf814a3b3a85df6b162c94c92a3dd5
SHA512:	86de5d8f3d9fef2a436bc36c9178f6f030ba006a71a86bb30ce9df0e4eefb4b9fa71fa596c64bde7d231417c75d33410dde2c2855e45809b9b727b54a03e8985
SSDEEP:	49152:RrwObw+yBXDMjmS/vVLdVlxl/z5MP/m2Y8H9W0AORUbwLwA6/TFmSfy:2ObwnBsmEVLdfxl/z5MPO8H9W7ORUbXd
TLSH:	0A85AE3A3A919077C1333234558DF3BAF2AEA5314D38565766911F3C3E358A2992C3AF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................................(.......).................U.....-.....................Rich....................PE..L....vkg...

File Icon


Icon Hash:	9e1f191f6777733a

Static PE Info

General

Entrypoint:	0x4f761f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676B7696 [Wed Dec 25 03:05:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	1d827ad5ca3aef28dfe0cea19c081a23

Entrypoint Preview

Instruction
call 00007F4DF47FED09h
jmp 00007F4DF47F7C8Eh
cmp ecx, dword ptr [005625E0h]
jne 00007F4DF47F7E04h
rep ret
jmp 00007F4DF47FED90h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword ptr [0051C290h]
push edi
push dword ptr [005957A8h]
call esi
push dword ptr [005957A4h]
mov ebx, eax
mov dword ptr [ebp-04h], ebx
call esi
mov esi, eax
cmp esi, ebx
jc 00007F4DF47F7E87h
mov edi, esi
sub edi, ebx
lea eax, dword ptr [edi+04h]
cmp eax, 04h
jc 00007F4DF47F7E77h
push ebx
call 00007F4DF47FB674h
mov ebx, eax
lea eax, dword ptr [edi+04h]
pop ecx
cmp ebx, eax
jnc 00007F4DF47F7E4Ah
mov eax, 00000800h
cmp ebx, eax
jnc 00007F4DF47F7E04h
mov eax, ebx
add eax, ebx
cmp eax, ebx
jc 00007F4DF47F7E11h
push eax
push dword ptr [ebp-04h]
call 00007F4DF47FEEC3h
pop ecx
pop ecx
test eax, eax
jne 00007F4DF47F7E18h
lea eax, dword ptr [ebx+10h]
cmp eax, ebx
jc 00007F4DF47F7E40h
push eax
push dword ptr [ebp-04h]
call 00007F4DF47FEEADh
pop ecx
pop ecx
test eax, eax
je 00007F4DF47F7E31h
sar edi, 02h
push eax
lea esi, dword ptr [eax+edi*4]
call dword ptr [0051C294h]
mov dword ptr [005957A8h], eax
push dword ptr [ebp+08h]
mov edi, dword ptr [0051C294h]
call edi
mov dword ptr [esi], eax
add esi, 04h
push esi
call edi
mov dword ptr [005957A4h], eax
mov eax, dword ptr [ebp+08h]
jmp 00007F4DF47F7E04h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15ab58	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x196000	0x14020	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1ab000	0x19964	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11ccd0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1457b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11c000	0x908	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11ab56	0x11ac00	81f07ad9401bb030f6fd4b22bfc8020d	False	0.5604173574270557	data	6.522543309935167	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11c000	0x41c80	0x41e00	53ba3f6835c1465c9f6599c95a09247d	False	0.2668665500474383	data	4.99171438264604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x15e000	0x377bc	0x30200	0925c3d4d81457481990a402b0e891aa	False	0.896190137987013	data	7.817358833843515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x196000	0x14020	0x14200	0d1402167d2e62a9452ff3195ff8375e	False	0.7321549883540373	data	6.846851273620952	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1ab000	0x28678	0x28800	b766fbb210faa4b699434a30410c6ed0	False	0.26442539544753085	data	4.952802281401289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x196d78	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x196eac	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x196f60	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x197094	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x1971c8	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x1972fc	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x197430	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x197564	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x197698	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1977cc	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x197900	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x197a34	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x197b68	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x197c9c	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x197dd0	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x197f04	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x198038	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x1980f0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x198234	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	Chinese	China	0.5335365853658537
RT_ICON	0x19889c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Chinese	China	0.646505376344086
RT_ICON	0x198b84	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	Chinese	China	0.6598360655737705
RT_ICON	0x198d6c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Chinese	China	0.6385135135135135
RT_ICON	0x198e94	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Chinese	China	0.6260660980810234
RT_ICON	0x199d3c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.7793321299638989
RT_ICON	0x19a5e4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Chinese	China	0.8231566820276498
RT_ICON	0x19acac	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Chinese	China	0.6575144508670521
RT_ICON	0x19b214	0x93cb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9988106250825954
RT_ICON	0x1a45e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.5116182572614107
RT_ICON	0x1a6b88	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.6109287054409006
RT_ICON	0x1a7c30	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Chinese	China	0.6221311475409836
RT_ICON	0x1a85b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.7402482269503546
RT_DIALOG	0x1a8a20	0x120	data	Chinese	China	0.6145833333333334
RT_DIALOG	0x1a8b40	0xd8	data	Chinese	China	0.7268518518518519
RT_DIALOG	0x1a8c18	0xe2	data	Chinese	China	0.6769911504424779
RT_DIALOG	0x1a8cfc	0x34	data	Chinese	China	0.8653846153846154
RT_STRING	0x1a8d30	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x1a8d74	0x4e	data	Chinese	China	0.8461538461538461
RT_STRING	0x1a8dc4	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x1a8df0	0x84	data	Chinese	China	0.9166666666666666
RT_STRING	0x1a8e74	0x1c4	data	Chinese	China	0.8053097345132744
RT_STRING	0x1a9038	0x14e	data	Chinese	China	0.5179640718562875
RT_STRING	0x1a9188	0x10e	data	Chinese	China	0.7037037037037037
RT_STRING	0x1a9298	0x50	data	Chinese	China	0.7125
RT_STRING	0x1a92e8	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x1a932c	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x1a9394	0x1b2	data	Chinese	China	0.6474654377880185
RT_STRING	0x1a9548	0xf4	data	Chinese	China	0.6065573770491803
RT_STRING	0x1a963c	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x1a9660	0x1a6	data	Chinese	China	0.6658767772511849
RT_GROUP_CURSOR	0x1a9808	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x1a982c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9840	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9854	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9868	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a987c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9890	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9908	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a991c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9930	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x1a9944	0xbc	data	Chinese	China	0.6117021276595744
RT_VERSION	0x1a9a00	0x2bc	data	Chinese	China	0.4542857142857143
RT_MANIFEST	0x1a9cbc	0x362	ASCII text, with very long lines (866), with no line terminators	English	United States	0.4515011547344111

Imports

DLL	Import
KERNEL32.dll	IsDebuggerPresent, IsProcessorFeaturePresent, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetStringTypeW, GetTimeZoneInformation, LCMapStringW, GetConsoleCP, GetConsoleMode, UnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, HeapCreate, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStdHandle, SetUnhandledExceptionFilter, GetFileType, SetStdHandle, VirtualQuery, GetSystemInfo, WriteConsoleW, SetEnvironmentVariableA, FindResourceW, LoadResource, LockResource, SizeofResource, GetModuleFileNameW, CreateThread, VirtualAlloc, GetSystemTimeAsFileTime, HeapSize, HeapQueryInformation, HeapReAlloc, RaiseException, ExitThread, RtlUnwind, ExitProcess, HeapAlloc, HeapFree, DecodePointer, EncodePointer, GetStartupInfoW, HeapSetInformation, GetCommandLineW, FindResourceExW, SearchPathW, GetProfileIntW, GetTickCount, InitializeCriticalSectionAndSpinCount, GetNumberFormatW, GetWindowsDirectoryW, GetTempPathW, GetTempFileNameW, GetFileTime, GetFileSizeEx, GetFileAttributesW, FileTimeToLocalFileTime, GetFileAttributesExW, SetErrorMode, FileTimeToSystemTime, lstrlenA, GlobalGetAtomNameW, GetFullPathNameW, GetVolumeInformationW, FindFirstFileW, FindClose, GetCurrentProcess, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, CreateFileW, lstrcmpiW, lstrcpyW, DeleteFileW, InterlockedIncrement, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GlobalFlags, GetCurrentDirectoryW, GlobalFindAtomW, GetVersionExW, CompareStringW, InterlockedDecrement, ReleaseActCtx, CreateActCtxW, CopyFileW, GlobalSize, FormatMessageW, LocalFree, MulDiv, GlobalUnlock, GlobalFree, FreeResource, GetCurrentProcessId, GlobalAddAtomW, GetPrivateProfileStringW, lstrlenW, WritePrivateProfileStringW, GetPrivateProfileIntW, WaitForSingleObject, ResumeThread, SetThreadPriority, lstrcmpA, GlobalDeleteAtom, GetCurrentThread, GetCurrentThreadId, GetUserDefaultUILanguage, ConvertDefaultLocale, GetSystemDefaultUILanguage, GetLocaleInfoW, ActivateActCtx, LoadLibraryW, GetLastError, DeactivateActCtx, SetLastError, MultiByteToWideChar, WideCharToMultiByte, GlobalLock, lstrcmpW, GlobalAlloc, GetModuleHandleW, GetProcAddress, InterlockedExchange, FreeLibrary, TerminateThread, Sleep, CloseHandle, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot, VirtualProtect
USER32.dll	RegisterClipboardFormatW, FrameRect, CopyIcon, CharUpperBuffW, PostThreadMessageW, GetKeyNameTextW, DefFrameProcW, DefMDIChildProcW, DrawMenuBar, HideCaret, InvertRect, LockWindowUpdate, SetCursorPos, SetRect, CreateAcceleratorTableW, GetKeyboardState, GetKeyboardLayout, MapVirtualKeyW, ToUnicodeEx, CopyAcceleratorTableW, TranslateMDISysAccel, DrawFrameControl, DrawIconEx, SetClassLongW, DestroyAcceleratorTable, SetParent, UnpackDDElParam, ReuseDDElParam, LoadImageW, LoadAcceleratorsW, InsertMenuItemW, BringWindowToTop, TranslateAcceleratorW, UnregisterClassW, GetMenuDefaultItem, SetMenuDefaultItem, CreatePopupMenu, IsMenu, MonitorFromPoint, UpdateLayeredWindow, EnableScrollBar, EmptyClipboard, IsRectEmpty, IsZoomed, GetAsyncKeyState, NotifyWinEvent, MessageBeep, RedrawWindow, SetWindowRgn, LoadMenuW, OffsetRect, IntersectRect, CharUpperW, DestroyIcon, GetSysColorBrush, SetLayeredWindowAttributes, EnumDisplayMonitors, SetRectEmpty, KillTimer, SetTimer, RealChildWindowFromPoint, DeleteMenu, WaitMessage, ReleaseCapture, LoadCursorW, WindowFromPoint, SetCapture, ShowWindow, MoveWindow, SetWindowTextW, IsDialogMessageW, CheckDlgButton, RegisterWindowMessageW, SendDlgItemMessageW, SendDlgItemMessageA, WinHelpW, IsChild, CloseClipboard, SetClipboardData, OpenClipboard, GetNextDlgGroupItem, CopyImage, UnionRect, GetIconInfo, CreateMenu, IsClipboardFormatAvailable, GetUpdateRect, GetDoubleClickTime, IsCharLowerW, MapVirtualKeyExW, SubtractRect, DestroyCursor, MapDialogRect, DrawFocusRect, GetCapture, GetClassLongW, SetPropW, GetPropW, RemovePropW, GetWindowRgn, DrawEdge, GetKeyState, EnableWindow, DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, SendMessageW, AppendMenuW, GetSystemMenu, LoadIconW, PostMessageW, PostQuitMessage, CheckMenuItem, EnableMenuItem, GetMenuState, ModifyMenuW, GetParent, GetFocus, LoadBitmapW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, ValidateRect, GetCursorPos, PeekMessageW, IsWindowVisible, GetActiveWindow, DispatchMessageW, TranslateMessage, GetMessageW, CallNextHookEx, SetWindowsHookExW, SetCursor, ShowOwnedPopups, MessageBoxW, IsWindowEnabled, GetLastActivePopup, GetWindowLongW, GetWindowThreadProcessId, DrawStateW, FillRect, UpdateWindow, InvalidateRect, GetClassNameW, EndDialog, GetNextDlgTabItem, GetDlgItem, IsWindow, DestroyWindow, CreateDialogIndirectParamW, SetActiveWindow, GetDesktopWindow, RemoveMenu, GetSubMenu, GetMenuItemCount, InsertMenuW, GetMenuItemID, GetMenuStringW, TabbedTextOutW, DrawTextW, DrawTextExW, GrayStringW, ScreenToClient, ClientToScreen, GetDC, ReleaseDC, GetWindowDC, BeginPaint, EndPaint, GetSysColor, PtInRect, GetWindowRect, UnhookWindowsHookEx, CopyRect, InflateRect, GetMenuItemInfoW, DestroyMenu, SystemParametersInfoW, GetWindow, SetWindowPos, SetWindowLongW, GetMenu, CallWindowProcW, DefWindowProcW, GetDlgCtrlID, GetWindowPlacement, SetWindowPlacement, SetScrollInfo, GetScrollInfo, DeferWindowPos, EqualRect, AdjustWindowRectEx, RegisterClassW, GetClassInfoW, GetClassInfoExW, CreateWindowExW, ShowScrollBar, SetForegroundWindow, GetScrollPos, SetScrollPos, GetScrollRange, SetScrollRange, SetMenu, TrackPopupMenu, ScrollWindow, MapWindowPoints, GetMonitorInfoW, MonitorFromWindow, GetMessagePos, GetMessageTime, GetTopWindow, EndDeferWindowPos, BeginDeferWindowPos, GetForegroundWindow, GetWindowTextW, GetWindowTextLengthW, SetFocus
GDI32.dll	GetStockObject, GetDeviceCaps, CopyMetaFileW, CreateDCW, SaveDC, RestoreDC, SetBkColor, SetBkMode, SetPolyFillMode, SetROP2, SetTextColor, SetMapMode, GetClipBox, ExcludeClipRect, IntersectClipRect, LineTo, MoveToEx, SetTextAlign, GetLayout, SetLayout, SelectClipRgn, CreateRectRgn, GetViewportExtEx, GetWindowExtEx, BitBlt, GetPixel, PtVisible, RectVisible, TextOutW, ExtTextOutW, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, OffsetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, DeleteDC, GetObjectW, CreatePatternBrush, CreateCompatibleDC, CreateSolidBrush, GetObjectType, CreatePen, CreateHatchBrush, CreateFontIndirectW, GetTextExtentPoint32W, CreateDIBitmap, CreateCompatibleBitmap, CreateRectRgnIndirect, GetTextMetricsW, EnumFontFamiliesW, GetTextCharsetInfo, SetRectRgn, CombineRgn, PatBlt, DPtoLP, CreateRoundRectRgn, CreateDIBSection, CreatePolygonRgn, GetBkColor, GetTextColor, CreateEllipticRgn, Polyline, Ellipse, Polygon, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, RealizePalette, GetSystemPaletteEntries, OffsetRgn, GetRgnBox, SetDIBColorTable, StretchBlt, SetPixel, Rectangle, EnumFontFamiliesExW, ExtFloodFill, SetPaletteEntries, LPtoDP, GetWindowOrgEx, GetViewportOrgEx, PtInRegion, FillRgn, FrameRgn, GetBoundsRect, GetTextFaceW, SetPixelV, DeleteObject, CreateBitmap, SelectPalette
MSIMG32.dll	AlphaBlend, TransparentBlt
COMDLG32.dll	GetFileTitleW
WINSPOOL.DRV	OpenPrinterW, DocumentPropertiesW, ClosePrinter
ADVAPI32.dll	RegQueryValueExW, RegOpenKeyExW, RegCreateKeyExW, RegSetValueExW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyW, RegQueryValueW, RegCloseKey, RegEnumValueW, RegEnumKeyExW
SHELL32.dll	SHBrowseForFolderW, SHAppBarMessage, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetDesktopFolder, ShellExecuteW, DragQueryFileW, DragFinish, SHGetFileInfoW
COMCTL32.dll	ImageList_GetIconSize, InitCommonControlsEx
SHLWAPI.dll	PathFindExtensionW, PathFindFileNameW, PathStripToRootW, PathIsUNCW, PathRemoveFileSpecW
ole32.dll	OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleLockRunning, OleGetClipboard, RegisterDragDrop, CoLockObjectExternal, RevokeDragDrop, CoCreateGuid, CoTaskMemFree, DoDragDrop, CreateStreamOnHGlobal, CoInitializeEx, CoInitialize, CoCreateInstance, CoUninitialize, OleDuplicateData, CoTaskMemAlloc, ReleaseStgMedium
OLEAUT32.dll	SysFreeString, SysAllocString, SysAllocStringLen, VariantClear, VariantChangeType, VariantInit, SysStringLen, VarBstrFromDate, SystemTimeToVariantTime, VariantTimeToSystemTime
gdiplus.dll	GdipGetImagePaletteSize, GdipGetImagePalette, GdipCreateBitmapFromStream, GdipCreateBitmapFromScan0, GdipGetImagePixelFormat, GdipBitmapUnlockBits, GdipGetImageGraphicsContext, GdipDrawImageI, GdipCreateFromHDC, GdiplusShutdown, GdiplusStartup, GdipGetImageHeight, GdipCloneImage, GdipGetImageWidth, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipDeleteGraphics, GdipAlloc, GdipDrawImageRectI, GdipBitmapLockBits, GdipFree, GdipSetInterpolationMode
IPHLPAPI.DLL	GetTcpTable2, SetTcpEntry
WS2_32.dll	htonl, inet_ntop
OLEACC.dll	AccessibleObjectFromWindow, CreateStdAccessibleObject, LresultFromObject
IMM32.dll	ImmGetOpenStatus, ImmReleaseContext, ImmGetContext
WINMM.dll	PlaySoundW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 08:20:59.418148041 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:20:59.423110008 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:20:59.423192024 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:20:59.423474073 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:20:59.428203106 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.306638002 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.306925058 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.311794996 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.311836958 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.311846972 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622891903 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622915983 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622925997 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622936010 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622946024 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622956038 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622967005 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622977018 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622987986 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622997999 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.622993946 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.623109102 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.623109102 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.624001980 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.628279924 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.628290892 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.628345966 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.846925974 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.846940041 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.846950054 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.846977949 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.846990108 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.846998930 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.847009897 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.847013950 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.847019911 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.847047091 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.847069025 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.847534895 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.847546101 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.847556114 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.847565889 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.847575903 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.847584009 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.847608089 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.848304033 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848315001 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848325968 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848349094 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.848393917 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.848468065 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848479986 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848525047 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.848695993 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848706007 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848716974 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848726988 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848737001 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:00.848742008 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:00.848774910 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.068840981 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.068928957 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.068939924 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.068949938 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.068985939 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.069029093 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.069065094 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.069076061 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.069092989 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.069104910 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.069114923 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.069122076 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.069125891 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.069140911 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.069145918 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.069165945 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.069982052 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.069992065 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070003033 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070012093 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070023060 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070029974 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.070033073 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070044994 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070053101 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.070089102 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.070875883 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070887089 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070897102 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070907116 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070916891 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070924997 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.070926905 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070939064 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.070941925 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.070983887 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.071808100 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.071819067 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.071830034 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.071840048 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.071850061 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.071861029 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.071871996 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.071875095 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.071875095 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.071907997 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.071932077 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.072702885 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.072714090 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.072731018 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.072741032 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.072751999 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.072757959 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.072762966 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.072773933 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.072802067 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.072846889 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.073559999 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.073570967 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.073616982 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.297157049 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297193050 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297202110 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297213078 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297223091 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297245026 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.297295094 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.297378063 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297411919 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297420025 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.297456980 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297511101 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.297527075 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297785044 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297800064 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297811985 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297821999 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297832966 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297835112 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.297843933 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297852993 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.297875881 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.297899961 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.298207045 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298218012 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298227072 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298243999 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298254967 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298255920 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.298264980 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298275948 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298300028 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.298332930 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.298742056 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298782110 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298795938 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.298836946 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298847914 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298857927 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298867941 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298877001 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.298888922 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.298916101 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.299268961 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299279928 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299289942 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299299955 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299335957 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.299366951 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.299544096 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299554110 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299565077 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299608946 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299619913 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299635887 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.299684048 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.299943924 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299954891 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299966097 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299976110 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.299998045 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.300024986 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.300179005 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300232887 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.300344944 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300355911 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300365925 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300375938 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300385952 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300395966 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300405979 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300415993 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300415993 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.300426006 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.300436020 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.300482035 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.302165031 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302175045 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302207947 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302225113 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.302268982 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.302323103 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302335024 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302344084 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302357912 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302367926 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302377939 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302377939 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.302388906 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302397966 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302409887 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302417040 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.302419901 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.302437067 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.302454948 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.303169012 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.303179979 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.303189993 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.303200006 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.303222895 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.303272963 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.303431034 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.303442001 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.303452015 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.303481102 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.352766037 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520109892 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520143986 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520153999 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520164013 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520174026 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520184994 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520195007 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520204067 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520216942 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520292044 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520292997 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520342112 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520353079 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520363092 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520379066 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520405054 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520415068 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520423889 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520426035 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520426035 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520433903 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520443916 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520453930 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520472050 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520524979 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520549059 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520560026 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520569086 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520576000 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520580053 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520607948 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520634890 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520751953 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520761967 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520771980 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520781994 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520792007 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520802021 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520803928 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520812035 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520822048 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520832062 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520847082 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520845890 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520847082 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520865917 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520899057 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.520955086 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520966053 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520977020 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520987034 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.520996094 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.521009922 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.521044016 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.521080017 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.521090031 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.521115065 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.521126032 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.521132946 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.521135092 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.521146059 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.521167994 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.521194935 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:01.606362104 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:01.610362053 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:03.619288921 CET	49731	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:03.624187946 CET	7777	49731	124.156.117.13	192.168.2.4
Dec 31, 2024 08:21:03.624272108 CET	49731	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:21:26.733814955 CET	49731	7777	192.168.2.4	124.156.117.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 08:20:59.418517113 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:20:59.418585062 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:20:59.463048935 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:20:59.500804901 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:20:59.593075037 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:20:59.663238049 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:20:59.780808926 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:20:59.902810097 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:00.050786972 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:00.220776081 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:00.410804033 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:00.623785019 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:00.844789028 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:01.104795933 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:01.373797894 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:01.663798094 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:01.963835001 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:02.295708895 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:02.641851902 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:03.012928009 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:03.391835928 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:03.727715969 CET	54327	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:03.727822065 CET	54327	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:03.745790005 CET	54327	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:03.792912960 CET	54326	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:03.797487974 CET	54327	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:03.864820957 CET	54327	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:21.570061922 CET	54327	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:21:21.576653004 CET	54326	6341	192.168.2.4	192.168.1.2

Target ID:	0
Start time:	02:20:56
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1.exe"
Imagebase:	0x50000
File size:	1'874'432 bytes
MD5 hash:	A2ECCD0AC68E32F1763FF60E5B151304
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000000.1658022811.00000000001AE000.00000008.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:21:02
Start date:	31/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 1416
Imagebase:	0xac0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	68.5%
Signature Coverage:	8.8%
Total number of Nodes:	1371
Total number of Limit Nodes:	26

Executed Functions

Function 00067E35 Relevance: 103.8, APIs: 48, Strings: 11, Instructions: 557
libraryloaderstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00067E3F

Part of subcall function 0005A078: __EH_prolog3.LIBCMT ref: 0005A07F
Part of subcall function 0005A078: GetWindowDC.USER32(00000000,00000004,00067938,00000000,?,?,00178F40), ref: 0005A0AB

GetDeviceCaps.GDI32(?,00000058), ref: 00067E65
DeleteObject.GDI32(00000000), ref: 00067EC6
DeleteObject.GDI32(00000000), ref: 00067EE3
DeleteObject.GDI32(00000000), ref: 00067F00
DeleteObject.GDI32(00000000), ref: 00067F17
DeleteObject.GDI32(00000000), ref: 00067F34
DeleteObject.GDI32(00000000), ref: 00067F4B
DeleteObject.GDI32(00000000), ref: 00067F62
DeleteObject.GDI32(00000000), ref: 00067F79
DeleteObject.GDI32(00000000), ref: 00067F96
DeleteObject.GDI32(00000000), ref: 00067FAD
_memset.LIBCMT ref: 00067FC4
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 00067FD4
lstrcpyW.KERNEL32(?,?), ref: 00068023
EnumFontFamiliesW.GDI32(?,00000000,Function_00017DEC), ref: 0006804A
lstrcpyW.KERNEL32(?), ref: 0006805A
EnumFontFamiliesW.GDI32(?,00000000,Function_00017DEC), ref: 00068075
lstrcpyW.KERNEL32(?), ref: 0006808D
CreateFontIndirectW.GDI32(?), ref: 00068099
CreateFontIndirectW.GDI32(?), ref: 000680E9
CreateFontIndirectW.GDI32(?), ref: 00068124
CreateFontIndirectW.GDI32(?), ref: 0006814C
CreateFontIndirectW.GDI32(?), ref: 00068169
GetSystemMetrics.USER32(00000048), ref: 00068184
lstrcpyW.KERNEL32(?), ref: 00068198
CreateFontIndirectW.GDI32(?), ref: 0006819E
GetStockObject.GDI32(00000011), ref: 000681CC
GetObjectW.GDI32(?,0000005C,?), ref: 000681EE
lstrcpyW.KERNEL32(?), ref: 00068227
CreateFontIndirectW.GDI32(?), ref: 00068231
CreateFontIndirectW.GDI32(?), ref: 00068250
GetStockObject.GDI32(00000011), ref: 00068266
GetObjectW.GDI32(?,0000005C,?), ref: 00068277
CreateFontIndirectW.GDI32(?), ref: 00068281
CreateFontIndirectW.GDI32(?), ref: 000682A4
__EH_prolog3_GS.LIBCMT ref: 0006832F
GetVersionExW.KERNEL32(?,0000011C), ref: 00068485
KiUserCallbackDispatcher.NTDLL(00001000), ref: 00068490
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 00068515
GetProcAddress.KERNEL32(?,DrawThemeTextEx), ref: 00068528
GetProcAddress.KERNEL32(?,BufferedPaintInit), ref: 0006853B
GetProcAddress.KERNEL32(?,BufferedPaintUnInit), ref: 0006854E
GetProcAddress.KERNEL32(?,BeginBufferedPaint), ref: 00068561
GetProcAddress.KERNEL32(?,EndBufferedPaint), ref: 00068574
GetProcAddress.KERNEL32(00000000,DwmExtendFrameIntoClientArea), ref: 000685BD
GetProcAddress.KERNEL32(?,DwmDefWindowProc), ref: 000685D0
GetProcAddress.KERNEL32(?,DwmIsCompositionEnabled), ref: 000685E3

Strings

BeginBufferedPaint, xrefs: 00068550
EndBufferedPaint, xrefs: 00068563
dwmapi.dll, xrefs: 000685A2
UxTheme.dll, xrefs: 000684F4
DwmDefWindowProc, xrefs: 000685BF
DrawThemeTextEx, xrefs: 00068517
DwmIsCompositionEnabled, xrefs: 000685D2
BufferedPaintUnInit, xrefs: 0006853D
DrawThemeParentBackground, xrefs: 0006850F
DwmExtendFrameIntoClientArea, xrefs: 000685B7
BufferedPaintInit, xrefs: 0006852A

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Object$Font$CreateDeleteIndirect$AddressProc$lstrcpy$EnumFamiliesH_prolog3_Stock$CallbackCapsCharsetDeviceDispatcherH_prolog3InfoMetricsSystemTextUserVersionWindow_memset
String ID: BeginBufferedPaint$BufferedPaintInit$BufferedPaintUnInit$DrawThemeParentBackground$DrawThemeTextEx$DwmDefWindowProc$DwmExtendFrameIntoClientArea$DwmIsCompositionEnabled$EndBufferedPaint$UxTheme.dll$dwmapi.dll
API String ID: 2460119550-1174303547
Opcode ID: d4cbe6a4c0e193e62e31f4004568a562607e876255859df0a133f544876a42e6
Instruction ID: 7123f30b4c2349d8440f78c7bb837e5243b80acd6baef5de27e587bd274510ab
Opcode Fuzzy Hash: d4cbe6a4c0e193e62e31f4004568a562607e876255859df0a133f544876a42e6
Instruction Fuzzy Hash: 443257B08017189FCB619FB8C844BDAFBF9AF59300F00896EE59EA7252DB715984CF50

Function 03162320 Relevance: 89.7, APIs: 38, Strings: 13, Instructions: 447
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

_memset.LIBCMT ref: 03162366
_memset.LIBCMT ref: 0316237F
_memset.LIBCMT ref: 0316238F
gethostname.WS2_32(?,00000032), ref: 0316239D
gethostbyname.WS2_32(?), ref: 031623A7
inet_ntoa.WS2_32 ref: 031623BF
_strcat_s.LIBCMT ref: 031623D2
_strcat_s.LIBCMT ref: 031623EB
inet_ntoa.WS2_32 ref: 0316240C
_strcat_s.LIBCMT ref: 0316241F
_strcat_s.LIBCMT ref: 03162438
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000001), ref: 03162465
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000001), ref: 0316247F
GetLastInputInfo.USER32 ref: 03162492
GetTickCount.KERNEL32 ref: 03162498
wsprintfW.USER32 ref: 031624CD
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,?,?,?), ref: 031624E0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,0000021E,00000000,?,?,?), ref: 031624FA
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 03162557
wsprintfW.USER32 ref: 03162576
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?), ref: 03162591
GetWindowTextW.USER32(00000000,000005A2,000000FA), ref: 031625A8
lstrlenW.KERNEL32(000007A0,?,?,?,?,?,?,?,?), ref: 031625C5
lstrlenW.KERNEL32(00000868,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03162624
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 03162698
GetProcAddress.KERNEL32(00000000), ref: 0316269F
GetSystemInfo.KERNEL32(?), ref: 031626BB
wsprintfW.USER32 ref: 031626FA
AllocateAndInitializeSid.ADVAPI32 ref: 03162740
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 03162760
FreeSid.ADVAPI32(?), ref: 0316276D
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 03162806
wsprintfW.USER32 ref: 0316284F
GetLocaleInfoW.KERNEL32(00000800,00000002,00000C1C,00000040), ref: 03162864
_memset.LIBCMT ref: 03162878
EnumDisplayMonitors.USER32 ref: 0316289A
GetSystemDirectoryW.KERNEL32(?,00000032), ref: 031628C1
GetCurrentHwProfileW.ADVAPI32(?), ref: 031628CE

Strings

%d min, xrefs: 031624C7
2024.12.25, xrefs: 03162646
x86, xrefs: 031626E2, 031626ED
Network, xrefs: 031625B9, 03162618
GetNativeSystemInfo, xrefs: 03162658
kernel32.dll, xrefs: 0316265D
AppEvents, xrefs: 031625B2, 03162611
GROUP, xrefs: 031625D3
1.0, xrefs: 031625F7
X86 %s, xrefs: 031626F4
Run:%s Con:%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 03162849
x64, xrefs: 031626DB
REMARK, xrefs: 03162632

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ByteCharInfoMultiWide_memset_strcat_swsprintf$System$Windowinet_ntoalstrlen$AddressAllocateCheckCountCurrentDirectoryDisplayEnumForegroundFreeHandleInitializeInputLastLocalLocaleMembershipModuleMonitorsProcProfileTextTickTimeToken_mallocgethostbynamegethostname
String ID: %d min$1.0$2024.12.25$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$Run:%s Con:%4d.%2d.%2d-%2d:%2d:%2d$X86 %s$kernel32.dll$x64$x86
API String ID: 152478060-3937765074
Opcode ID: 9f58a63d3ebac19bcd70c80d2649a26d9910b0c896792fb06dd1fd03930646ee
Instruction ID: 69490d6040d1b02bfadcfd72f260a322b136424e32ff3fe5a3f6784d3317e73c
Opcode Fuzzy Hash: 9f58a63d3ebac19bcd70c80d2649a26d9910b0c896792fb06dd1fd03930646ee
Instruction Fuzzy Hash: 0EF1E675A00315AFD724EB60DC49FEAB3B8FB0C700F044599F619A7181EB706A95CFA4

Function 03169DF0 Relevance: 47.6, APIs: 20, Strings: 7, Instructions: 330
sleepsynchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03172905: __fassign.LIBCMT ref: 031728FB

Sleep.KERNEL32(00000000), ref: 03169E44
CloseHandle.KERNEL32(00000000), ref: 03169E71

Part of subcall function 03161320: WSAStartup.WS2_32(00000202,?), ref: 03161371
Part of subcall function 03161320: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0316137C
Part of subcall function 03161320: InterlockedExchange.KERNEL32(0000003C,00000000), ref: 0316138A

GetLocalTime.KERNEL32(?), ref: 03169EB7
wsprintfW.USER32 ref: 03169EEE
SetUnhandledExceptionFilter.KERNEL32(031643B0), ref: 03169EFC
CloseHandle.KERNEL32(00000000), ref: 03169F15

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

Sleep.KERNEL32(00000000), ref: 0316A088
EnumWindows.USER32(Function_00002D40,?), ref: 0316A0AA
Sleep.KERNEL32(00004E20), ref: 0316A0B7
EnumWindows.USER32(Function_00002D40,?), ref: 0316A0CB
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0316A12E
Sleep.KERNEL32(00000FA0,?,?,00000208,124.156.117.13), ref: 0316A1A8
CloseHandle.KERNEL32(?), ref: 0316A1EC

Part of subcall function 031717EF: ___set_flsgetvalue.LIBCMT ref: 03171814
Part of subcall function 031717EF: __calloc_crt.LIBCMT ref: 03171820
Part of subcall function 031717EF: __getptd.LIBCMT ref: 0317182D
Part of subcall function 031717EF: CreateThread.KERNEL32(00000000,?,0317178A,00000000,00000000,0316A571), ref: 03171864
Part of subcall function 031717EF: GetLastError.KERNEL32(?,0316A571,00000000,00000000,03162F50,?,00000000,00000000), ref: 0317186E
Part of subcall function 031717EF: _free.LIBCMT ref: 03171877
Part of subcall function 031717EF: __dosmaperr.LIBCMT ref: 03171882

Sleep.KERNEL32(000003E8), ref: 0316A232
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0316A25C
CloseHandle.KERNEL32(?), ref: 0316A263
CloseHandle.KERNEL32(?), ref: 0316A281
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0316A2A3
CloseHandle.KERNEL32(?), ref: 0316A2AA
CloseHandle.KERNEL32(?), ref: 0316A2C8

Strings

124.156.117.13, xrefs: 03169F2B
124.156.117.13, xrefs: 03169F73
124.156.117.13, xrefs: 03169F35, 03169F7D, 03169FDB, 0316A0E6, 0316A13A
7777, xrefs: 03169F8A
7777, xrefs: 03169F49, 03169F91, 03169FEF, 0316A0D5, 0316A0FD
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 03169EE8
7777, xrefs: 03169F42

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CloseHandle$Sleep$Create$EnumEventObjectSingleWaitWindows$ErrorExceptionExchangeFilterInterlockedLastLocalStartupThreadTimeUnhandled___set_flsgetvalue__calloc_crt__dosmaperr__fassign__getptd_free_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$124.156.117.13$124.156.117.13$124.156.117.13$7777$7777$7777
API String ID: 988101634-1715954754
Opcode ID: 2ff22bc2eff6e0ec85d44bd481787dc034e62857684ccba61c8c4e03543f829d
Instruction ID: 14aae4c0f901349baaba7433e6eeb1a6e4bc56cb19d86a255db256e9d22569d5
Opcode Fuzzy Hash: 2ff22bc2eff6e0ec85d44bd481787dc034e62857684ccba61c8c4e03543f829d
Instruction Fuzzy Hash: 06C148B1908302BFD324FFA4EC85A1F77E9AF8C711F080A2DF46596285DB709595CB62

Function 03163D60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,00000000,74DEDF80), ref: 03163D98
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 03163DB4
_memset.LIBCMT ref: 03163DEB
GlobalMemoryStatusEx.KERNEL32(?), ref: 03163DFE
swprintf.LIBCMT ref: 03163E43
swprintf.LIBCMT ref: 03163E56

Strings

HDD:%d, xrefs: 03163E38
@, xrefs: 03163DF7
:, xrefs: 03163D8D
%sFree%d Gb , xrefs: 03163E4B

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: f4fd0b15a9107997f3be51177092d288354bbd94e2d87f5d14bf41822dcc951f
Instruction ID: bfefc4a1ba36261e7fdcabcaafc5ebe5f660a933ab54e40f1efdd08d61476ca7
Opcode Fuzzy Hash: f4fd0b15a9107997f3be51177092d288354bbd94e2d87f5d14bf41822dcc951f
Instruction Fuzzy Hash: 593170B6E0021CABDB14DBE5DC45BEEBBB9FB88700F54421DE905AB240EB706945CB94

Function 02AC3840 Relevance: 16.5, APIs: 11, Instructions: 43threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00002820), ref: 02AC3846
GetConsoleWindow.KERNEL32(00000000), ref: 02AC384E
ShowWindow.USER32(00000000), ref: 02AC3855
GetCurrentThreadId.KERNEL32 ref: 02AC3861
PostThreadMessageA.USER32(00000000), ref: 02AC3868
GetInputState.USER32 ref: 02AC386E

Part of subcall function 02AC29A0: _memset.LIBCMT ref: 02AC29D1
Part of subcall function 02AC29A0: _memset.LIBCMT ref: 02AC29E1

CreateThread.KERNEL32(00000000,00000000,Function_00002140,00000000,00000000,00000000), ref: 02AC388E
CreateThread.KERNEL32(00000000,00000000,Function_00002460,00000000,00000000,00000000), ref: 02AC38A4
WaitForSingleObject.KERNEL32(02AE50D4,000000FF), ref: 02AC38AE
CloseHandle.KERNEL32(02AE50D4), ref: 02AC38BB
Sleep.KERNEL32(0000012C), ref: 02AC38C6

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Thread$CreateWindow_memset$CloseConsoleCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait
String ID:
API String ID: 80679444-0
Opcode ID: fcb7928ecb06446833d533d538535cdfaaad83204f3fbec863e2c90279b9352a
Instruction ID: 429bc59bdad36bdd599c3bfa28256c228e0b291af3b925ca7fd3d10b8bb99fe4
Opcode Fuzzy Hash: fcb7928ecb06446833d533d538535cdfaaad83204f3fbec863e2c90279b9352a
Instruction Fuzzy Hash: FB015C71EC5314BBEA206BA0AD0EF493A24B704B5AF614D05B327ED1D0CDB0A4128B65

Function 03164110 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75comstringnativeCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0316412A

Part of subcall function 03163E70: _memset.LIBCMT ref: 03163ED8
Part of subcall function 03163E70: RegOpenKeyExW.KERNEL32(?,SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000,00000000,00020019,?,00000000,0000052A,0000039A), ref: 03163EFD

CoInitialize.OLE32(00000000), ref: 03164152
CoCreateInstance.OLE32(03186FBC,00000000,00000017,03186FCC,?), ref: 0316416D
NtProtectVirtualMemory.NTDLL(?,00000000), ref: 03164185
swprintf.LIBCMT ref: 031641EC

Strings

DriverDesc, xrefs: 0316413E
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000, xrefs: 03164143
%s , xrefs: 031641E4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateInitializeInstanceMemoryOpenProtectVirtual_memsetlstrlenswprintf
String ID: %s $DriverDesc$SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
API String ID: 2282874092-2074342395
Opcode ID: 0131f97b9a590b25621072b90f99653be35da36f95a94ae8415536ae840448a0
Instruction ID: 512a206fc18621f4b47d4f4bae9f3ba27d95fdf212635202482ef7ddd5d291a3
Opcode Fuzzy Hash: 0131f97b9a590b25621072b90f99653be35da36f95a94ae8415536ae840448a0
Instruction Fuzzy Hash: 71218870700215AFE718EB54DC55FAD7379DB4C704F108198E60AAB2C1DB70AD40CFA4

Function 00051410 Relevance: 7.5, APIs: 5, Instructions: 49processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0005142E
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00051452
__wcsicoll.LIBCMT ref: 00051467
Process32NextW.KERNEL32(000000FF,0000022C), ref: 00051489
CloseHandle.KERNEL32(000000FF), ref: 00051497

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll
String ID:
API String ID: 3102623508-0
Opcode ID: 25fdf560440626743ba1446b488d3a84594aa1a42188cd1cda87123e79962811
Instruction ID: 094071335e8c48e69e9e1e670ad5067d5434c044900930aac7371da327a72496
Opcode Fuzzy Hash: 25fdf560440626743ba1446b488d3a84594aa1a42188cd1cda87123e79962811
Instruction Fuzzy Hash: ED115675E00208EBCB24DFA5DC49BFEB7B9EF48701F104599E909A7290EB749A84CF50

Function 031615C0 Relevance: 3.1, APIs: 2, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 03161633
recv.WS2_32(?,?,00040000,00000000), ref: 03161654

Part of subcall function 03161830: _memmove.LIBCMT ref: 0316185E
Part of subcall function 03161830: _memmove.LIBCMT ref: 03161922

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _memmove$_mallocrecvselect
String ID:
API String ID: 1734404984-0
Opcode ID: 94ccb528474db549dca93693aa80ec1c751ce2581a02e7b116644c34c76fb939
Instruction ID: 0ba0bb605acb8c577a99f876a6c9c580dfcf5083c0370458a7e0d9c2de65fcd6
Opcode Fuzzy Hash: 94ccb528474db549dca93693aa80ec1c751ce2581a02e7b116644c34c76fb939
Instruction Fuzzy Hash: 5E21D7B5600214ABDB20DF65DC84BAA77B8EF48310F0801B4E904AB2C0D7F0A994CBA1

Function 000678DC Relevance: 64.8, APIs: 43, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 000678E3
GetSysColor.USER32(00000016), ref: 000678F2
GetSysColor.USER32(0000000F), ref: 000678FF
GetSysColor.USER32(00000015), ref: 00067912
GetSysColor.USER32(0000000F), ref: 0006791A
GetDeviceCaps.GDI32(?,0000000C), ref: 00067940
GetSysColor.USER32(0000000F), ref: 0006794E
GetSysColor.USER32(00000010), ref: 00067958
GetSysColor.USER32(00000015), ref: 00067962
GetSysColor.USER32(00000016), ref: 0006796C
GetSysColor.USER32(00000014), ref: 00067976
GetSysColor.USER32(00000012), ref: 00067980
GetSysColor.USER32(00000011), ref: 0006798A
GetSysColor.USER32(00000006), ref: 00067991
GetSysColor.USER32(0000000D), ref: 00067998
GetSysColor.USER32(0000000E), ref: 0006799F
GetSysColor.USER32(00000005), ref: 000679A6
GetSysColor.USER32(00000008), ref: 000679B0
GetSysColor.USER32(00000009), ref: 000679B7
GetSysColor.USER32(00000007), ref: 000679BE
GetSysColor.USER32(00000002), ref: 000679C5
GetSysColor.USER32(00000003), ref: 000679CC
GetSysColor.USER32(0000001B), ref: 000679D3
GetSysColor.USER32(0000001C), ref: 000679DD
GetSysColor.USER32(0000000A), ref: 000679E7
GetSysColor.USER32(0000000B), ref: 000679F1
GetSysColor.USER32(00000013), ref: 000679FB
GetSysColor.USER32(0000001A), ref: 00067A15
GetSysColorBrush.USER32(00000010), ref: 00067A30
GetSysColorBrush.USER32(00000014), ref: 00067A47
GetSysColorBrush.USER32(00000005), ref: 00067A59
CreateSolidBrush.GDI32(?), ref: 00067A7D
CreateSolidBrush.GDI32(?), ref: 00067A99
CreateSolidBrush.GDI32(?), ref: 00067AB5
CreateSolidBrush.GDI32(?), ref: 00067AD1
CreateSolidBrush.GDI32(?), ref: 00067AED
CreateSolidBrush.GDI32(?), ref: 00067B09
CreateSolidBrush.GDI32(?), ref: 00067B25
CreatePen.GDI32(00000000,00000001), ref: 00067B4E
CreatePen.GDI32(00000000,00000001), ref: 00067B71
CreatePen.GDI32(00000000,00000001), ref: 00067B94
CreateSolidBrush.GDI32(?), ref: 00067C18
CreatePatternBrush.GDI32(00000000), ref: 00067C59

Part of subcall function 0005A27D: DeleteObject.GDI32(00000000), ref: 0005A28C

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Color$BrushCreate$Solid$CapsDeleteDeviceH_prolog3ObjectPattern
String ID:
API String ID: 3754413814-0
Opcode ID: f64fbee3b3a3d980a3746bd9c35b9196b31cbe7b096468a79c8ae898e8c80499
Instruction ID: d9cdcfbffaa8344a96bd83fd58bc25da3ef4f96ae770dd1a90732e8e6dec69ac
Opcode Fuzzy Hash: f64fbee3b3a3d980a3746bd9c35b9196b31cbe7b096468a79c8ae898e8c80499
Instruction Fuzzy Hash: A1B17C70A00B449EDB30AF75CC46BEBBAE1AF41701F004A2DE59B96592DF71A548DF21

Function 000B6E09 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 421
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 000B6E13
LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002000), ref: 000B6FD5
GetObjectW.GDI32(00000082,00000018,?), ref: 000B6FE7
CreateCompatibleDC.GDI32(00000000), ref: 000B7039
GetObjectW.GDI32(00000082,00000018,?), ref: 000B7054
SelectObject.GDI32(?,00000082), ref: 000B7068
CreateCompatibleBitmap.GDI32(?,?,?), ref: 000B708C
SelectObject.GDI32(?,00000000), ref: 000B709F
CreateCompatibleDC.GDI32(?), ref: 000B70B5
SelectObject.GDI32(?,?), ref: 000B70CA
SelectObject.GDI32(?,00000000), ref: 000B70D9
DeleteObject.GDI32(?), ref: 000B70DE
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 000B70FE
GetPixel.GDI32(?,?,?), ref: 000B711D
SetPixel.GDI32(?,?,?,00000000), ref: 000B7153
SelectObject.GDI32(?,?), ref: 000B7175
SelectObject.GDI32(?,00000000), ref: 000B717D
DeleteObject.GDI32(00000082), ref: 000B7182
DeleteObject.GDI32(00000082), ref: 000B71B4
__EH_prolog3.LIBCMT ref: 000B71E8
CreateCompatibleDC.GDI32(00000000), ref: 000B72B3
CreateCompatibleDC.GDI32(00000000), ref: 000B72BF

Strings

, xrefs: 000B6FED

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Object$Select$CompatibleCreate$Delete$H_prolog3Pixel$BitmapImageLoad
String ID:
API String ID: 1197801157-3916222277
Opcode ID: 5593dff057479cfd59736e4f8b0c7e6059f1355e3d96053e69549c3bcceb5411
Instruction ID: b36462cfb94dc31fdb279ee08e4c7852f4e81ffaf2ab9ab3f7ace42ff673dc2a
Opcode Fuzzy Hash: 5593dff057479cfd59736e4f8b0c7e6059f1355e3d96053e69549c3bcceb5411
Instruction Fuzzy Hash: D9024970D01219DFCF55DFA8C980AEEBBB5FF48700F10856AF809AA256D7718985CFA0

Function 0316A2E0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223
sleepsynchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03172905: __fassign.LIBCMT ref: 031728FB

Sleep.KERNEL32(00000000), ref: 0316A33A
GetLocalTime.KERNEL32(?), ref: 0316A341
wsprintfW.USER32 ref: 0316A378
Sleep.KERNEL32(00000000), ref: 0316A401
EnumWindows.USER32(03162D40,?), ref: 0316A417
Sleep.KERNEL32(00004E20), ref: 0316A425
EnumWindows.USER32(03162D40,00000000), ref: 0316A439
Sleep.KERNEL32(0000C350), ref: 0316A447
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0316A4A4
CloseHandle.KERNEL32(?), ref: 0316A54D

Part of subcall function 03161270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 03161291
Part of subcall function 03161270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 031612AA
Part of subcall function 03161270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 031612C3
Part of subcall function 03161270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 031612E3
Part of subcall function 03161270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 031612FA
Part of subcall function 03161270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 03161311

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

Sleep.KERNEL32(000003E8), ref: 0316A585
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0316A5A6
CloseHandle.KERNEL32(00000000), ref: 0316A5B3
CloseHandle.KERNEL32(?), ref: 0316A5CD
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0316A5E6
CloseHandle.KERNEL32(00000000), ref: 0316A5F3
CloseHandle.KERNEL32(?), ref: 0316A60D

Strings

192.168.1.2, xrefs: 0316A45C, 0316A4AA
6341, xrefs: 0316A44B, 0316A473
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0316A372

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: FreeVirtual$CloseHandleSleep$EnumObjectSingleWaitWindows$CreateEventLocalTime__fassign_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$192.168.1.2$6341
API String ID: 3548684339-291747511
Opcode ID: dfcce7a374c916f487e8af5a988f9ee7e948b6c88c7fb91c7c9e452145bbfb5a
Instruction ID: 54ca6ddba5a0dbe1d72b635797829059307c3010ef3ba6c5eede34e437bda537
Opcode Fuzzy Hash: dfcce7a374c916f487e8af5a988f9ee7e948b6c88c7fb91c7c9e452145bbfb5a
Instruction Fuzzy Hash: AB8104B15083019FD324EFA8DC84A6FB3E9AFCC711F140A1DF4A997280DB74A5418BA6

Function 0316FC80 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 324
threadtimenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0316FCB1
GetCurrentThreadId.KERNEL32 ref: 0316FCC6
__alloca_probe_16.LIBCMT ref: 0316FD27
CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 0316FD7F
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF,80004005,?,00000000,000000FF,00000000), ref: 0316FDE5
_free.LIBCMT ref: 0316FE0D
_malloc.LIBCMT ref: 0316FE54

Part of subcall function 03171DDE: __FF_MSGBANNER.LIBCMT ref: 03171DF7
Part of subcall function 03171DDE: __NMSG_WRITE.LIBCMT ref: 03171DFE
Part of subcall function 03171DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171E23

_free.LIBCMT ref: 0316FE6C

Part of subcall function 03171DA4: HeapFree.KERNEL32(00000000,00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171DBA
Part of subcall function 03171DA4: GetLastError.KERNEL32(00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000), ref: 03171DCC

std::exception::exception.LIBCMT ref: 0316FE8F
__CxxThrowException@8.LIBCMT ref: 0316FEA4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 0316FED1
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 0316FF6E
GetCurrentThreadId.KERNEL32 ref: 0316FF8C
GetCurrentThreadId.KERNEL32 ref: 0316FFB5
CloseHandle.KERNEL32(00000000), ref: 0316FFDA
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 0316FFF7

Strings

---------------> Client Worker Thread 0x%08X stoped <---------------, xrefs: 0316FFB8
bad allocation, xrefs: 0316FE88
---------------> Client Worker Thread 0x%08X started <---------------, xrefs: 0316FCB4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CurrentThread$ErrorLast$HeapTimerWaitable_free$AllocateCloseCreateEventsException@8FreeHandleMultipleThrowWait__alloca_probe_16_mallocstd::exception::exception
String ID: ---------------> Client Worker Thread 0x%08X started <---------------$---------------> Client Worker Thread 0x%08X stoped <---------------$bad allocation
API String ID: 911687180-800104984
Opcode ID: ee05780712e9224d2d3ab72743bf862d4af41a8244cd1afc47cae538ff0dcf18
Instruction ID: 07e7d9647243d26af442c71586d506c40b5b88c3fa3d7186dfd51706d43eb9ff
Opcode Fuzzy Hash: ee05780712e9224d2d3ab72743bf862d4af41a8244cd1afc47cae538ff0dcf18
Instruction Fuzzy Hash: 19C18A75A003069BDB20DFA9D844B6EF7F9AF8C300F294529D855D7380EB31E952CBA5

Function 03163E70 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 165
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 03163ED8
RegOpenKeyExW.KERNEL32(?,SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000,00000000,00020019,?,00000000,0000052A,0000039A), ref: 03163EFD
RegQueryValueExW.ADVAPI32(?,DriverDesc,00000000,00000001,?,00000208), ref: 03163F77
lstrcmpW.KERNEL32(?,031878F0), ref: 03163F8D
lstrcpyW.KERNEL32(80000002,?), ref: 03163FA3

Strings

DriverDesc, xrefs: 03163F6F, 03163FFB, 03164062
%s-%d, xrefs: 0316408F
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000, xrefs: 03163EF5
error, xrefs: 031640BA

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: OpenQueryValue_memsetlstrcmplstrcpy
String ID: %s-%d$DriverDesc$SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000$error
API String ID: 2102619503-1280345570
Opcode ID: a01b4dc3ea408f13734b25c1aaf37f9a82155eb9413ba0f270d97b3bfe01a823
Instruction ID: a24923a3dec2ed27170cf7c43f4d6c29d03d495fe32a2b60a33f1abd4d6ed9f0
Opcode Fuzzy Hash: a01b4dc3ea408f13734b25c1aaf37f9a82155eb9413ba0f270d97b3bfe01a823
Instruction Fuzzy Hash: 74518071900329ABDB34DFA5DD88BEAB7B8EB4C700F1046D9E51597180DF74AA80CF64

Function 03162D40 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindowVisible.USER32(?), ref: 03162D53

Strings

Malwarebytes, xrefs: 03162DB3
Process, xrefs: 03162EED
Capsa, xrefs: 03162EB7, 03162EDB
Wireshark, xrefs: 03162E37
ApateDNS, xrefs: 03162D9D
Port, xrefs: 03162E0B
TaskExplorer, xrefs: 03162DDF
TCPEye, xrefs: 03162DC9
Fiddler, xrefs: 03162E8F
CurrPorts, xrefs: 03162DF5
Metascan, xrefs: 03162E21
Sniff, xrefs: 03162EC9

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: cf340b29b5671a430e1b67ac7c69dcd1e741bd648de090def28b9cb736ac6b43
Instruction ID: b92fe93418ff6a2f77bfab680cac6cf34e28179db55bf57408ade9c579655d3c
Opcode Fuzzy Hash: cf340b29b5671a430e1b67ac7c69dcd1e741bd648de090def28b9cb736ac6b43
Instruction Fuzzy Hash: F1414D5AE4271637E922F7E16C07A9E215C5E2F4CBF0C44B4FC18A4242F761933688AB

Function 02AC2310 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedExchange.KERNEL32(00000000,00000001), ref: 02AC234D
_memset.LIBCMT ref: 02AC23AD
_memset.LIBCMT ref: 02AC23D1
_memset.LIBCMT ref: 02AC23E3
_memmove.LIBCMT ref: 02AC240A
VirtualAlloc.KERNEL32(00000000,02AE2F18,00003000,00000040), ref: 02AC246E
_memmove.LIBCMT ref: 02AC2487
CloseHandle.KERNEL32(00000000), ref: 02AC24A3

Strings

_, xrefs: 02AC2392
., xrefs: 02AC237E
!jWW, xrefs: 02AC2374
i, xrefs: 02AC239C
{vU_, xrefs: 02AC236A
l, xrefs: 02AC2388

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: _memset$_memmove$AllocCloseExchangeHandleInterlockedVirtual
String ID: !jWW$.$_$i$l${vU_
API String ID: 3421416217-3065862289
Opcode ID: ebf1af66bd5fa55149c8181415891a7558d7232404c3c61f8518ce524e7e5d8b
Instruction ID: 38c5ad402f1fffb8eb3b4aff5c5b7b14c13d6f9bca852b8f932c3682da7346a2
Opcode Fuzzy Hash: ebf1af66bd5fa55149c8181415891a7558d7232404c3c61f8518ce524e7e5d8b
Instruction Fuzzy Hash: 0E41E474A403189FDB20DF14CC81B9A77A9FF49710F1045A9FA0D9B281DBB05A81CFA6

Function 03162FC0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 99
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,2024.12.25), ref: 03162FE6
GetLastError.KERNEL32 ref: 03162FEE
Sleep.KERNEL32(000003E8), ref: 03163005
CreateMutexW.KERNEL32(00000000,00000000,2024.12.25), ref: 03163010
GetLastError.KERNEL32 ref: 03163012
_memset.LIBCMT ref: 03163039
lstrlenW.KERNEL32(?), ref: 03163046
lstrcmpW.KERNEL32(?,03187AEC), ref: 03163074
Sleep.KERNEL32(000003E8), ref: 0316307F
GetModuleHandleW.KERNEL32(00000000), ref: 0316308C
GetConsoleWindow.KERNEL32 ref: 03163096

Strings

open, xrefs: 03163054
2024.12.25, xrefs: 03162FDD, 03163007
key, xrefs: 03163059

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: 2024.12.25$key$open
API String ID: 2922109467-228899315
Opcode ID: bd025534da3bc4c2d508849962ff8e2242a24ed51046b3375bfa9e3fbfca530b
Instruction ID: 96d1e3778af8b550518e96af4f66050c93210130a19dea4cf7d0732072f3c02d
Opcode Fuzzy Hash: bd025534da3bc4c2d508849962ff8e2242a24ed51046b3375bfa9e3fbfca530b
Instruction Fuzzy Hash: 8E2155766043029BE614FFB1EC46B5A77A8EB9C740F180819E650971C0EF70A558CBA6

Function 03161410 Relevance: 21.2, APIs: 14, Instructions: 157
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 03161431
InterlockedExchange.KERNEL32(?,00000000), ref: 0316143D
timeGetTime.WINMM ref: 03161443
socket.WS2_32(00000002,00000001,00000006), ref: 0316146A
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 03161496
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 031614A2
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000), ref: 031614C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 031614CD
gethostbyname.WS2_32(00000000), ref: 031614DB
htons.WS2_32(?), ref: 031614FE
connect.WS2_32(?,?,00000010), ref: 0316151C
setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 03161544
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 03161576
InterlockedExchange.KERNEL32(?,00000001), ref: 03161581

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ByteCharExchangeInterlockedMultiWidelstrlen$EventIoctlResetTimeconnectgethostbynamehtonssetsockoptsockettime
String ID:
API String ID: 2541589167-0
Opcode ID: 953eb56d4cd63cd1b03cb2758d684de877c5b54f6c3d6f5f216d1b6833a8f441
Instruction ID: dfe6ad94c6847c28289b6a4a4f572cfaf5ad6232f9bfd1d486aa5ce069f017a8
Opcode Fuzzy Hash: 953eb56d4cd63cd1b03cb2758d684de877c5b54f6c3d6f5f216d1b6833a8f441
Instruction Fuzzy Hash: 14518FB5A00305AFD724EFA5DC45FAAB7F8EF5C710F504519FA06EB680DBB0A9408B64

Function 02AC1410 Relevance: 21.2, APIs: 14, Instructions: 157
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 02AC1431
InterlockedExchange.KERNEL32(?,00000000), ref: 02AC143D
timeGetTime.WINMM ref: 02AC1443
socket.WS2_32(00000002,00000001,00000006), ref: 02AC146A
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 02AC1496
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02AC14A2
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000), ref: 02AC14C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02AC14CD
gethostbyname.WS2_32(00000000), ref: 02AC14DB
htons.WS2_32(?), ref: 02AC14FE
connect.WS2_32(?,?,00000010), ref: 02AC151C
setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 02AC1544
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 02AC1576
InterlockedExchange.KERNEL32(?,00000001), ref: 02AC1581

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ByteCharExchangeInterlockedMultiWidelstrlen$EventIoctlResetTimeconnectgethostbynamehtonssetsockoptsockettime
String ID:
API String ID: 2541589167-0
Opcode ID: a8e7a22dfccd21893844234301b91362f7ba72cca07c21e006191d8b86751b3d
Instruction ID: 67a995cbf8089d6453a2b3f7a099accc8d6b64690b4020deb3b1eac6454f4153
Opcode Fuzzy Hash: a8e7a22dfccd21893844234301b91362f7ba72cca07c21e006191d8b86751b3d
Instruction Fuzzy Hash: F9514EB1A40308AFE720DFA4DD45FAAB7B9FF48714F10491DF616D7290DB70A8158B60

Function 03164290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ntdll.dll,75BF73E0,?,?,?,03162515,000002E6,00000282,?,?,?), ref: 0316429C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 031642B2
swprintf.LIBCMT ref: 031642EF

Part of subcall function 03164210: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,03164323), ref: 0316423D
Part of subcall function 03164210: GetProcAddress.KERNEL32(00000000), ref: 03164244
Part of subcall function 03164210: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03164323), ref: 03164252

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,00000282), ref: 03164347
RegQueryValueExW.KERNEL32(00000282,ProductName,00000000,00000001,00000000,?), ref: 03164363
RegCloseKey.KERNEL32(00000282), ref: 03164386
FreeLibrary.KERNEL32(00000000,?,?,?,03162515,000002E6,00000282,?,?,?), ref: 03164398

Strings

%d.%d.%d, xrefs: 031642E7
ProductName, xrefs: 0316435D
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0316433D
RtlGetNtVersionNumbers, xrefs: 031642AC
ntdll.dll, xrefs: 03164297

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: f66314be351b9222f904e0aa0f6b3fc2b785a222124afff10c0a2c5a3bd77d07
Instruction ID: b494851b4e8001cd7bf1b219a81edb2d16e1fbd6d678ad0ddf867b1a63bc4f56
Opcode Fuzzy Hash: f66314be351b9222f904e0aa0f6b3fc2b785a222124afff10c0a2c5a3bd77d07
Instruction Fuzzy Hash: 83319176A40319BFD714EBE5DC46EFFB77CEB4C700F144158BA19A6181EF709A1086A4

Function 00051660 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000514C0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000514D7

Part of subcall function 00051590: Sleep.KERNEL32(00000000,?,000003E8,00002710,00000000,000000FF,6C078965,0019533E,EFF91FD5,?,0016A0EB,000000FF), ref: 00051640

Part of subcall function 00051410: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0005142E
Part of subcall function 00051410: Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00051452
Part of subcall function 00051410: __wcsicoll.LIBCMT ref: 00051467
Part of subcall function 00051410: CloseHandle.KERNEL32(000000FF), ref: 00051497

Part of subcall function 00051410: Process32NextW.KERNEL32(000000FF,0000022C), ref: 00051489

TerminateThread.KERNEL32(00000000,00000000), ref: 000516F3
CloseHandle.KERNEL32(00000000), ref: 000516FD
TerminateThread.KERNEL32(00000000,00000000), ref: 00051716
CloseHandle.KERNEL32(00000000), ref: 00051720
CreateThread.KERNEL32(00000000,00000000,Function_000013B0,00000000,00000000,?), ref: 00051752
CreateThread.KERNEL32(00000000,00000000,Function_000013B0,00000000,00000000,?), ref: 00051774
CreateThread.KERNEL32(00000000,00000000,Function_000014B0,00000000,00000000,?), ref: 000517AF
CreateThread.KERNEL32(00000000,00000000,Function_000014B0,00000000,00000000,?), ref: 000517D6
Sleep.KERNEL32(00001388), ref: 000517E8

Strings

360Safe.exe, xrefs: 00051677, 000516C7
360Tray.exe, xrefs: 00051670, 000516B8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CreateThread$CloseHandle$Process32SleepSnapshotTerminateToolhelp32$FirstNext__wcsicoll
String ID: 360Safe.exe$360Tray.exe
API String ID: 1169703884-80816502
Opcode ID: c0aa5a41bd1a3c01be83b2b308a93eaa4598c302d79c0104c6e65bb3001109f7
Instruction ID: b2f7d93c31e0a406e9d1fbc4b5ed79653b9f1d20774ea2d6e5d9734b6a76efa2
Opcode Fuzzy Hash: c0aa5a41bd1a3c01be83b2b308a93eaa4598c302d79c0104c6e65bb3001109f7
Instruction Fuzzy Hash: 8551FC74D44208EBEF50DFD4CC5ABFEB7B5AB48706F108118E90176280D7B55A88CFA5

Function 0316EC80 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000030), ref: 0316EC98
connect.WS2_32(?,?,-0000001D), ref: 0316ECC0
WSAGetLastError.WS2_32 ref: 0316ECD3
connect.WS2_32(?,?,-0000001D), ref: 0316ED07
WSAEventSelect.WS2_32(?,?,00000023), ref: 0316ED20
SetLastError.KERNEL32(00000000), ref: 0316ED3F
GetLastError.KERNEL32 ref: 0316ED56
WSASetLastError.WS2_32(00000000), ref: 0316ED66
send.WS2_32(?,00000000,00000000,00000000), ref: 0316ED7D
WSAGetLastError.WS2_32 ref: 0316ED88

Strings

<C-CNNID: %Iu> send 0 bytes (detect package), xrefs: 0316ED9E

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorLast$EventSelectconnect$send
String ID: <C-CNNID: %Iu> send 0 bytes (detect package)
API String ID: 1826129850-4236689219
Opcode ID: f98f0a1ed1cf3cb6bdb2fc34327d0aa0c131970cfd5f5b4efca6ffe429160f73
Instruction ID: eb9f1c8486cdecd9dc8af78a70a644742142f8dbe646665c032f3b942dc1f41c
Opcode Fuzzy Hash: f98f0a1ed1cf3cb6bdb2fc34327d0aa0c131970cfd5f5b4efca6ffe429160f73
Instruction Fuzzy Hash: B631F67A2006105FD728EBBADC48A6BB7A9EB98720B08471CF526C72C1EF74D8518770

Function 0316F570 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 154networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,76CB4AAF), ref: 0316F5B3
LeaveCriticalSection.KERNEL32(?), ref: 0316F5FE
send.WS2_32(?,?,?,00000000), ref: 0316F627
EnterCriticalSection.KERNEL32(?), ref: 0316F63A
LeaveCriticalSection.KERNEL32(?), ref: 0316F64D
SetLastError.KERNEL32(00000000), ref: 0316F655
WSAGetLastError.WS2_32 ref: 0316F6B2
EnterCriticalSection.KERNEL32(?), ref: 0316F6C6
LeaveCriticalSection.KERNEL32(?), ref: 0316F6FF

Strings

<C-CNNID: %Iu> OnSend() event should not return 'HR_ERROR' !!, xrefs: 0316F675

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ErrorLast$send
String ID: <C-CNNID: %Iu> OnSend() event should not return 'HR_ERROR' !!
API String ID: 484515946-1981346945
Opcode ID: 0fba073f46e55c8ca32d68319844369b10d355ee8036a56e0b10363563fa56dc
Instruction ID: 911f0f195b2699fbc8c183096e206cb26058406f33e50e6d467bdde8349d1668
Opcode Fuzzy Hash: 0fba073f46e55c8ca32d68319844369b10d355ee8036a56e0b10363563fa56dc
Instruction Fuzzy Hash: D6513BB5504B01DFC324DFB9E984AAAB7F8FB4C711F14462EE96AC3640EB30A4558B60

Function 000825A3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 000825E0
PathFindExtensionW.SHLWAPI(?), ref: 000825FA
__wcsdup.LIBCMT ref: 00082644
__wcsdup.LIBCMT ref: 00082682
__wcsdup.LIBCMT ref: 000826B6
__wcsdup.LIBCMT ref: 0008271C
__wcsdup.LIBCMT ref: 0008275D

Strings

.INI, xrefs: 0008273E
.HLP, xrefs: 000826FB
.CHM, xrefs: 000826F4

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: __wcsdup$ExtensionFileFindModuleNamePath
String ID: .CHM$.HLP$.INI
API String ID: 2477486372-4017452060
Opcode ID: 6f101707c0646a8d0a32de34d421a9f871ab3079754738556645ea4ab9c5107a
Instruction ID: 93b1004c6aa35c46b76cd21fe63995eba8a25601f7382883da2cda8d2a177329
Opcode Fuzzy Hash: 6f101707c0646a8d0a32de34d421a9f871ab3079754738556645ea4ab9c5107a
Instruction Fuzzy Hash: E0518EB1900709ABDB60FB64CD45BEB73FCBF14304F4048A9A885D2192EF70E999CB60

Function 02AC8ED0 Relevance: 16.8, APIs: 11, Instructions: 324timenetworkCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02AC8FCF
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF,80004005,?,00000000,000000FF,00000000), ref: 02AC9035
_free.LIBCMT ref: 02AC905D
_malloc.LIBCMT ref: 02AC90A4

Part of subcall function 02ACB087: __FF_MSGBANNER.LIBCMT ref: 02ACB0A0
Part of subcall function 02ACB087: __NMSG_WRITE.LIBCMT ref: 02ACB0A7
Part of subcall function 02ACB087: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 02ACB0CC

_free.LIBCMT ref: 02AC90BC

Part of subcall function 02ACB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1DE
Part of subcall function 02ACB1C8: GetLastError.KERNEL32(00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1F0

std::exception::exception.LIBCMT ref: 02AC90DF
__CxxThrowException@8.LIBCMT ref: 02AC90F4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 02AC9121
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 02AC91BE
CloseHandle.KERNEL32(00000000), ref: 02AC922A
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 02AC9247

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ErrorLast$HeapTimerWaitable_free$AllocateCloseCreateEventsException@8FreeHandleMultipleThrowWait_mallocstd::exception::exception
String ID:
API String ID: 1916819448-0
Opcode ID: 9ee263c3478dad4a74fc7286b71695040ba42145a956828c94f54f9b7f722704
Instruction ID: 23a41949252b8d044b843990f2c919960a307b603fa4c74be0181a5f7b8c3f37
Opcode Fuzzy Hash: 9ee263c3478dad4a74fc7286b71695040ba42145a956828c94f54f9b7f722704
Instruction Fuzzy Hash: BBC15A70A006069FDB20DF69C984B6BB7E5AF88714F20452ED856D7380EF35E905CBA1

Function 0006386E Relevance: 16.6, APIs: 11, Instructions: 106memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(001DFD28,?,?,?,001DFD0C,001DFD0C,?,00063CC4,00000004,0005B9B7,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00063881
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,001DFD0C,001DFD0C,?,00063CC4,00000004,0005B9B7,00055FA4,00055A05,?,0005612F,00000004), ref: 000638D7
GlobalHandle.KERNEL32(00F82A50), ref: 000638E0
GlobalUnlock.KERNEL32(00000000), ref: 000638EA
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 00063903
GlobalHandle.KERNEL32(00F82A50), ref: 00063915
GlobalLock.KERNEL32(00000000), ref: 0006391C
LeaveCriticalSection.KERNEL32(?,?,?,?,001DFD0C,001DFD0C,?,00063CC4,00000004,0005B9B7,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00063925
GlobalLock.KERNEL32(00000000), ref: 00063931
_memset.LIBCMT ref: 0006394B
LeaveCriticalSection.KERNEL32(?), ref: 00063979

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 366908a5b594257ac37637e4e93b759aa5c0a5719aa51cecf8e950ca8a83d10e
Instruction ID: c80f0ddce8c6d6a3248b0ce43173ddd117baf9c6258850d6b197b1db9ce32c01
Opcode Fuzzy Hash: 366908a5b594257ac37637e4e93b759aa5c0a5719aa51cecf8e950ca8a83d10e
Instruction Fuzzy Hash: A6319271600705AFD7209F68DC89AAB7BFAFF44301B05892DF596D3651DBB0F9848BA0

Function 02AC7ED0 Relevance: 15.1, APIs: 10, Instructions: 113networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000030), ref: 02AC7EE8
connect.WS2_32(?,?,-0000001D), ref: 02AC7F10
WSAGetLastError.WS2_32 ref: 02AC7F23
connect.WS2_32(?,?,-0000001D), ref: 02AC7F57
WSAEventSelect.WS2_32(?,?,00000023), ref: 02AC7F70
SetLastError.KERNEL32(00000000), ref: 02AC7F8F
GetLastError.KERNEL32 ref: 02AC7FA6
WSASetLastError.WS2_32(00000000), ref: 02AC7FB6
send.WS2_32(?,00000000,00000000,00000000), ref: 02AC7FCD
WSAGetLastError.WS2_32 ref: 02AC7FD8

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ErrorLast$EventSelectconnect$send
String ID:
API String ID: 1826129850-0
Opcode ID: db0e6b55fa194824f9a580f305f216198b010f089ef1d46bbc437be572e4d4a7
Instruction ID: 72bc9f529c6eae8dc79247f030a106e6e73816667db6b29a52d278afc9f44f3d
Opcode Fuzzy Hash: db0e6b55fa194824f9a580f305f216198b010f089ef1d46bbc437be572e4d4a7
Instruction Fuzzy Hash: 1131AE766006005FD3249B79DC88A2BB6A9EB85728F254B1DF567C72C0DF74E816CBA0

Function 02AC87C0 Relevance: 13.7, APIs: 9, Instructions: 154networkCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02AC8803
RtlLeaveCriticalSection.NTDLL(?), ref: 02AC884E
send.WS2_32(?,?,?,00000000), ref: 02AC8877
RtlEnterCriticalSection.NTDLL(?), ref: 02AC888A
RtlLeaveCriticalSection.NTDLL(?), ref: 02AC889D
SetLastError.KERNEL32(00000000), ref: 02AC88A5
WSAGetLastError.WS2_32 ref: 02AC8902
RtlEnterCriticalSection.NTDLL(?), ref: 02AC8916
RtlLeaveCriticalSection.NTDLL(?), ref: 02AC894F

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ErrorLast$send
String ID:
API String ID: 484515946-0
Opcode ID: 5b38e954412739a36cd404b5ff002e40a2d073c9f8088665b4e1c6f7476473a4
Instruction ID: 357eec2bf1f3705a378745fd9a6744fe085a0652cfb55f3e472fc91ba9e7e0d9
Opcode Fuzzy Hash: 5b38e954412739a36cd404b5ff002e40a2d073c9f8088665b4e1c6f7476473a4
Instruction Fuzzy Hash: 7A514DB1904701DFD325CF68D988BAAB7F4FB48714F604A2EE46AC7740DF34A4458B61

Function 03170080 Relevance: 13.6, APIs: 9, Instructions: 134networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 03170123
GetLastError.KERNEL32 ref: 0317018D

Part of subcall function 0316EC80: WSAEventSelect.WS2_32(?,?,00000030), ref: 0316EC98
Part of subcall function 0316EC80: connect.WS2_32(?,?,-0000001D), ref: 0316ECC0
Part of subcall function 0316EC80: WSAGetLastError.WS2_32 ref: 0316ECD3

ResetEvent.KERNEL32(?), ref: 0317015F
WSAGetLastError.WS2_32 ref: 0317017E
WSAGetLastError.WS2_32 ref: 031701A5
WSAGetLastError.WS2_32 ref: 031701B4
SetLastError.KERNEL32(00000000), ref: 031701C8
GetLastError.KERNEL32 ref: 031701DE
SetLastError.KERNEL32(00000000), ref: 031701F0

Part of subcall function 0316EBA0: bind.WS2_32(?,?,-0000001D), ref: 0316EBD8

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorLast$Event$ResetSelectbindconnect
String ID:
API String ID: 1052395590-0
Opcode ID: 7941073b592968c75d3423f17860b0578407a7094083e5ca4c2755215deefc63
Instruction ID: d17d8d7e43e9e3d3f59a4dca048bb5999cb9ccbf1555d233971a80ca8290c3d6
Opcode Fuzzy Hash: 7941073b592968c75d3423f17860b0578407a7094083e5ca4c2755215deefc63
Instruction Fuzzy Hash: AC417D762007049FD724EFAADC80A6BB3F9AF9C300F19851EE946C7250DF75E9458BA1

Function 03161BD0 Relevance: 13.6, APIs: 9, Instructions: 101synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 03161BE2
ResetEvent.KERNEL32(?), ref: 03161BE8
timeGetTime.WINMM ref: 03161BEA
InterlockedExchange.KERNEL32(?,00000000), ref: 03161BF9
WaitForSingleObject.KERNEL32(?,00001770), ref: 03161C5B
ResetEvent.KERNEL32(?), ref: 03161C75
ResetEvent.KERNEL32(?), ref: 03161C84

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: EventReset$ExchangeInterlockedObjectSingleTimeWaittime
String ID:
API String ID: 3684151993-0
Opcode ID: 1b6ff7c6fb09a652f1d6539bb8b4a66c9172d8da201e61a17dd97bf33802d5bb
Instruction ID: 64eed0a11b7eab8cc7472d812f400a699cfe1f98d7af40567162c3478479d2cf
Opcode Fuzzy Hash: 1b6ff7c6fb09a652f1d6539bb8b4a66c9172d8da201e61a17dd97bf33802d5bb
Instruction Fuzzy Hash: B2315E76240704AFD324EBAADC81B5AB7E8BF88324F10891AE646C7640DA71F441CB60

Function 0316F3A0 Relevance: 13.6, APIs: 9, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,76CB4AAF,?,?,?,?,?,03182FB8,000000FF), ref: 0316F3D2
_free.LIBCMT ref: 0316F3E5

Part of subcall function 03171DA4: HeapFree.KERNEL32(00000000,00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171DBA
Part of subcall function 03171DA4: GetLastError.KERNEL32(00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000), ref: 03171DCC

ResetEvent.KERNEL32(?,?,?,?,?,?,03182FB8,000000FF), ref: 0316F403
ResetEvent.KERNEL32(?,?,?,?,?,?,03182FB8,000000FF), ref: 0316F40C
ResetEvent.KERNEL32(?,?,?,?,?,?,03182FB8,000000FF), ref: 0316F415
HeapDestroy.KERNELBASE(?,?,?,?,?,?,03182FB8,000000FF), ref: 0316F435
HeapCreate.KERNEL32(?,?,?,?,?,?,?,?,03182FB8,000000FF), ref: 0316F447
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0316F47B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0316F485

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Event$HeapReset$CriticalSection$CreateDestroyEnterErrorFreeLastLeave_free
String ID:
API String ID: 465610239-0
Opcode ID: 6349975aaa98440d5c3c6a1eb11c2cba81c0c07db4fa42ffd3e3371327cec7eb
Instruction ID: 6544ec5e717bf527cc9fbc54c9eec6f31b5202aac586c1d5194a255949a4eab3
Opcode Fuzzy Hash: 6349975aaa98440d5c3c6a1eb11c2cba81c0c07db4fa42ffd3e3371327cec7eb
Instruction Fuzzy Hash: 1A31E9B5900B049FC724DFA6D884A9BF7E8FF4C310F404A2EE59AC3610DB34A940CB60

Function 03170700 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03170728

Part of subcall function 03171DA4: HeapFree.KERNEL32(00000000,00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171DBA
Part of subcall function 03171DA4: GetLastError.KERNEL32(00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000), ref: 03171DCC

_malloc.LIBCMT ref: 03170776
_free.LIBCMT ref: 03170791
std::exception::exception.LIBCMT ref: 031707BD
__CxxThrowException@8.LIBCMT ref: 031707D2
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF), ref: 03170820

Strings

bad allocation, xrefs: 031707B6

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _free$ErrorException@8FreeHeapLastThrowTimerWaitable_mallocstd::exception::exception
String ID: bad allocation
API String ID: 2829241915-2104205924
Opcode ID: 9b9e12c2a34fd27d2e868dd0a10dd5ad6c4ee7612475f62fcd1aaf966b2c9dbb
Instruction ID: 02f015d2b525a9e26699fe60b47200b269e3de91602d4a1853058377ce2951f8
Opcode Fuzzy Hash: 9b9e12c2a34fd27d2e868dd0a10dd5ad6c4ee7612475f62fcd1aaf966b2c9dbb
Instruction Fuzzy Hash: 3B3170B5A41701AFE720DF79D884BDAF3F9AB8C300F18052DD45AD7240EB31A9408F61

Function 02AC3140 Relevance: 10.7, APIs: 7, Instructions: 203sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02ACAE62: __fassign.LIBCMT ref: 02ACAE58

Sleep.KERNEL32(00000000), ref: 02AC3194
Sleep.KERNEL32(000007D0), ref: 02AC31B5
Sleep.KERNEL32(00000000), ref: 02AC3327
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02AC3372
Sleep.KERNEL32(000003E8), ref: 02AC33D0
CloseHandle.KERNEL32(?), ref: 02AC3415
CloseHandle.KERNEL32(?), ref: 02AC3451

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Sleep$CloseHandle$CreateEvent__fassign
String ID:
API String ID: 1692144934-0
Opcode ID: bf6681e49355ba57ee50e69d6f4fd79ba025dfd6c7366d0470a5f89297976b58
Instruction ID: 9755f9d3e8f63fab76722838bbe218a2817e68d127711bfc63c4916da282f1fd
Opcode Fuzzy Hash: bf6681e49355ba57ee50e69d6f4fd79ba025dfd6c7366d0470a5f89297976b58
Instruction Fuzzy Hash: 4571D9B1E89381EFDF20EF649D8166AB7E4BB84304F10496DE14A9B341DF70D546CB92

Function 02AC5F70 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02AC5FB8
_free.LIBCMT ref: 02AC5FF6
_free.LIBCMT ref: 02AC6035
_free.LIBCMT ref: 02AC6075
_free.LIBCMT ref: 02AC609D
_free.LIBCMT ref: 02AC60C1
_free.LIBCMT ref: 02AC60F9

Part of subcall function 02ACB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1DE
Part of subcall function 02ACB1C8: GetLastError.KERNEL32(00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1F0

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9266aa3aa819598bc856cdfbf9be2ae0cfd4355612125d75a70991d15d58d72f
Instruction ID: 402214cae09f9521d3a93d32f5d75277dc925290b2400036d255b1b08162d549
Opcode Fuzzy Hash: 9266aa3aa819598bc856cdfbf9be2ae0cfd4355612125d75a70991d15d58d72f
Instruction Fuzzy Hash: A0512BB2A00211DFCB14DF58C5C0969BBA6FF8831872985ADD50A6F311CB72BD56CF91

Function 0316C2F0 Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000001,00000004), ref: 0316C325
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 0316C337
setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000000,00000004), ref: 0316C35E
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 0316C370

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 9b789cf924648c1d935e709142f52960d97c4d0e4c391787c9dc1aa7301bc3b0
Instruction ID: 253e2b7c7b4ec86ed266c63a54f214e4fbe4da203b86d96f8b876930c07cee82
Opcode Fuzzy Hash: 9b789cf924648c1d935e709142f52960d97c4d0e4c391787c9dc1aa7301bc3b0
Instruction Fuzzy Hash: 8021D87274421A7EEA10D684EC81FBDB328DF8AB74F200365FB14EB2C0DA70990493D4

Function 02AC2190 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82sleepCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02AC21C5
GetExitCodeProcess.KERNEL32(00000000,?), ref: 02AC224B
Sleep.KERNEL32(00000BB8), ref: 02AC2264
_wprintf.LIBCMT ref: 02AC2272

Strings

denglupeizhi, xrefs: 02AC21A6
houmenpeizhi, xrefs: 02AC21D5

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CodeExitProcessSleep_memmove_wprintf
String ID: denglupeizhi$houmenpeizhi
API String ID: 272709134-95055996
Opcode ID: f1e6e4eaa48138ca64f4eeddfb4d142d75cd8efc3763ccafbf1ddaa8293bb3dc
Instruction ID: 3825c9790c760f385b4cfc2cfe5ff1d0926a10aca69a98765ecb8772ffea25b7
Opcode Fuzzy Hash: f1e6e4eaa48138ca64f4eeddfb4d142d75cd8efc3763ccafbf1ddaa8293bb3dc
Instruction Fuzzy Hash: 0E210772E443009BDA109F689C45B5B3798AB54328F54092DFD55D7181EF30D9168BE2

Function 031717EF Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 03171814
__calloc_crt.LIBCMT ref: 03171820
__getptd.LIBCMT ref: 0317182D
CreateThread.KERNEL32(00000000,?,0317178A,00000000,00000000,0316A571), ref: 03171864
GetLastError.KERNEL32(?,0316A571,00000000,00000000,03162F50,?,00000000,00000000), ref: 0317186E
_free.LIBCMT ref: 03171877
__dosmaperr.LIBCMT ref: 03171882

Part of subcall function 03174208: __getptd_noexit.LIBCMT ref: 03174208

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 41a32cc95d93ef5ffd08d53fe902a1f758f605d282db4b27b33b57208a2a560a
Instruction ID: bb0eba1c5e1cae8a48457bf9f34584fd323746fa53b87f0979e3b407e5f5c2e8
Opcode Fuzzy Hash: 41a32cc95d93ef5ffd08d53fe902a1f758f605d282db4b27b33b57208a2a560a
Instruction Fuzzy Hash: FC11CE3A2443067FEB15FFA6EC4099B77B8EF5D664B1D4139F8148A190DF35D8118AA0

Function 02ACAA21 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02ACAA46
__calloc_crt.LIBCMT ref: 02ACAA52
__getptd.LIBCMT ref: 02ACAA5F
CreateThread.KERNEL32(?,?,02ACA9BC,00000000,?,?), ref: 02ACAA96
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 02ACAAA0
_free.LIBCMT ref: 02ACAAA9
__dosmaperr.LIBCMT ref: 02ACAAB4

Part of subcall function 02ACCA78: __getptd_noexit.LIBCMT ref: 02ACCA78

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 87b51194288ae1c755ca203406bbf3cfacae01e49a6765e7d02d5b1c6ccd5ae7
Instruction ID: 96aced947f7ad981de01c47993b8a0b1912878c4ed8f453da12ab10e80988184
Opcode Fuzzy Hash: 87b51194288ae1c755ca203406bbf3cfacae01e49a6765e7d02d5b1c6ccd5ae7
Instruction Fuzzy Hash: 5311E53314470AAFDB14AFA4AE459AB37DBEF05374B71042EF919D6152EF31D8018BA0

Function 0005B140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0005B173
SetLastError.KERNEL32(0000006F), ref: 0005B18A
CreateActCtxWWorker.KERNEL32(?), ref: 0005B1D2
CreateActCtxWWorker.KERNEL32(00000020), ref: 0005B1F0
CreateActCtxWWorker.KERNEL32(00000020), ref: 0005B212

Strings

, xrefs: 0005B1B4

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CreateWorker$ErrorFileLastModuleName
String ID:
API String ID: 3218422885-3916222277
Opcode ID: aea42211f5488f65625ca7266951f4cf8418faf47896bcfd9ad7ac19420565de
Instruction ID: 50308823a91371e1473af521dd7640e7e03d9d67dde9935e2a3abf6ceb3d68ed
Opcode Fuzzy Hash: aea42211f5488f65625ca7266951f4cf8418faf47896bcfd9ad7ac19420565de
Instruction Fuzzy Hash: 92216D718002189ACB60EF65DC987EEB7F8BF54324F108699D469E2190DB746A89CF60

Function 000514C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000514D7
_memset.LIBCMT ref: 00051509
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00051526
Process32NextW.KERNEL32(000000FF,0000022C), ref: 00051542
CloseHandle.KERNEL32(000000FF), ref: 00051576

Strings

P, xrefs: 00051562

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID: P
API String ID: 2526126748-3110715001
Opcode ID: e151185c789122c81ad986e06435044180501659dbd91e4fc5806d44bd670220
Instruction ID: fdd7cba5d88e8b93db214f181c26a6a36be6cd95b53ac0a63c04e3288eb063a4
Opcode Fuzzy Hash: e151185c789122c81ad986e06435044180501659dbd91e4fc5806d44bd670220
Instruction Fuzzy Hash: CA11DA70901218EBDB20EFA4DC9DBEDB7B4EB48711F504299E90AA6291DB785BC4CF50

Function 03164210 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,03164323), ref: 0316423D
GetProcAddress.KERNEL32(00000000), ref: 03164244
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03164323), ref: 03164252
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03164323), ref: 0316425A

Strings

GetNativeSystemInfo, xrefs: 03164218
kernel32.dll, xrefs: 0316421D

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: a8b90bee2ddbe41d94f85adff68f97213925118747c72bdd2a833239132d49a3
Instruction ID: dba8bfa1d240ba42989bc82c8e457ff51cc307c6476213f7a8e5b7275a01154e
Opcode Fuzzy Hash: a8b90bee2ddbe41d94f85adff68f97213925118747c72bdd2a833239132d49a3
Instruction Fuzzy Hash: 5301D670D002099FCF54EFF5A8446AEBAF4AB4C301F6445AAD81AE3240EB759A508BA4

Function 000D7D69 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000D7D70

Part of subcall function 0006872C: EnterCriticalSection.KERNEL32(001E0170,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068766
Part of subcall function 0006872C: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068778
Part of subcall function 0006872C: LeaveCriticalSection.KERNEL32(001E0170,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068785
Part of subcall function 0006872C: EnterCriticalSection.KERNEL32(?,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068795

GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 000D7DC8
GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 000D7DDA

Strings

windows, xrefs: 000D7DC2, 000D7DC7, 000D7DD4
DragMinDist, xrefs: 000D7DBD
DragDelay, xrefs: 000D7DCF

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: 412ea557a2dd6cb9b28e63a6e58b40476ada01e64e0b8523583c91bd2a26385b
Instruction ID: 78503f12fda344d887fb7753710ffa58b262a776e52dd67733ddb48df941da34
Opcode Fuzzy Hash: 412ea557a2dd6cb9b28e63a6e58b40476ada01e64e0b8523583c91bd2a26385b
Instruction Fuzzy Hash: 610171B19457009AC7219F6A8DC1B8AFAF8BF94700F50460FF6899BB61CBF095418F94

Function 0317178A Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 03171790

Part of subcall function 03174429: TlsGetValue.KERNEL32(00000000,03174582,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000,00000000), ref: 03174432
Part of subcall function 03174429: DecodePointer.KERNEL32(?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000,00000000,?,0317468F,0000000D), ref: 03174444
Part of subcall function 03174429: TlsSetValue.KERNEL32(00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000,00000000,?,0317468F), ref: 03174453

___fls_getvalue@4.LIBCMT ref: 0317179B

Part of subcall function 03174409: TlsGetValue.KERNEL32(?,?,031717A0,00000000), ref: 03174417

___fls_setvalue@8.LIBCMT ref: 031717AE

Part of subcall function 0317445D: DecodePointer.KERNEL32(?,?,?,031717B3,00000000,?,00000000), ref: 0317446E

GetLastError.KERNEL32(00000000,?,00000000), ref: 031717B7
ExitThread.KERNEL32 ref: 031717BE
GetCurrentThreadId.KERNEL32 ref: 031717C4
__freefls@4.LIBCMT ref: 031717E4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 17323d5f719a9f38bd209ede237c46208206def8f3ccc4e9913bde1c3ae7f75e
Instruction ID: 0aeca954c40d1a9621d022b42a790ec6753e5c4911dfbf922bbcd8811ffa5dab
Opcode Fuzzy Hash: 17323d5f719a9f38bd209ede237c46208206def8f3ccc4e9913bde1c3ae7f75e
Instruction Fuzzy Hash: EBF03079505701BFC708FFB3D90888E7BBDAF4D2443198464A8068F215DF34D482DBA5

Function 02ACA9BC Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02ACA9C2

Part of subcall function 02ACCB2A: TlsGetValue.KERNEL32(7FFFFFFF,02ACCC83,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000,?,02ACAE5D,?), ref: 02ACCB33
Part of subcall function 02ACCB2A: RtlDecodePointer.NTDLL ref: 02ACCB45
Part of subcall function 02ACCB2A: TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000,?,02ACAE5D,?,00000000), ref: 02ACCB54

___fls_getvalue@4.LIBCMT ref: 02ACA9CD

Part of subcall function 02ACCB0A: TlsGetValue.KERNEL32(?,?,02ACA9D2,00000000), ref: 02ACCB18

___fls_setvalue@8.LIBCMT ref: 02ACA9E0

Part of subcall function 02ACCB5E: RtlDecodePointer.NTDLL(?), ref: 02ACCB6F

GetLastError.KERNEL32(00000000,?,00000000), ref: 02ACA9E9
RtlExitUserThread.NTDLL(00000000), ref: 02ACA9F0
GetCurrentThreadId.KERNEL32 ref: 02ACA9F6
__freefls@4.LIBCMT ref: 02ACAA16

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLastUser___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2876972746-0
Opcode ID: a34b3c3ef099db5f1e540699deb38b3bf0add630916dd8188b95f34c95cb706e
Instruction ID: 45038e8e9eda02fbdbfd1dec2b44e10599945bb52805f91409264a952fa2d6fa
Opcode Fuzzy Hash: a34b3c3ef099db5f1e540699deb38b3bf0add630916dd8188b95f34c95cb706e
Instruction Fuzzy Hash: 23F03674541644AFC708BFA1C64885E7BEBEF48354731885DEA0AC7211EF34D882CFA0

Function 02AC3460 Relevance: 9.1, APIs: 6, Instructions: 149sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02ACAE62: __fassign.LIBCMT ref: 02ACAE58

Sleep.KERNEL32(00000000), ref: 02AC34BA
Sleep.KERNEL32(000007D0), ref: 02AC34CC
Sleep.KERNEL32(00000000), ref: 02AC3557
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02AC35A5
CloseHandle.KERNEL32(?), ref: 02AC364D

Part of subcall function 02ACA8DC: _malloc.LIBCMT ref: 02ACA8F6

CloseHandle.KERNEL32(?), ref: 02AC368E

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Sleep$CloseHandle$CreateEvent__fassign_malloc
String ID:
API String ID: 1495094446-0
Opcode ID: f7ef7b57bfa56eaff803c8bb85a72ed7ecdedbc3a04a581659cc9099eb1188e7
Instruction ID: 5689d9e7a2e5f480de2ac882fc63c6de398ec1b140790d079e903ec706809735
Opcode Fuzzy Hash: f7ef7b57bfa56eaff803c8bb85a72ed7ecdedbc3a04a581659cc9099eb1188e7
Instruction Fuzzy Hash: 975180B0A44744DFDB31DF28D98479BB7E4BB88718F204A5CE4999B280DF34D646CB92

Function 02AC92D0 Relevance: 9.1, APIs: 6, Instructions: 134networkCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 02AC93DD

Part of subcall function 02AC7ED0: WSAEventSelect.WS2_32(?,?,00000030), ref: 02AC7EE8
Part of subcall function 02AC7ED0: connect.WS2_32(?,?,-0000001D), ref: 02AC7F10
Part of subcall function 02AC7ED0: WSAGetLastError.WS2_32 ref: 02AC7F23

ResetEvent.KERNEL32(?), ref: 02AC93AF
WSAGetLastError.WS2_32 ref: 02AC93CE
WSAGetLastError.WS2_32 ref: 02AC93F5
WSAGetLastError.WS2_32 ref: 02AC9404
GetLastError.KERNEL32 ref: 02AC942E

Part of subcall function 02AC7DF0: bind.WS2_32(?,?,-0000001D), ref: 02AC7E28

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ErrorLast$Event$ResetSelectbindconnect
String ID:
API String ID: 1052395590-0
Opcode ID: 21bdc4ca709c0f361c423366ff6bdf194a57da5d40fcb82d7c89943e93df3dac
Instruction ID: 94b39d10c264673c44b651f03e2c0dc344f8b52a0f33b448da657c28b00ed27d
Opcode Fuzzy Hash: 21bdc4ca709c0f361c423366ff6bdf194a57da5d40fcb82d7c89943e93df3dac
Instruction Fuzzy Hash: 8D4181756006058FCB20DFA9D884AABB3F9BF88304F11892EE946C7350DF75E905CBA1

Function 02AC9945 Relevance: 9.1, APIs: 6, Instructions: 109timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02AC9978

Part of subcall function 02ACB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1DE
Part of subcall function 02ACB1C8: GetLastError.KERNEL32(00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1F0

_malloc.LIBCMT ref: 02AC99C6
_free.LIBCMT ref: 02AC99E1
std::exception::exception.LIBCMT ref: 02AC9A0D
__CxxThrowException@8.LIBCMT ref: 02AC9A22
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF), ref: 02AC9A70

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: _free$ErrorException@8FreeHeapLastThrowTimerWaitable_mallocstd::exception::exception
String ID:
API String ID: 2829241915-0
Opcode ID: c61216030a0083193b6bc4dd9242a55646730d93326cb99f3d9cc764e2e21561
Instruction ID: 3b084f0480040023dbe04f0a9ca51c61d5958108a337781a7d86d6b49a7a8b54
Opcode Fuzzy Hash: c61216030a0083193b6bc4dd9242a55646730d93326cb99f3d9cc764e2e21561
Instruction Fuzzy Hash: F1316FB1A417059BD720DF7989C0BEBB7E9BF89314F20082DE55AD7240DF32E9058B61

Function 02AC9950 Relevance: 9.1, APIs: 6, Instructions: 102timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02AC9978

Part of subcall function 02ACB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1DE
Part of subcall function 02ACB1C8: GetLastError.KERNEL32(00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1F0

_malloc.LIBCMT ref: 02AC99C6
_free.LIBCMT ref: 02AC99E1
std::exception::exception.LIBCMT ref: 02AC9A0D
__CxxThrowException@8.LIBCMT ref: 02AC9A22
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF), ref: 02AC9A70

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: _free$ErrorException@8FreeHeapLastThrowTimerWaitable_mallocstd::exception::exception
String ID:
API String ID: 2829241915-0
Opcode ID: d1710d838b8baa2502b0b90cb55b643f6c81e17ec30b9740c27da5be24c91745
Instruction ID: 5e637e10def97c0376ea2309b8e6d47a3698f163bf5c2ba5f28bba4a1c2806d0
Opcode Fuzzy Hash: d1710d838b8baa2502b0b90cb55b643f6c81e17ec30b9740c27da5be24c91745
Instruction Fuzzy Hash: 613152B1A417059BD720DF7989C0BEBB7E9BF85314F20082DD45AD7240DF32E9058B61

Function 02AC85F0 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02AC8622
_free.LIBCMT ref: 02AC8635

Part of subcall function 02ACB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1DE
Part of subcall function 02ACB1C8: GetLastError.KERNEL32(00000000,?,02ACCCD6,00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000), ref: 02ACB1F0

HeapDestroy.KERNELBASE(?,?,?,?,?,?,02ADA808,000000FF), ref: 02AC8685
HeapCreate.KERNEL32(?,?,?,?,?,?,?,?,02ADA808,000000FF), ref: 02AC8697
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AC86CB
RtlLeaveCriticalSection.NTDLL(?), ref: 02AC86D5

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Heap$CriticalSection$CreateDestroyEnterErrorEventFreeLastLeave_free
String ID:
API String ID: 2758866208-0
Opcode ID: 6b69bb5535bbe491ae7c5978da948eea46c9eef4d4e98b8e1d567796cd53584c
Instruction ID: 705537a0662de40bcfe514e15d4ed87a245ff006b35f9c2fd2965ac15711a460
Opcode Fuzzy Hash: 6b69bb5535bbe491ae7c5978da948eea46c9eef4d4e98b8e1d567796cd53584c
Instruction Fuzzy Hash: A831E6B5940B049FD720DF65D884AABF7E8FB48714F504E2EE59AC3600DB34A905CB60

Function 0316EA50 Relevance: 9.1, APIs: 6, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000023), ref: 0316EA6B
WSAGetLastError.WS2_32 ref: 0316EA76
SetLastError.KERNEL32(00000000), ref: 0316EAA6
send.WS2_32(?,00000000,00000000,00000000), ref: 0316EAC7
WSAGetLastError.WS2_32 ref: 0316EAD2
GetLastError.KERNEL32 ref: 0316EAF5

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: 8838096362e5f4f665898bbf5fd778746dfa16fa9edc5efc1e1ad8b8bc133ab0
Instruction ID: bf096bbc91084177046c3ad6319c83a99db7b646ab7f14b7c4d34dc211a13698
Opcode Fuzzy Hash: 8838096362e5f4f665898bbf5fd778746dfa16fa9edc5efc1e1ad8b8bc133ab0
Instruction Fuzzy Hash: B32162752007018FE334DFAAE848B17BBE8FB98720F144A2DE646C7680DB75E450DBA4

Function 02AC7CA0 Relevance: 9.1, APIs: 6, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000023), ref: 02AC7CBB
WSAGetLastError.WS2_32 ref: 02AC7CC6
SetLastError.KERNEL32(00000000), ref: 02AC7CF6
send.WS2_32(?,00000000,00000000,00000000), ref: 02AC7D17
WSAGetLastError.WS2_32 ref: 02AC7D22
GetLastError.KERNEL32 ref: 02AC7D45

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: 0bb72c26beee1fec9d7195c953b35026c0f323aee562f0388b5516f73687aa19
Instruction ID: 1226c4b754fcb9bedf59aa98cbc14cb9530d9a1696e28281391d03594464aeea
Opcode Fuzzy Hash: 0bb72c26beee1fec9d7195c953b35026c0f323aee562f0388b5516f73687aa19
Instruction Fuzzy Hash: 38214F756407008FE3308F69E848B17B7F8EB40324F204E2EE656CA690CB75E4058FA0

Function 02ACA9B0 Relevance: 9.0, APIs: 6, Instructions: 29threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02ACD2B2: _doexit.LIBCMT ref: 02ACD2BE

___set_flsgetvalue.LIBCMT ref: 02ACA9C2

Part of subcall function 02ACCB2A: TlsGetValue.KERNEL32(7FFFFFFF,02ACCC83,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000,?,02ACAE5D,?), ref: 02ACCB33
Part of subcall function 02ACCB2A: RtlDecodePointer.NTDLL ref: 02ACCB45
Part of subcall function 02ACCB2A: TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,02ACF702,?,?,02AE012C,00000000,?,02ACAE5D,?,00000000), ref: 02ACCB54

___fls_getvalue@4.LIBCMT ref: 02ACA9CD

Part of subcall function 02ACCB0A: TlsGetValue.KERNEL32(?,?,02ACA9D2,00000000), ref: 02ACCB18

___fls_setvalue@8.LIBCMT ref: 02ACA9E0

Part of subcall function 02ACCB5E: RtlDecodePointer.NTDLL(?), ref: 02ACCB6F

GetLastError.KERNEL32(00000000,?,00000000), ref: 02ACA9E9
RtlExitUserThread.NTDLL(00000000), ref: 02ACA9F0
GetCurrentThreadId.KERNEL32 ref: 02ACA9F6
__freefls@4.LIBCMT ref: 02ACAA16

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLastUser___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 811752470-0
Opcode ID: 2152f56fc22d44d4fb3e2358c4847715f05f919b642d7c247af789c8ce476fed
Instruction ID: c453d4bd19c41b186dfab679c4fe5af8e9b690f0b99c00b5bb98f1c7b00f4d86
Opcode Fuzzy Hash: 2152f56fc22d44d4fb3e2358c4847715f05f919b642d7c247af789c8ce476fed
Instruction Fuzzy Hash: D5E0E575881209ABCB143FF18A0999F7A6BAD04354F314C19FB17D3515FE24D5518EB1

Function 031716AA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 031716C4

Part of subcall function 03171DDE: __FF_MSGBANNER.LIBCMT ref: 03171DF7
Part of subcall function 03171DDE: __NMSG_WRITE.LIBCMT ref: 03171DFE
Part of subcall function 03171DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171E23

std::exception::exception.LIBCMT ref: 031716F9
std::exception::exception.LIBCMT ref: 03171713
__CxxThrowException@8.LIBCMT ref: 03171724

Strings

bad allocation, xrefs: 031716F2

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: d5bdc5c65e9d97ea67ba04359e62dc6e69fab1135276f25aec1d45ab5106551b
Instruction ID: ec2e9f0bbbbf6e9dd53424c7fa1b0766c6437169c0ef742204eb11d25e6fc5e9
Opcode Fuzzy Hash: d5bdc5c65e9d97ea67ba04359e62dc6e69fab1135276f25aec1d45ab5106551b
Instruction Fuzzy Hash: 17F0F938900307BBDF18FF52D804AED76B5AB0C250F1D047AE814EA090CFB295828F55

Function 02ACA8DC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02ACA8F6

Part of subcall function 02ACB087: __FF_MSGBANNER.LIBCMT ref: 02ACB0A0
Part of subcall function 02ACB087: __NMSG_WRITE.LIBCMT ref: 02ACB0A7
Part of subcall function 02ACB087: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 02ACB0CC

std::exception::exception.LIBCMT ref: 02ACA92B
std::exception::exception.LIBCMT ref: 02ACA945
__CxxThrowException@8.LIBCMT ref: 02ACA956

Strings

W), xrefs: 02ACA9A8

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: W)
API String ID: 615853336-1400489827
Opcode ID: 5b4c81b06b59b06ebeb660e0c899f7c9a46409e293e7bb0ec94a7ca9e6a00fef
Instruction ID: 86e44e8d37d747b7fe83dd120225b17f121df2046ac4746d2fa8d6f1bd3840bc
Opcode Fuzzy Hash: 5b4c81b06b59b06ebeb660e0c899f7c9a46409e293e7bb0ec94a7ca9e6a00fef
Instruction Fuzzy Hash: 91F0D63594021DEBDF04EF65D905ABE36A6AB00728F20045EE41696081CF71CE02DFD1

Function 0316B2E0 Relevance: 7.6, APIs: 5, Instructions: 147COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,76CB4AAF,00000000,00000000,74DF0F00,00000004,0316C01F,03182DFC,000000FF,?,0316BB12,0316C01F,76CB4AAF), ref: 0316B31F
InitializeCriticalSectionAndSpinCount.KERNEL32(00000158,00000000,00000400,00000400,00001000,?,0316BB12,0316C01F,76CB4AAF,00000000,0316A3DC,74DF0F00,00000000,00000000,03182EEF,000000FF), ref: 0316B3F1
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,0316BB12,0316C01F,76CB4AAF,00000000,0316A3DC,74DF0F00,00000000,00000000,03182EEF,000000FF), ref: 0316B42F
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,0316BB12,0316C01F,76CB4AAF,00000000,0316A3DC,74DF0F00,00000000,00000000,03182EEF,000000FF), ref: 0316B454
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,0316BB12,0316C01F,76CB4AAF,00000000,0316A3DC,74DF0F00,00000000,00000000,03182EEF,000000FF), ref: 0316B479

Part of subcall function 031662D0: __CxxThrowException@8.LIBCMT ref: 031662E2
Part of subcall function 031662D0: GdipCloneImage.GDIPLUS(?,00000002,00000074,?,?,0316C01F,0318976C,?,0316B100,80004005,?,0316B3DF,00000400,00000400,00001000), ref: 03166306
Part of subcall function 031662D0: GdipAlloc.GDIPLUS(00000010,?,?,0316C01F,0318976C,?,0316B100,80004005,?,0316B3DF,00000400,00000400,00001000,?,0316BB12,0316C01F), ref: 03166315

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateEvent$Gdip$AllocCloneCountCriticalException@8ImageInitializeSectionSpinThrow
String ID:
API String ID: 2321832077-0
Opcode ID: d2e6f2e583f3cb2fa99ee5735f7099959983e349dfbb6afc28bed947adf39020
Instruction ID: 70e137124996d832d43d84f2f3726f0649f6611ad51b289c5f51847fc57ffdf8
Opcode Fuzzy Hash: d2e6f2e583f3cb2fa99ee5735f7099959983e349dfbb6afc28bed947adf39020
Instruction Fuzzy Hash: 9A511AB1904B44AFD320DF6AC884A9BFBF8FF99700F10891ED19AD7650D7B4A540CB64

Function 031613B0 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 031613D2
CancelIo.KERNEL32(?), ref: 031613DC
InterlockedExchange.KERNEL32(?,00000000), ref: 031613E8
closesocket.WS2_32(?), ref: 031613F2
SetEvent.KERNEL32(?), ref: 031613FC

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 39c63857c3de74a38a60b15b11cc7ae642286c65c9e89bf79f2be1312b5901c0
Instruction ID: 809117a85e5627b7db523da00773373760b6564f09e247b6a0f670633d440990
Opcode Fuzzy Hash: 39c63857c3de74a38a60b15b11cc7ae642286c65c9e89bf79f2be1312b5901c0
Instruction Fuzzy Hash: 61F09075100701AFC328EBD5E908E67B7B8EB4CB10F004A0CFA4287684CFB4B944CBA4

Function 02AC13B0 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02AC13D2
CancelIo.KERNEL32(?), ref: 02AC13DC
InterlockedExchange.KERNEL32(?,00000000), ref: 02AC13E8
closesocket.WS2_32(?), ref: 02AC13F2
SetEvent.KERNEL32(?), ref: 02AC13FC

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: e12c4abf4fba4e2f8649acf591e350c1235ef639440792648048982d6ff3831f
Instruction ID: 75cd33c22391c2be9159c31fa13ceaf713e826c330b85de19dbcebb27510b457
Opcode Fuzzy Hash: e12c4abf4fba4e2f8649acf591e350c1235ef639440792648048982d6ff3831f
Instruction Fuzzy Hash: 62F01D76542700ABD320DB94DA49E6AB7B8FB48B14F404E08B657C76C0CFB5E9188BB0

Function 031619A0 Relevance: 6.1, APIs: 4, Instructions: 102timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0316A418,00000000), ref: 03161A27
timeGetTime.WINMM ref: 03161A2D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 03161A41
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 03161A4A

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateEvent$ExchangeInterlockedTimetime
String ID:
API String ID: 2985171241-0
Opcode ID: 61aa341c97c494daa693047f82f40fc7ccd5786bb176558d1af8caa04f00f213
Instruction ID: 173531902f2a9da7bdb55fe2da173fc30561010e3005576bfb1b1c4ac670be54
Opcode Fuzzy Hash: 61aa341c97c494daa693047f82f40fc7ccd5786bb176558d1af8caa04f00f213
Instruction Fuzzy Hash: AC41D4B5600B409FC320DFAAC980A16FBF9FF99714B104A5EE55AC7B60D7B0A944CB64

Function 02AC1BE0 Relevance: 6.1, APIs: 4, Instructions: 101synchronizationtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 02AC1BFA
InterlockedExchange.KERNEL32(?,00000000), ref: 02AC1C09
WaitForSingleObject.KERNEL32(?,00001770), ref: 02AC1C6B

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ExchangeInterlockedObjectSingleTimeWaittime
String ID:
API String ID: 3701969524-0
Opcode ID: dd2e7fadc5d97a444055a695d889062639cc5d6b1f8353ca16d5f9b6b918eee5
Instruction ID: f1e627d769e7e8d1d9ebf0b4e0266465c8947b4623d7031e2158c14566a197bd
Opcode Fuzzy Hash: dd2e7fadc5d97a444055a695d889062639cc5d6b1f8353ca16d5f9b6b918eee5
Instruction Fuzzy Hash: 4A313C76640704AFD320DBA9DC84F5AB7E8BF88324F10891EF64AC7690DAB1F445CB60

Function 02AC1190 Relevance: 6.1, APIs: 4, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02AC11C9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02AC1206
_memmove.LIBCMT ref: 02AC1222
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02AC1235

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4_memmove
String ID:
API String ID: 1828152804-0
Opcode ID: a52a7616cf1efca7f0bbb58d9257134607cc5499e009b17838b50543ce16c4cf
Instruction ID: af3221291c6f434d4a2fc747c262bc52a8335d997c885dba623e7942a7288fbf
Opcode Fuzzy Hash: a52a7616cf1efca7f0bbb58d9257134607cc5499e009b17838b50543ce16c4cf
Instruction Fuzzy Hash: 1421C271F403089BDB109FAAD985B6EFBF4EF40705F1089ADE85EE2641EB30A8148B54

Function 02AC10E0 Relevance: 6.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02AC110F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02AC113F
_memmove.LIBCMT ref: 02AC115B
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02AC1172

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4_memmove
String ID:
API String ID: 1828152804-0
Opcode ID: 18609912762b2e9ced7608eea6504d70d575f65ea2cbb1c9c3ddf5740caef216
Instruction ID: d5596a6f6ee55be74e2dd2fe06085ceb54c8c4f0e95fee4df5a207b67c31cc3c
Opcode Fuzzy Hash: 18609912762b2e9ced7608eea6504d70d575f65ea2cbb1c9c3ddf5740caef216
Instruction Fuzzy Hash: 1D11B470E40308ABDB109FA9D985B6EBBF8FF04705F10896DE959D2241EA34A914C750

Function 0316F2F0 Relevance: 6.1, APIs: 4, Instructions: 64threadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0316F2F4
WSACloseEvent.WS2_32(?), ref: 0316F357
shutdown.WS2_32(0316B977,00000001), ref: 0316F36B
closesocket.WS2_32(0316B977), ref: 0316F375

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CloseCurrentEventThreadclosesocketshutdown
String ID:
API String ID: 802825583-0
Opcode ID: d0674e0ef80dd04f5a33c8b3937648f9a27401f8d60fcbafc89c8972c2e1acc8
Instruction ID: 6ef2e3b4a928b2124ee03ebcf55de4e0ccc05baf0093896743d40b9048effed3
Opcode Fuzzy Hash: d0674e0ef80dd04f5a33c8b3937648f9a27401f8d60fcbafc89c8972c2e1acc8
Instruction Fuzzy Hash: AC114C75200B108BC634EF6AE84495AF3FAAFCC7107154B19E496C7794DB35E893CBA0

Function 02AC8540 Relevance: 6.1, APIs: 4, Instructions: 64threadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02AC8544
WSACloseEvent.WS2_32(?), ref: 02AC85A7
shutdown.WS2_32(02AC4BD7,00000001), ref: 02AC85BB
closesocket.WS2_32(02AC4BD7), ref: 02AC85C5

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CloseCurrentEventThreadclosesocketshutdown
String ID:
API String ID: 802825583-0
Opcode ID: 0bf14bebd567f51b43e5d97cf10253a5b102d4960b26cd76c3d095fb07ce9d06
Instruction ID: 037a4424006f8d01a84bc2565d3afad787d5f915577c17796ac54203eba1e66d
Opcode Fuzzy Hash: 0bf14bebd567f51b43e5d97cf10253a5b102d4960b26cd76c3d095fb07ce9d06
Instruction Fuzzy Hash: 37115E75600A008FC631EF2DD88495AF3FABF88714B248B1DE596C7790DF75E9428BA0

Function 0316F9B0 Relevance: 4.6, APIs: 3, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0316E490: StrChrW.SHLWAPI(?,0000005E), ref: 0316E49E

WSASetLastError.WS2_32(0000273F), ref: 0316FA7E
socket.WS2_32(?,00000002,00000011), ref: 0316FAB7
WSACreateEvent.WS2_32 ref: 0316FB00

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateErrorEventLastsocket
String ID:
API String ID: 2854923884-0
Opcode ID: 6b725d606b7b5a91513a6d830b8c25c10ebc2e764bbe5b6f36592be2aaf5c10c
Instruction ID: 54e5475d5dd627fe2e059d4629f18953724a0332d5473b5fbac70a47c14fd340
Opcode Fuzzy Hash: 6b725d606b7b5a91513a6d830b8c25c10ebc2e764bbe5b6f36592be2aaf5c10c
Instruction Fuzzy Hash: C241A57AA003459BDB14EFE4EC45BABB3B8EB4C711F04452AED0597280FB35A465C7A1

Function 02AC8C00 Relevance: 4.6, APIs: 3, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 02AC76E0: StrChrW.SHLWAPI(?,0000005E), ref: 02AC76EE

WSASetLastError.WS2_32(0000273F), ref: 02AC8CCE
socket.WS2_32(?,00000002,00000011), ref: 02AC8D07
WSACreateEvent.WS2_32 ref: 02AC8D50

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CreateErrorEventLastsocket
String ID:
API String ID: 2854923884-0
Opcode ID: a6f166fab573f8b1a05cf3d2da3797155e33c16570f10fbb1491d7366aa1bbf4
Instruction ID: 08d641c4dd678405279e023bf92def354fb433c3aefe258a4b36d2f80aa7fa75
Opcode Fuzzy Hash: a6f166fab573f8b1a05cf3d2da3797155e33c16570f10fbb1491d7366aa1bbf4
Instruction Fuzzy Hash: 4B4194B6A452059FDB10DF64DC85BABB3B8FB04715F10492EED0693280EF39A414CFA1

Function 000B71E1 Relevance: 4.6, APIs: 3, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000B71E8
CreateCompatibleDC.GDI32(00000000), ref: 000B72B3
CreateCompatibleDC.GDI32(00000000), ref: 000B72BF

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreate$H_prolog3
String ID:
API String ID: 2193723985-0
Opcode ID: 7bc7bd613387e12ddf49afac9f23d918d2b8e13b47e28eb5d925ec7b90c8ee0a
Instruction ID: 27b0479598c394d9e9ba20a3df29a79531662ec009f7b5aa62efd480809db801
Opcode Fuzzy Hash: 7bc7bd613387e12ddf49afac9f23d918d2b8e13b47e28eb5d925ec7b90c8ee0a
Instruction Fuzzy Hash: C151BFB0911765CFCB44DF69C98129A7BB9BF09B00F1081ABEC49DF65AD7B08544CF90

Function 0316CB80 Relevance: 4.6, APIs: 3, Instructions: 114COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0316CBA1
_malloc.LIBCMT ref: 0316CC15

Part of subcall function 03171DDE: __FF_MSGBANNER.LIBCMT ref: 03171DF7
Part of subcall function 03171DDE: __NMSG_WRITE.LIBCMT ref: 03171DFE
Part of subcall function 03171DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171E23

_free.LIBCMT ref: 0316CC3D

Part of subcall function 03171DA4: HeapFree.KERNEL32(00000000,00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171DBA
Part of subcall function 03171DA4: GetLastError.KERNEL32(00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000), ref: 03171DCC

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Heap_malloc$AllocateErrorFreeLast_free
String ID:
API String ID: 916394080-0
Opcode ID: 698f098fbc19cb9910703d1d393761fa4be2011af469bf64b4c794560db12866
Instruction ID: eaf79427dc0c4eb319f7b046ee22ee3f0084267c3763258d7c07e9a266786e3d
Opcode Fuzzy Hash: 698f098fbc19cb9910703d1d393761fa4be2011af469bf64b4c794560db12866
Instruction Fuzzy Hash: 5E416CB1901B008FD361CF6AD480786FBE8BF98714F148A2FC5EAC7A20E7B5A0448F51

Function 02AC5550 Relevance: 4.6, APIs: 3, Instructions: 96COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000000,00000004), ref: 02AC55BE
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 02AC55D0

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 7a6794c9650f796dcadcea8f59129977b747566efca987d579593dd0693c3fea
Instruction ID: 6ac8fcc31b3c3615d29d0a971f1798eac11e7db8dcaca8af7affeb961d75f4f6
Opcode Fuzzy Hash: 7a6794c9650f796dcadcea8f59129977b747566efca987d579593dd0693c3fea
Instruction Fuzzy Hash: 8321B672B4420A7AEA10D694DC81FBDB378DF45B75F600765FB14EB2C0DAB0990597A0

Function 000543C6 Relevance: 4.6, APIs: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,001AE008,00000000,00000001,?), ref: 0005440B
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,00000004), ref: 0005442B
RegCloseKey.ADVAPI32(?), ref: 0005446F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 9d54a9f6a02324b5b2aaacb1473e1e0a02bab922cbc96208ab2b480aa5f6d1c4
Instruction ID: e8e2238245192085433029f59b82be88055fbcb2b7c63b3cd411409f399ce336
Opcode Fuzzy Hash: 9d54a9f6a02324b5b2aaacb1473e1e0a02bab922cbc96208ab2b480aa5f6d1c4
Instruction Fuzzy Hash: A7210971E00208EFDF11CF85C944AEEBBF8EF91319F2180AAE856A6110D7715A88CF51

Function 00148212 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

__stbuf.LIBCMT ref: 00148260
__output_l.LIBCMT ref: 00148278
__ftbuf.LIBCMT ref: 00148289

Part of subcall function 00148FB0: __getptd_noexit.LIBCMT ref: 00148FB0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: __ftbuf__getptd_noexit__output_l__stbuf
String ID:
API String ID: 1135767703-0
Opcode ID: 0b62a90cd2c104f81b5bcc8ebe880bdaffce0d305a2f98ad49b6359410187279
Instruction ID: 6460edfa9b2097f943dbd3a469af448a9e652841336f3a8d2ccfe0fde63c3fa6
Opcode Fuzzy Hash: 0b62a90cd2c104f81b5bcc8ebe880bdaffce0d305a2f98ad49b6359410187279
Instruction Fuzzy Hash: 65016272D00208AAE7117BF49C43AAE7664DF31760F21453DB414EA2F3DF798D4686A1

Function 0316C670 Relevance: 4.5, APIs: 3, Instructions: 39networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00002741), ref: 0316C689
WSAStringToAddressW.WS2_32(?,?,00000000,?,?), ref: 0316C6AF
htons.WS2_32(?), ref: 0316C6C2

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: AddressErrorLastStringhtons
String ID:
API String ID: 1418563660-0
Opcode ID: 8c8956f825dbce45540ee5c9d8fe6e4aabbc724e2ed4e5aca95b0f6593363544
Instruction ID: 3e5c705f6736f28cb9f82a26880ba7f1121c46462f5cbb698065eecc54a68744
Opcode Fuzzy Hash: 8c8956f825dbce45540ee5c9d8fe6e4aabbc724e2ed4e5aca95b0f6593363544
Instruction Fuzzy Hash: BEF096712003556BEB28EFE9D849BFB77A8EF08750F440419F989C7280DB70D49087E8

Function 02AC58D0 Relevance: 4.5, APIs: 3, Instructions: 39networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00002741), ref: 02AC58E9
WSAStringToAddressW.WS2_32(?,?,00000000,?,?), ref: 02AC590F
htons.WS2_32(?), ref: 02AC5922

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: AddressErrorLastStringhtons
String ID:
API String ID: 1418563660-0
Opcode ID: 9b54c6ccb15ff1da468e56250c37180734718b2cf1335d59a45d2095406e53fe
Instruction ID: 3ed1f1d15b0b78c3b3f3f8d1c43a4d8782adeafa3b0df9a32fba2b591dc27321
Opcode Fuzzy Hash: 9b54c6ccb15ff1da468e56250c37180734718b2cf1335d59a45d2095406e53fe
Instruction Fuzzy Hash: CDF06231A442496BEB249F94D849BAB37A8EF04754F904C1DF95AD7180DF70E45097A0

Function 0316A620 Relevance: 4.5, APIs: 3, Instructions: 32threadsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,03169DF0,00000000,00000000,00000000), ref: 0316A642
CreateThread.KERNEL32(00000000,00000000,0316A2E0,00000000,00000000,00000000), ref: 0316A658
WaitForSingleObject.KERNEL32(?,000000FF,?,?,03172AE0,?,?,?,?,?,?,031891D8,0000000C,03172B88,?), ref: 0316A662

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateThread$ObjectSingleWait
String ID:
API String ID: 1771687473-0
Opcode ID: de929d94d425cd5105296c3d3c7fe7ebb8a2f40909d8368550c72bd7d9bf4027
Instruction ID: b2a6873883641e784f9704c80c608a77c83c6a94f692d7084bb37c4d515bbb03
Opcode Fuzzy Hash: de929d94d425cd5105296c3d3c7fe7ebb8a2f40909d8368550c72bd7d9bf4027
Instruction Fuzzy Hash: 61F09BF16843197BEA14A7A9EC06F66379CD70C710F104513B920F71C4DAB078908F78

Function 0317172A Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0317172F

Part of subcall function 0317456B: GetLastError.KERNEL32(00000001,00000000,0317420D,03171E67,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 0317456F
Part of subcall function 0317456B: ___set_flsgetvalue.LIBCMT ref: 0317457D
Part of subcall function 0317456B: __calloc_crt.LIBCMT ref: 03174591
Part of subcall function 0317456B: DecodePointer.KERNEL32(00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000,00000000,?,0317468F), ref: 031745AB
Part of subcall function 0317456B: GetCurrentThreadId.KERNEL32 ref: 031745C1
Part of subcall function 0317456B: SetLastError.KERNEL32(00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000,00000000,?,0317468F), ref: 031745D9

__freeptd.LIBCMT ref: 03171739

Part of subcall function 0317472D: TlsGetValue.KERNEL32(?,?,03172A68,00000000,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317474E
Part of subcall function 0317472D: TlsGetValue.KERNEL32(?,?,03172A68,00000000,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03174760
Part of subcall function 0317472D: DecodePointer.KERNEL32(00000000,?,03172A68,00000000,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03174776
Part of subcall function 0317472D: __freefls@4.LIBCMT ref: 03174781
Part of subcall function 0317472D: TlsSetValue.KERNEL32(0000001E,00000000,?,03172A68,00000000,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03174793

ExitThread.KERNEL32 ref: 03171742

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: c222a46fb0b3498449d1301d6dbf813c4821952c13274bcf52791edef911337e
Instruction ID: da0960faa811374e6aa57ab0f7f3fe8cb0f0b4fc9ed9c0b8ec49b36c0d854ef7
Opcode Fuzzy Hash: c222a46fb0b3498449d1301d6dbf813c4821952c13274bcf52791edef911337e
Instruction Fuzzy Hash: F7C08C250083452B9A00B723A849C6A3A3E8A883D070C0020A8188A000DF20D84084A1

Function 0316FB50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0316FB78

Part of subcall function 0316E9D0: WSAGetLastError.WS2_32 ref: 0316E9D8
Part of subcall function 0316E9D0: WSAResetEvent.WS2_32(?), ref: 0316EA15

Strings

, xrefs: 0316FC1B

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: EnumErrorEventEventsLastNetworkReset
String ID:
API String ID: 1050048411-3916222277
Opcode ID: a0ad1db15f1ba867c160218f90ee3866c985ffffa79957c45af015cc7d9d483f
Instruction ID: 620fa9be1b59021f541d8ed8df28bbc4ed00059da3451b8d58ad4b1327301a50
Opcode Fuzzy Hash: a0ad1db15f1ba867c160218f90ee3866c985ffffa79957c45af015cc7d9d483f
Instruction Fuzzy Hash: EA3170756047099FC724DFA9E890A6AF7F5AF8C214F18066EDC4AC7640EB31D9168B90

Function 02AC8DA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 02AC8DC8

Part of subcall function 02AC7C20: WSAGetLastError.WS2_32 ref: 02AC7C28
Part of subcall function 02AC7C20: WSAResetEvent.WS2_32(?), ref: 02AC7C65

Strings

, xrefs: 02AC8E6B

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: EnumErrorEventEventsLastNetworkReset
String ID:
API String ID: 1050048411-3916222277
Opcode ID: 4810ef7ebc1406f36f7c982e6898df14947054b8ae4caa5ea83fb10ecb56fd36
Instruction ID: 4f302c12c48b5fc58e629d1a84a399ec2720b7cafbab5d5a217aa5476c173457
Opcode Fuzzy Hash: 4810ef7ebc1406f36f7c982e6898df14947054b8ae4caa5ea83fb10ecb56fd36
Instruction Fuzzy Hash: FC315EB16047088FC721DF69D990BAAF7F6BF84614B24466DD84AD7640EF34D9058F90

Function 00051820 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,EFF91FD5), ref: 0005185F

Strings

C:\Users\Administrator\Desktop, xrefs: 000518E0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: C:\Users\Administrator\Desktop
API String ID: 514040917-3755706383
Opcode ID: 5ba72aab2282dead6f75feff6db762fb6d16a033a2d21849049df23dab28a405
Instruction ID: 42d0501b70f4908a7a63dc2c601b312225f31024679af640f56a91f46dae8f22
Opcode Fuzzy Hash: 5ba72aab2282dead6f75feff6db762fb6d16a033a2d21849049df23dab28a405
Instruction Fuzzy Hash: DF415B70805118DBDB54EBA4CC99BEEB7B4AF14701F108299E416AB292EB742E4CCB90

Function 035601CB Relevance: 3.3, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 0356022B

Memory Dump Source

Source File: 00000000.00000002.1954375014.0000000003560000.00000040.00001000.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3560000_1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: 5188ec19bf2e9f0bbcf59ea074748717627bff8aea5cb41f8cbaa3572480b11e
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: 83A16070A04606EFDB24CFA9D880AAEF7B5FF48305F1885A9E415DB3A1D770E951CB90

Function 02AC4550 Relevance: 3.1, APIs: 2, Instructions: 147COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,02AE012C,00000000,00000000,00000000,00000004,02AC527F,02ADA64C,000000FF,?,02AC4D72,02AC527F,02AE012C), ref: 02AC458F
InitializeCriticalSectionAndSpinCount.KERNEL32(00000158,00000000,00000400,00000400,02AE1EA8,?,02AC4D72,02AC527F,02AE012C,00000000,02AC3302,00000000,00000000,00000000,02ADA73F,000000FF), ref: 02AC4661

Part of subcall function 02AC3FB0: __CxxThrowException@8.LIBCMT ref: 02AC3FC2

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CountCreateCriticalEventException@8InitializeSectionSpinThrow
String ID:
API String ID: 2367981338-0
Opcode ID: 878392fb548c858446a877fd483729615ee9a0e7f787743bb90c1e4e062a9a16
Instruction ID: 5667ec82f2fe7d209bda2051482a6faf9d17f2420024192f35132cc01c177371
Opcode Fuzzy Hash: 878392fb548c858446a877fd483729615ee9a0e7f787743bb90c1e4e062a9a16
Instruction Fuzzy Hash: 41511AB1940B40AFD720DF6A8984A9BFBF8FF99704F10891EE19A97750DB70A504CB54

Function 02AC1840 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02AC186E
_memmove.LIBCMT ref: 02AC1932

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 88b8b18900c2fea2e440f5d790c4ff52a3da6065c29ca646272ceb9d63bd851c
Instruction ID: cf5bfce1d62700325dc3dd9c4ca8caee97afab4bf891c9c090f3c18020fb689b
Opcode Fuzzy Hash: 88b8b18900c2fea2e440f5d790c4ff52a3da6065c29ca646272ceb9d63bd851c
Instruction Fuzzy Hash: 8C316B76704602AFD718DE6AC8C0D66F3AABF44254724C62CD82D97606EF31FC55CB90

Function 02AC19B0 Relevance: 3.1, APIs: 2, Instructions: 102timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(02AC333E,00000000), ref: 02AC1A37
timeGetTime.WINMM ref: 02AC1A3D

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ExchangeInterlockedTimetime
String ID:
API String ID: 1255932121-0
Opcode ID: ef9174a6b8e015239b094448cbbc00612b61bf71460f645b63fa9faa99b8eb9c
Instruction ID: 0c211021cbc5730ddceaff6fc5907d46d1ad7287481b10eb096f7d602e0e6284
Opcode Fuzzy Hash: ef9174a6b8e015239b094448cbbc00612b61bf71460f645b63fa9faa99b8eb9c
Instruction Fuzzy Hash: D941D7B5A40B409FD320CF6AC980A16FBF8FF99714B10495EE59AC7B60D7B0E945CB50

Function 02AC15C0 Relevance: 3.1, APIs: 2, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 02ACA8DC: _malloc.LIBCMT ref: 02ACA8F6

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 02AC1633
recv.WS2_32(?,?,00040000,00000000), ref: 02AC1654

Part of subcall function 02AC1840: _memmove.LIBCMT ref: 02AC186E
Part of subcall function 02AC1840: _memmove.LIBCMT ref: 02AC1932

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: _memmove$_mallocrecvselect
String ID:
API String ID: 1734404984-0
Opcode ID: ef856ae4dab03804686c6b5d3e8e7604ec75f423eceb0c4b147e08f7f03b8c02
Instruction ID: 7237ad6ed2bc9a8ed856aa925df484948d102035bbd3008ef33539068be05a33
Opcode Fuzzy Hash: ef856ae4dab03804686c6b5d3e8e7604ec75f423eceb0c4b147e08f7f03b8c02
Instruction Fuzzy Hash: BE21A7B5B402089BDB20DF65CC84BAA77A5EF45310F244598EA19AB2C1DFB0E985CF91

Function 02AC7B90 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02AC7BAE
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,-00000001,00000000,00000000), ref: 02AC7BE5

Part of subcall function 02AC3FB0: __CxxThrowException@8.LIBCMT ref: 02AC3FC2

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ByteCharMultiWide$Exception@8Throw
String ID:
API String ID: 2985342829-0
Opcode ID: ab075db594ff4bc103da6541ad7f8c303165c3d77847b0abdf07e0226d83992d
Instruction ID: f96b12f3b803688360aeac3a87eaec2fc8ad0a54fc71e08daf900eab46ceb4d1
Opcode Fuzzy Hash: ab075db594ff4bc103da6541ad7f8c303165c3d77847b0abdf07e0226d83992d
Instruction Fuzzy Hash: 1F11E9313812156FE6219A49DC88F6AF75DEB84764F30411DF311AF2C0CE6068018FE4

Function 00054210 Relevance: 3.1, APIs: 2, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

_wmemcpy_s.LIBCPMTD ref: 0005428B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: _wmemcpy_s
String ID:
API String ID: 67063488-0
Opcode ID: 3149fa814990a70032cac697e70eefd725a9569572b24ec6260fcca1de6a0001
Instruction ID: e1f1bf9642395b110e29a1a0ec16d362e24d08de1f8f3d3ac8ef028adb39ccbc
Opcode Fuzzy Hash: 3149fa814990a70032cac697e70eefd725a9569572b24ec6260fcca1de6a0001
Instruction Fuzzy Hash: 1D211D75900018AFCB04EF98D8919EFB7B5BF44305F508558B929A7292DA30AA88CB95

Function 02AC1750 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 02AC1781
send.WS2_32(?,?,?,00000000), ref: 02AC17BE

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 688bf3c10c3a9829659c148c950996dfc0823a9be73a1a0efee61f85f10b97ca
Instruction ID: 794cc54936687bc32b00b0f1ac01a59a19e1564d116533280d15b1ecc80991f3
Opcode Fuzzy Hash: 688bf3c10c3a9829659c148c950996dfc0823a9be73a1a0efee61f85f10b97ca
Instruction Fuzzy Hash: EE118272B42204EBD7208B6AD9C4B5EB799EB41368F314139E90DDB252DE70D9429A90

Function 02AC7100 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02AC7125
_free.LIBCMT ref: 02AC716A

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: _free_malloc
String ID:
API String ID: 845055658-0
Opcode ID: 113d8ae0564a45764d8d68d46de6fb94e01c25267e37bea5a1ed0058e48659f8
Instruction ID: e37c21fbae50ad6a4885a9165fd4f689ba37ce694f8fc0d20791ba2b4d64c82f
Opcode Fuzzy Hash: 113d8ae0564a45764d8d68d46de6fb94e01c25267e37bea5a1ed0058e48659f8
Instruction Fuzzy Hash: 0001C473A452119BDB14EBA8ACC05AAF35DFF40235B10023EE91D82750EB32E8158BD1

Function 02AC42B0 Relevance: 3.0, APIs: 2, Instructions: 49COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02AC42C3
RtlEnterCriticalSection.NTDLL(?), ref: 02AC42CD

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f36d4f2318c9752d2103ff794473fdf35d562aa12a9d6609eac877430608a89d
Instruction ID: 5d34f347df476d2bbb7f410ff26a84db8313181f3aa09f3b28dd353db497c715
Opcode Fuzzy Hash: f36d4f2318c9752d2103ff794473fdf35d562aa12a9d6609eac877430608a89d
Instruction Fuzzy Hash: 860162766006109FD720DB29FDC4B9BB7E8EB88719F110C2DF146C3600DB74F84A8AA4

Function 0316B0D0 Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,00000000,00000004,?,0316B3DF,00000400,00000400,00001000,?,0316BB12,0316C01F,76CB4AAF,00000000,0316A3DC), ref: 0316B0EA
_free.LIBCMT ref: 0316B129

Part of subcall function 031662D0: __CxxThrowException@8.LIBCMT ref: 031662E2
Part of subcall function 031662D0: GdipCloneImage.GDIPLUS(?,00000002,00000074,?,?,0316C01F,0318976C,?,0316B100,80004005,?,0316B3DF,00000400,00000400,00001000), ref: 03166306
Part of subcall function 031662D0: GdipAlloc.GDIPLUS(00000010,?,?,0316C01F,0318976C,?,0316B100,80004005,?,0316B3DF,00000400,00000400,00001000,?,0316BB12,0316C01F), ref: 03166315

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Gdip$AllocCloneCreateException@8HeapImageThrow_free
String ID:
API String ID: 279427069-0
Opcode ID: 533f64b88376cfbf95b98777a29ddb7bcdd202352916b6644145802961ac66be
Instruction ID: 6a9ac18a01aff8f0dff80f6472cd5c6c39f1f38cfa8e4ad60d6f6b2f9fb67a94
Opcode Fuzzy Hash: 533f64b88376cfbf95b98777a29ddb7bcdd202352916b6644145802961ac66be
Instruction Fuzzy Hash: 5001B3B1A00B049BC720DF6BD844A47FBF8FF98710B148A1EE59A87710D770A500CB94

Function 02AC4340 Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,00000000,00000004,?,02AC464F,00000400,00000400,02AE1EA8,?,02AC4D72,02AC527F,02AE012C,00000000,02AC3302), ref: 02AC435A
_free.LIBCMT ref: 02AC4399

Part of subcall function 02AC3FB0: __CxxThrowException@8.LIBCMT ref: 02AC3FC2

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: CreateException@8HeapThrow_free
String ID:
API String ID: 1065114656-0
Opcode ID: 62a362412777f9bea141a034a80c4be0a9c68e35db2829f25994e65a0818de04
Instruction ID: 808893354f629db7e6b86694300e2822891db525bd757f3f9f68496958aa2b74
Opcode Fuzzy Hash: 62a362412777f9bea141a034a80c4be0a9c68e35db2829f25994e65a0818de04
Instruction Fuzzy Hash: 480180B0A00B049BC720DF2AD844A57FBF8FF95710B108A1EE99A87B10D770A545CF95

Function 0008277F Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000), ref: 0008278D
SetErrorMode.KERNEL32(00000000), ref: 00082795

Part of subcall function 0005B140: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0005B173
Part of subcall function 0005B140: SetLastError.KERNEL32(0000006F), ref: 0005B18A

Part of subcall function 000825A3: GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 000825E0
Part of subcall function 000825A3: PathFindExtensionW.SHLWAPI(?), ref: 000825FA
Part of subcall function 000825A3: __wcsdup.LIBCMT ref: 00082644
Part of subcall function 000825A3: __wcsdup.LIBCMT ref: 00082682
Part of subcall function 000825A3: __wcsdup.LIBCMT ref: 000826B6

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Error__wcsdup$FileModeModuleName$ExtensionFindLastPath
String ID:
API String ID: 972848482-0
Opcode ID: dbfbdb9b0687d628052b0669a6555f6f17ba1ee5af883be16989343bbd701909
Instruction ID: 4e0a6d5113a4ddbadaacdd71efd4e298c9d4fa45651f2987bc2ecac33d110604
Opcode Fuzzy Hash: dbfbdb9b0687d628052b0669a6555f6f17ba1ee5af883be16989343bbd701909
Instruction Fuzzy Hash: 38F06D71A142145FDBA0FF65D455AEE3BD8AF84721F05805AF9889B353DB30E840CBA6

Function 0316C3D0 Relevance: 3.0, APIs: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 0316C3EE
WSAGetLastError.WS2_32 ref: 0316C3F9

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorIoctlLast
String ID:
API String ID: 4052769934-0
Opcode ID: e47ea960d2ce4a5f59cd17f27dfae9f4699d0046897d3b0ebe95863eec3fbf7c
Instruction ID: 1ae50cffc2f02e9c4a21cccae78d578d6d5b672eb17f489b160c7e6d995248de
Opcode Fuzzy Hash: e47ea960d2ce4a5f59cd17f27dfae9f4699d0046897d3b0ebe95863eec3fbf7c
Instruction Fuzzy Hash: F4E06D766161287BE624EBE9AC48CEB7F5DDB0A770F500395FE1DC2080DA209A50D2F4

Function 02AC5630 Relevance: 3.0, APIs: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 02AC564E
WSAGetLastError.WS2_32 ref: 02AC5659

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ErrorIoctlLast
String ID:
API String ID: 4052769934-0
Opcode ID: 1b70b2d1f2f2944e30a85186468d1542f27179d14ad3b178d53edab15ed039de
Instruction ID: e6b5aadb3e17792850c2e7b687e294f3b1a1058d93ea2503164cb17e1e474add
Opcode Fuzzy Hash: 1b70b2d1f2f2944e30a85186468d1542f27179d14ad3b178d53edab15ed039de
Instruction Fuzzy Hash: 13E06D769160287AD620AAA9AC49DEB7F5CDB06674F604759FA1DC2080DA709A10C6E0

Function 0316EEE0 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 0316EEFB

Part of subcall function 0316E320: SetLastError.KERNEL32(000005B4,0316B977,76CB4AAF), ref: 0316E35C

Part of subcall function 031662D0: __CxxThrowException@8.LIBCMT ref: 031662E2
Part of subcall function 031662D0: GdipCloneImage.GDIPLUS(?,00000002,00000074,?,?,0316C01F,0318976C,?,0316B100,80004005,?,0316B3DF,00000400,00000400,00001000), ref: 03166306
Part of subcall function 031662D0: GdipAlloc.GDIPLUS(00000010,?,?,0316C01F,0318976C,?,0316B100,80004005,?,0316B3DF,00000400,00000400,00001000,?,0316BB12,0316C01F), ref: 03166315

CloseHandle.KERNEL32(00000000), ref: 0316EF28

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Gdip$AllocCloneCloseErrorEventException@8HandleImageLastThrow
String ID:
API String ID: 4077832904-0
Opcode ID: aa7a2a1e0294397b69a42882f05112fa6cc71373837a0f0592e18621a9c365b4
Instruction ID: 4b1aee03358f11861f366a765bd75716461a4882a9be06ba98dd516fed34f071
Opcode Fuzzy Hash: aa7a2a1e0294397b69a42882f05112fa6cc71373837a0f0592e18621a9c365b4
Instruction Fuzzy Hash: 84F0BE76100320ABD334EBA4D804B67B3F8AB0C310F144A1CF7628A680DBB2F450CBA4

Function 03174189 Relevance: 3.0, APIs: 2, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,031741C2,00000000,00000000,00000000,00000000,00000000,0317DA42,?,0317524C,00000003,03171DFC,00000001,00000000,00000000), ref: 03174194
__invoke_watson.LIBCMT ref: 031741B0

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: DecodePointer__invoke_watson
String ID:
API String ID: 4034010525-0
Opcode ID: cae8a4ab3878b2f588221c3b7605812e0c2fee70f7c65440f9ba88584b2b9621
Instruction ID: cfaf18b09e86c06dc9317a829d3c93600a5a87617768b9e4a0fe29b51b18aef9
Opcode Fuzzy Hash: cae8a4ab3878b2f588221c3b7605812e0c2fee70f7c65440f9ba88584b2b9621
Instruction Fuzzy Hash: 7FE0EC36140209BBDF057F63DC048AA3F7AEB5C7A0B484460FD1485420DF32E9B1DBA5

Function 000548E0 Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

ActivateActCtx.KERNEL32(?,?,0019DF70,00000010,00054AC8,KERNEL32.DLL), ref: 00054900
LoadLibraryW.KERNEL32(?), ref: 00054917

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ActivateLibraryLoad
String ID:
API String ID: 389599620-0
Opcode ID: 3570417f702d7ef5ae0875715a7686e0c0d3b112025f177b918a347223a8f73e
Instruction ID: 2aa50c72b87c5da7d8d6c9ede94ae07e2ceb25c9d2c1fae58fed9d536e0e2681
Opcode Fuzzy Hash: 3570417f702d7ef5ae0875715a7686e0c0d3b112025f177b918a347223a8f73e
Instruction Fuzzy Hash: 7CF03071C00219AFCF10AFA4DC469EEBAB4FF18712F108516F891E22A5CB744686DF90

Function 02AC17F0 Relevance: 3.0, APIs: 2, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 02AC1807
InterlockedExchange.KERNEL32(?,00000000), ref: 02AC1813

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ExchangeInterlockedSleep
String ID:
API String ID: 3334789516-0
Opcode ID: 2dd910335097c49e14dc6f1d11d06d72f3e6a8347d1c79570d09c26c60454744
Instruction ID: 1a2f07ad0bc88fef689bb3dd49b460baf137428dff6d6688c3a9564f2b954bce
Opcode Fuzzy Hash: 2dd910335097c49e14dc6f1d11d06d72f3e6a8347d1c79570d09c26c60454744
Instruction Fuzzy Hash: 58E0863654531067C220A769EC44D577768FBC8730B520F0CB276C36C08D70E4058B70

Function 00056385 Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00056398
SetWindowsHookExW.USER32(000000FF,Function_000061EA,00000000,00000000), ref: 000563A8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: 20767674ddb5be69424cf6c0736198b9a2aafc577bdf59817e9ae84757b9ee5f
Instruction ID: e4ec8a47f297ae4013cf291acb061ce2e5bcf5340bab43122a70e770d6ea376b
Opcode Fuzzy Hash: 20767674ddb5be69424cf6c0736198b9a2aafc577bdf59817e9ae84757b9ee5f
Instruction Fuzzy Hash: D1D0A7324443506FD72037707C0DBBB3E445B04332F041342FD52961E2C6A0A9C487D6

Function 02ACA97B Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02ACA987

Part of subcall function 02ACCCE5: __getptd_noexit.LIBCMT ref: 02ACCCE8
Part of subcall function 02ACCCE5: __amsg_exit.LIBCMT ref: 02ACCCF5

__endthreadex.LIBCMT ref: 02ACA997

Part of subcall function 02ACA97B: __getptd_noexit.LIBCMT ref: 02ACA961

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: __getptd_noexit$__amsg_exit__endthreadex__getptd
String ID:
API String ID: 1746327785-0
Opcode ID: f424049eceb157767f0cbb792d4fd0108767eec7400d6c58d01e9331b058e6e6
Instruction ID: 5ff0fbea76486341ef8b3498ad4baa8e13d56660fcb111184fe1daa8f25214ed
Opcode Fuzzy Hash: f424049eceb157767f0cbb792d4fd0108767eec7400d6c58d01e9331b058e6e6
Instruction Fuzzy Hash: B3C04C75581A04AAFF187BE0CF0AF1D7B276F00716F320559A1429A0B2CE749544AE11

Function 031640F4 Relevance: 3.0, APIs: 2, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,031640D2), ref: 03164101
RegCloseKey.ADVAPI32(?), ref: 0316410A

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 6b7f02126326c8ca776e2aaa28f5f6e68b4b10ab3f826f722869b67c63853853
Instruction ID: decf0c6941a93823f75b161a5febe3b05824577d11e3564d490b29fca20735c2
Opcode Fuzzy Hash: 6b7f02126326c8ca776e2aaa28f5f6e68b4b10ab3f826f722869b67c63853853
Instruction Fuzzy Hash: F5C09B72D101395BCB64F754EC4498977785B4C200F0101C57108A3154CF347FC1DF90

Function 0316BAD0 Relevance: 1.6, APIs: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0316B2E0: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,76CB4AAF,00000000,00000000,74DF0F00,00000004,0316C01F,03182DFC,000000FF,?,0316BB12,0316C01F,76CB4AAF), ref: 0316B31F
Part of subcall function 0316B2E0: InitializeCriticalSectionAndSpinCount.KERNEL32(00000158,00000000,00000400,00000400,00001000,?,0316BB12,0316C01F,76CB4AAF,00000000,0316A3DC,74DF0F00,00000000,00000000,03182EEF,000000FF), ref: 0316B3F1

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 0316BBA0

Part of subcall function 031662D0: __CxxThrowException@8.LIBCMT ref: 031662E2
Part of subcall function 031662D0: GdipCloneImage.GDIPLUS(?,00000002,00000074,?,?,0316C01F,0318976C,?,0316B100,80004005,?,0316B3DF,00000400,00000400,00001000), ref: 03166306
Part of subcall function 031662D0: GdipAlloc.GDIPLUS(00000010,?,?,0316C01F,0318976C,?,0316B100,80004005,?,0316B3DF,00000400,00000400,00001000,?,0316BB12,0316C01F), ref: 03166315

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateGdip$AllocCloneCountCriticalEventException@8ImageInitializeSectionSpinThrowTimerWaitable
String ID:
API String ID: 1469226031-0
Opcode ID: 6eef37e08ec0ba4b5a397458a7b2e0a483ceaf7a494bee7ca297abff308ba9c3
Instruction ID: 711127c4eaabb0b65585fb4ecb1b627638018d60ea05ec669f7bd7e9f3e20151
Opcode Fuzzy Hash: 6eef37e08ec0ba4b5a397458a7b2e0a483ceaf7a494bee7ca297abff308ba9c3
Instruction Fuzzy Hash: 523122B1505B449FE321DF6AC844BDBFBE8EF9A710F10490EE4AA9B240CBB56504CF90

Function 02AC4D30 Relevance: 1.6, APIs: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

Part of subcall function 02AC4550: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,02AE012C,00000000,00000000,00000000,00000004,02AC527F,02ADA64C,000000FF,?,02AC4D72,02AC527F,02AE012C), ref: 02AC458F
Part of subcall function 02AC4550: InitializeCriticalSectionAndSpinCount.KERNEL32(00000158,00000000,00000400,00000400,02AE1EA8,?,02AC4D72,02AC527F,02AE012C,00000000,02AC3302,00000000,00000000,00000000,02ADA73F,000000FF), ref: 02AC4661

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02AC4E00

Part of subcall function 02AC3FB0: __CxxThrowException@8.LIBCMT ref: 02AC3FC2

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Create$CountCriticalEventException@8InitializeSectionSpinThrowTimerWaitable
String ID:
API String ID: 723600342-0
Opcode ID: 892d41ad27bc84ded6fd199c5c9a68e908afd98bfebd6fb21b4af6240c8e2ec0
Instruction ID: 27d299dd082a79e119cb63226cf15c944035a67263258556b899d62e9a37fb0e
Opcode Fuzzy Hash: 892d41ad27bc84ded6fd199c5c9a68e908afd98bfebd6fb21b4af6240c8e2ec0
Instruction Fuzzy Hash: 913143B0901B409FE720CF29C544BDBFBE8EF89704F10490EE4AA9B240CBB56504CF90

Function 00053A00 Relevance: 1.6, APIs: 1, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

_wmemcpy_s.LIBCPMTD ref: 00053A8A

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: _wmemcpy_s
String ID:
API String ID: 67063488-0
Opcode ID: 3f724cf5154d8ca0fe87611ebe55cf9766e02ad78a46917bdf66656ea6427406
Instruction ID: 90655c182dc829c2d82fab5cc125b66a2022b50df4bb8becac17987239a78d69
Opcode Fuzzy Hash: 3f724cf5154d8ca0fe87611ebe55cf9766e02ad78a46917bdf66656ea6427406
Instruction Fuzzy Hash: 7A2195B4E002099FCB04EF98C8919AFBBB5FF88341F108599E955A7352DB30AE45CF91

Function 02AC1040 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02AC106E

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b27a90baf602e52cd30daa3db4f014a74a11944b0ff310d0bdf42e13ae600d1b
Instruction ID: a2b1de32e831960665991707be7b7a0368adab49bb442266ee83783c280bf0db
Opcode Fuzzy Hash: b27a90baf602e52cd30daa3db4f014a74a11944b0ff310d0bdf42e13ae600d1b
Instruction Fuzzy Hash: 4711C4727042569BDB18CE1AD8C0967B769FF48224B14862DED19D3202DF31E855CBE1

Function 02AC1BB7 Relevance: 1.6, APIs: 1, Instructions: 56synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00001770), ref: 02AC1C6B

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: fcfffd3111928dbd801f09e84aeefd5881e983f13d003ff30cb24da69ea7feaf
Instruction ID: 0bc5ccd937f5b985dbb05825ca40d063046371f9ae585e5143a96ea92d7fd408
Opcode Fuzzy Hash: fcfffd3111928dbd801f09e84aeefd5881e983f13d003ff30cb24da69ea7feaf
Instruction Fuzzy Hash: 1D1128753007009FD724DF69C880A56B3E1EF89328B24891DE65ACB791DB71F886CB50

Function 03171040 Relevance: 1.6, APIs: 1, Instructions: 50timeCOMMON

Download Yara Rule

APIs

Part of subcall function 031710C0: timeGetTime.WINMM(76CB4AAF,?,?,0318317E,000000FF,?,0317107F), ref: 031710FD
Part of subcall function 031710C0: InterlockedIncrement.KERNEL32( {N), ref: 03171112
Part of subcall function 031710C0: InterlockedIncrement.KERNEL32( {N), ref: 0317111D

timeGetTime.WINMM ref: 03171096

Part of subcall function 031709B0: SetLastError.KERNEL32(0000139F,76CB4AAF), ref: 031709E6

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: IncrementInterlockedTimetime$ErrorLast
String ID:
API String ID: 3970957619-0
Opcode ID: 94950650db02b23209c2b71b457c7516ed6b00725eb0eb39a982ec534592a7b3
Instruction ID: cb3f667e516e2e61391495c3521533bc0f686849303ef2e7a89589cbf508e8c3
Opcode Fuzzy Hash: 94950650db02b23209c2b71b457c7516ed6b00725eb0eb39a982ec534592a7b3
Instruction Fuzzy Hash: DA0129B1A01709AFC720DF6AC98498BF7F9FF89704B144A2ED05AC7600DB70AA058BD0

Function 02ACA290 Relevance: 1.6, APIs: 1, Instructions: 50timeCOMMON

Download Yara Rule

APIs

Part of subcall function 02ACA310: timeGetTime.WINMM(02AE012C,?,?,02ADA9CE,000000FF,?,02ACA2CF), ref: 02ACA34D

timeGetTime.WINMM ref: 02ACA2E6

Part of subcall function 02AC9C00: SetLastError.KERNEL32(0000139F,02AE012C), ref: 02AC9C36

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Timetime$ErrorLast
String ID:
API String ID: 2961902989-0
Opcode ID: 0dbae639c21db9cd6e0942f08bdd49b44dc4802e8ae192e7890e614d0aec1a83
Instruction ID: b3385a09c18df36efa2864374e890596e689f53577333d345303150f806814e2
Opcode Fuzzy Hash: 0dbae639c21db9cd6e0942f08bdd49b44dc4802e8ae192e7890e614d0aec1a83
Instruction Fuzzy Hash: 470121B16406099FC720DF7AC98495BF7EDFF85704B204A5ED059C3600DB74AA05CF90

Function 00063C70 Relevance: 1.5, APIs: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00063C77

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: 58d050888a7d7e4ad105d9abff969a9ed6cd31a356b7fe4370ed0272a2cb20fe
Instruction ID: 459422b560914cc172ed58b7d617f7f402c1933ef4de85036799123537785457
Opcode Fuzzy Hash: 58d050888a7d7e4ad105d9abff969a9ed6cd31a356b7fe4370ed0272a2cb20fe
Instruction Fuzzy Hash: 06012C746016128BDB64AFA4D81266D76E3AF903A1B24853DF952DB291DF308B82DB90

Function 00054010 Relevance: 1.5, APIs: 1, Instructions: 37memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00054065

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AllocatorDebugHeap
String ID:
API String ID: 571936431-0
Opcode ID: e3fadaff19754c859b5fdc5e65d0794ab45a608746c3fe409550eb2abf6e3803
Instruction ID: 1400a7995534edbdc7611821680a1325529178116d6a6394d3a57286ff36f76a
Opcode Fuzzy Hash: e3fadaff19754c859b5fdc5e65d0794ab45a608746c3fe409550eb2abf6e3803
Instruction Fuzzy Hash: 36016DB1904619ABCB18DF98DC51BEFB7B8FB48711F104629F925A73C1CB35A9048B90

Function 00053590 Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000006), ref: 000535AC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: fb90a551d1f6e0a3bde9d08cf2da21b593aa0c1b7b5cb4922214232f44134a08
Instruction ID: 8c24573d1230c2d3f350008e51e92953230fe52461d22187ec3b85d5594be372
Opcode Fuzzy Hash: fb90a551d1f6e0a3bde9d08cf2da21b593aa0c1b7b5cb4922214232f44134a08
Instruction Fuzzy Hash: 19F065B6A1510CBBDB10DF98DC41ABF73B8EB48341F10C568FD098B240E575EB04A7A0

Function 000591AE Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 000591CD

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 1d617edf50bdc2224914ce1c75ef6dc234a16cbaba0a8ac514ddf607c57187dc
Instruction ID: 306886931c4513d1c1216eaff5a9262423f4068b940326048e8ec8e86f9daab5
Opcode Fuzzy Hash: 1d617edf50bdc2224914ce1c75ef6dc234a16cbaba0a8ac514ddf607c57187dc
Instruction Fuzzy Hash: 87E06D325006279BC7108B49C408A47FBDDEFA1371F1A8426E804CB262CB71E8088BA4

Function 0014FFA1 Relevance: 1.5, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 0014FFC2

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: __flsbuf
String ID:
API String ID: 2056685748-0
Opcode ID: 05b21295f4039f2a48b0280d9254d2143f31e1f3bae67ceb3e2901a480aa6268
Instruction ID: ee54426d70b321491bbe7f6695a2506651421e6c16d77e33987984daa46c56de
Opcode Fuzzy Hash: 05b21295f4039f2a48b0280d9254d2143f31e1f3bae67ceb3e2901a480aa6268
Instruction Fuzzy Hash: 28E01A320441509BDA294B24D0456347BA4AF1272AB3886AEE9A5892F7C73A948BDA10

Function 02ADAB70 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 02ADAB8E

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 57307220171ab1fcbc5b434c30d7f38d9d8bdcdda33ebc8a33b7fa4c15199cdf
Instruction ID: cb71313baf44785a03b497a15e7c74691eb538a13a45e378c993e2415adf1bf2
Opcode Fuzzy Hash: 57307220171ab1fcbc5b434c30d7f38d9d8bdcdda33ebc8a33b7fa4c15199cdf
Instruction Fuzzy Hash: 35E04871D80208EBDB00EFA59D0695DB7A5DB0D304F51085DF916D7241DD719A29CFD2

Function 03171749 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03171755

Part of subcall function 031745E4: __getptd_noexit.LIBCMT ref: 031745E7
Part of subcall function 031745E4: __amsg_exit.LIBCMT ref: 031745F4

Part of subcall function 0317172A: __getptd_noexit.LIBCMT ref: 0317172F
Part of subcall function 0317172A: __freeptd.LIBCMT ref: 03171739
Part of subcall function 0317172A: ExitThread.KERNEL32 ref: 03171742

Part of subcall function 03174BDC: __getptd_noexit.LIBCMT ref: 03174BE2

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: __getptd_noexit$ExitThread__amsg_exit__freeptd__getptd
String ID:
API String ID: 133325885-0
Opcode ID: f46231fa71ff40e978c1bcef60f2727e7960cfcbd092bed716751680f5fc3130
Instruction ID: f17a1925f0fcb7992f6b31bffc1a77d9e76242affb80059a13a03cb31d9f50a5
Opcode Fuzzy Hash: f46231fa71ff40e978c1bcef60f2727e7960cfcbd092bed716751680f5fc3130
Instruction Fuzzy Hash: 72E082B8940300AFEB08FBA0C808EAE7734EF0C211F200089E1026F2B0CF34A840EF20

Function 00066BCB Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 0007EED6: GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 0007EF09
Part of subcall function 0007EED6: _memset.LIBCMT ref: 0007EF22

SystemParametersInfoW.USER32(00000029,-000001F8,?,00000000), ref: 00066BEF

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AddressInfoParametersProcSystem_memset
String ID:
API String ID: 831922234-0
Opcode ID: f5b640b913f1f1ae7a4861a729ff596d0ea845e564a6cfb534229440a9b6009c
Instruction ID: e93b289c2c4ffd75b8e1173003b8853c9fb9cff4ce97410f96dd746b064af62d
Opcode Fuzzy Hash: f5b640b913f1f1ae7a4861a729ff596d0ea845e564a6cfb534229440a9b6009c
Instruction Fuzzy Hash: 64D0A7B3590644AFE3005B70EC0AFB63609E770720F140630B528CA1D1EBB9D8408550

Function 0316ADD0 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 0316C2C7

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: df7149fa5a61abdbf946ffc54c0cc840947316fabacae89a083abcceda6bb6bf
Instruction ID: 77a3146d7ea3cd3ffd1d9ac81dd6c4f06201bd350d6c2418dffe464d078a42d9
Opcode Fuzzy Hash: df7149fa5a61abdbf946ffc54c0cc840947316fabacae89a083abcceda6bb6bf
Instruction Fuzzy Hash: 5DD0C97128430DBBD618AAC5A806EB5339C9B0CB11F804025BF095A5C09AB1B99486E9

Function 0316ADE0 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0316C2E7

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 69dae5c08d1179df3c1f815927444f73c848795e01f380a68ba0194ab669b463
Instruction ID: fd1924c1107b6b885502ba812324e842368bc7ae1ce37ca1689d93d464aa015e
Opcode Fuzzy Hash: 69dae5c08d1179df3c1f815927444f73c848795e01f380a68ba0194ab669b463
Instruction Fuzzy Hash: 4DD0C97229430DBBDA18AAC5A846EB5339C9B0CB11F804025BB095A5D0DAB2F59486E9

Function 02AC4020 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 02AC5527

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8090dd993c0bde5a2b76b492b75a598339eca176c67940df5399ceb310218da6
Instruction ID: 4e7c4f5d457239f714bb8787bb7970640a56ef88ac8696901e8b20e21a3e2b05
Opcode Fuzzy Hash: 8090dd993c0bde5a2b76b492b75a598339eca176c67940df5399ceb310218da6
Instruction Fuzzy Hash: 61D0223228430DB7D2009A80DC06FB633AC8B08F00F808420BB1A9A1C0AEB2F910C3E4

Function 02AC4030 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 02AC5547

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 581203eb1b1f1bb6d3b9b24f85d55add3cb1e33f953dd2595a878d85c622fe2e
Instruction ID: 1816b054356da65be754ec842b4bcf62fbb807c5c6338ed1ae5f1476da4c8dd0
Opcode Fuzzy Hash: 581203eb1b1f1bb6d3b9b24f85d55add3cb1e33f953dd2595a878d85c622fe2e
Instruction Fuzzy Hash: 0FD0223229430DB7D6009AC4EC02FB533AC8B08F00F804020BB199A1C0EEB2F500C3E4

Function 000513E0 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(001B39F8,0002A55F,00000040,?), ref: 000513F6

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cdde96b7c9848d5825fea9d13b35f64ca1a94bf380e17970d0f08499740ce1b1
Instruction ID: dbc2b5b9041529ad9c8e5f8b8ec9e5ae15248c614303e7e4ba970c24fc2821e5
Opcode Fuzzy Hash: cdde96b7c9848d5825fea9d13b35f64ca1a94bf380e17970d0f08499740ce1b1
Instruction Fuzzy Hash: 13D0C774A4421C7BC740FBE95D0BAADBBB8DB44705F4002A1EE18E5140EBF077588696

Function 0316C480 Relevance: 1.5, APIs: 1, Instructions: 10networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,03184834,00000010,00000000), ref: 0316C490

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: cac0c72e9d8c0dc750f794b8bdc7a17e529cbce7b5e23380f6f523a91b45bba0
Instruction ID: 84e6d08aa5a46b0d6a9027a3bafa74f9c84bf6ab87808cd24677041ac3597780
Opcode Fuzzy Hash: cac0c72e9d8c0dc750f794b8bdc7a17e529cbce7b5e23380f6f523a91b45bba0
Instruction Fuzzy Hash: A5C09B3128030D77D51067D59C06F8577DC570CF05F404814760856186DEF1B450455C

Function 02AC56E0 Relevance: 1.5, APIs: 1, Instructions: 10networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,02ADB604,00000010,00000000), ref: 02AC56F0

Memory Dump Source

Source File: 00000000.00000002.1953931555.0000000002AC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac1000_1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 16a0585bd4b415d053483d26578c22e3fc0fde81012179a6bb3ec90d217ee6c8
Instruction ID: 284937ca02339877fbb0f72ab1c226a7c91a6c4c9f7510419da42dbfe9f0b2fe
Opcode Fuzzy Hash: 16a0585bd4b415d053483d26578c22e3fc0fde81012179a6bb3ec90d217ee6c8
Instruction Fuzzy Hash: ADC09B356C530C77E5105595DC06F85775C9708F58F014C00760A9A181CDF1F4514568

Function 0005A27D Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0005A28C

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 5fd990dd5571a8b7648cbd3aca7bf926373a34bf1660844ab466f9652ecd6b20
Instruction ID: 0fcdf5b48d10dea2ce5fce92cb7a55ec8f4e35fe8c832c1a613efd8c7394344b
Opcode Fuzzy Hash: 5fd990dd5571a8b7648cbd3aca7bf926373a34bf1660844ab466f9652ecd6b20
Instruction Fuzzy Hash: 0FB09270A02206AADE806734990A72727946B83307F00C995F400D9442EB7AC0898941

Function 00051270 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

std::tr1::_Random_device.LIBCPMT ref: 00051277

Part of subcall function 0015EBB3: _rand_s.LIBCMT ref: 0015EBBF
Part of subcall function 0015EBB3: std::exception::exception.LIBCMT ref: 0015EBD7
Part of subcall function 0015EBB3: __CxxThrowException@8.LIBCMT ref: 0015EBEC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Exception@8Random_deviceThrow_rand_sstd::exception::exceptionstd::tr1::_
String ID:
API String ID: 3795384516-0
Opcode ID: c45f4bd1007560787cde0ef8e5e5411bf9392eba5c60d02c7db98903bcf4f06c
Instruction ID: d84ce5b4f716c7292b58c303e7ac3094eeba1a395179d0ae3b0cbac6b2dc879d
Opcode Fuzzy Hash: c45f4bd1007560787cde0ef8e5e5411bf9392eba5c60d02c7db98903bcf4f06c
Instruction Fuzzy Hash: FCB01270C0D30CA34A28AB956902419B79CC501212B0003DDBC0C073019DB39A1005D5

Function 00051590 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00051270: std::tr1::_Random_device.LIBCPMT ref: 00051277

Sleep.KERNEL32(00000000,?,000003E8,00002710,00000000,000000FF,6C078965,0019533E,EFF91FD5,?,0016A0EB,000000FF), ref: 00051640

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Random_deviceSleepstd::tr1::_
String ID:
API String ID: 1866270999-0
Opcode ID: 324472f96511045afe5f786f00743816fd8a223394ac0a484e61465c29dfe12f
Instruction ID: e523e154aecdc9c1cbc466d41dd8eab0cc99f0062fd8ae4f39f8695b2c6f9b1a
Opcode Fuzzy Hash: 324472f96511045afe5f786f00743816fd8a223394ac0a484e61465c29dfe12f
Instruction Fuzzy Hash: 5F116D31944258ABCB14EB54DC95BEEB3B8EB04750F404799B816B29D2EF702B48CE54

Non-executed Functions

Function 031646E0 Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 240libraryloaderinjectionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03164704
_memset.LIBCMT ref: 03164750
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 03164764

Part of subcall function 03165330: _vswprintf_s.LIBCMT ref: 03165341

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03164793
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000214,00000000,00000000,00000044,?), ref: 031647DA

Part of subcall function 03164640: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,031647FC), ref: 03164656
Part of subcall function 03164640: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,031647FC,?,?,?,?,?,?,74DF0630), ref: 0316465D

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0316480A
_memset.LIBCMT ref: 03164823
LoadLibraryA.KERNEL32(Kernel32.dll,OpenProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0316483B
GetProcAddress.KERNEL32(00000000), ref: 03164844
LoadLibraryA.KERNEL32(Kernel32.dll,ExitProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03164856
GetProcAddress.KERNEL32(00000000), ref: 03164859
LoadLibraryA.KERNEL32(Kernel32.dll,WinExec,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0316486B
GetProcAddress.KERNEL32(00000000), ref: 0316486E
LoadLibraryA.KERNEL32(Kernel32.dll,WaitForSingleObject,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03164880
GetProcAddress.KERNEL32(00000000), ref: 03164883
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0316488B
GetProcessId.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03164892
_memset.LIBCMT ref: 031648B4
GetModuleFileNameA.KERNEL32(00000000,?,000000FA,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 031648CA
VirtualAllocEx.KERNEL32(00000000,00000000,00000118,00003000,00000040), ref: 031648FF
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000118,00000000), ref: 0316491B
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000001,?), ref: 03164943
VirtualAllocEx.KERNEL32(00000000,00000000,00001000,00003000,00000040), ref: 03164958
WriteProcessMemory.KERNEL32(00000000,00000000,031645F0,00001000,00000000), ref: 03164972
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000001,00000000), ref: 03164990
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 031649A1
Sleep.KERNEL32(0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 031649BA
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000040,00000000), ref: 031649D6
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000040,00000000), ref: 031649E8
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 031649F1

Strings

OpenProcess, xrefs: 03164831
Windows\System32\svchost.exe, xrefs: 031647A4
WinExec, xrefs: 0316485B
ExitProcess, xrefs: 03164846
D, xrefs: 03164740
Windows\SysWOW64\svchost.exe, xrefs: 03164770
%s%s, xrefs: 03164776, 031647AA
Kernel32.dll, xrefs: 03164836, 0316484B, 03164860, 03164875
WaitForSingleObject, xrefs: 03164870

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect_memset$AllocCreateCurrentFileMemoryOpenThreadWrite$AttributesDirectoryModuleNameRemoteResumeSleepSystemToken_vswprintf_s
String ID: %s%s$D$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 4176418925-3213446972
Opcode ID: e37ec7c6986876fbb9b2997ed7fecca80887149d22b6b665a950790045d953ef
Instruction ID: 1c83b47129f18ae281095fc6919e0b7fbc0c5c0661f46c15860b60f9b48ae4ee
Opcode Fuzzy Hash: e37ec7c6986876fbb9b2997ed7fecca80887149d22b6b665a950790045d953ef
Instruction Fuzzy Hash: D481B775A40358BBD735EB629C45FDFB67CAF9DB01F100198B218A61C1DFB06A848F68

Function 03167F30 Relevance: 58.1, APIs: 29, Strings: 4, Instructions: 354windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 03167F67
GetDC.USER32(00000000), ref: 03167F74
CreateCompatibleDC.GDI32(00000000), ref: 03167F7A
GetDC.USER32(00000000), ref: 03167F85
GetDeviceCaps.GDI32(00000000,00000008), ref: 03167F92
GetDeviceCaps.GDI32(00000000,00000076), ref: 03167F9A
ReleaseDC.USER32(00000000,00000000), ref: 03167FAB
GetSystemMetrics.USER32(0000004E), ref: 03167FD0
GetSystemMetrics.USER32(0000004F), ref: 03167FFE
GetSystemMetrics.USER32(0000004C), ref: 03168050
GetSystemMetrics.USER32(0000004D), ref: 03168065
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 0316807E
SelectObject.GDI32(?,00000000), ref: 0316808C
SetStretchBltMode.GDI32(?,00000003), ref: 03168098
GetSystemMetrics.USER32(0000004F), ref: 031680A5
GetSystemMetrics.USER32(0000004E), ref: 031680B8
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 031680DF
_memset.LIBCMT ref: 03168152
GetDIBits.GDI32(?,?,00000000,00000000,?,00000028,00000000), ref: 0316816F
_memset.LIBCMT ref: 03168187
_memmove.LIBCMT ref: 031681C1

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

DeleteObject.GDI32(?), ref: 03168202
DeleteObject.GDI32(?), ref: 0316820C
ReleaseDC.USER32(00000000,?), ref: 03168218
_memmove.LIBCMT ref: 031682A4
DeleteObject.GDI32(?), ref: 031682B0
DeleteObject.GDI32(?), ref: 031682BA
ReleaseDC.USER32(00000000,?), ref: 031682C6

Strings

gfff, xrefs: 03167FE8
(, xrefs: 03168116
gfff, xrefs: 03168010
6, xrefs: 03168139

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memmove_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 1260665799-713438465
Opcode ID: 71694d0c3a01c62c97317c7e773b1a884b6b23ee8db08c905a4f4c5e1e0556a4
Instruction ID: 5301eafda6087bbd9696cc6aeb8ac5ab0dd012fb63a372a4a985000fefed9465
Opcode Fuzzy Hash: 71694d0c3a01c62c97317c7e773b1a884b6b23ee8db08c905a4f4c5e1e0556a4
Instruction Fuzzy Hash: 2BD14BB5E00318EFDB14EFE5D885A9EBBB8FF4C300F144529E506AB240DB74A945CBA5

Function 0316AA00 Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 216filesynchronizationstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0316AA30
Sleep.KERNEL32(00000001,?,?,031630D3), ref: 0316AA42
GetTickCount.KERNEL32 ref: 0316AA4E
GetTickCount.KERNEL32 ref: 0316AA61
InterlockedExchange.KERNEL32(03193358,00000000), ref: 0316AA69
OpenClipboard.USER32(00000000), ref: 0316AA71
GetClipboardData.USER32(0000000D), ref: 0316AA79
GlobalSize.KERNEL32(00000000), ref: 0316AA8A
GlobalLock.KERNEL32(00000000), ref: 0316AA9B
_memmove.LIBCMT ref: 0316AAFF
wsprintfW.USER32 ref: 0316AB14
_memset.LIBCMT ref: 0316AB32
GlobalUnlock.KERNEL32(00000000), ref: 0316AB3B
CloseClipboard.USER32 ref: 0316AB41
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,031630D3), ref: 0316AB59
CreateFileW.KERNEL32(031921E8,40000000,00000002,00000000,00000004,00000080,00000000,?,?,?,?,?,031630D3), ref: 0316AB76
SetFilePointer.KERNEL32 ref: 0316AB8F
lstrlenW.KERNEL32(03188340,00000000,00000000), ref: 0316ABA3
WriteFile.KERNEL32(00000000,03188340,00000000), ref: 0316ABAE
CloseHandle.KERNEL32(00000000), ref: 0316ABB5
ReleaseMutex.KERNEL32(?), ref: 0316ABC1
lstrlenW.KERNEL32(?,?,031630D3), ref: 0316AC0D
_memset.LIBCMT ref: 0316AC16
wsprintfW.USER32 ref: 0316AC4A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,031630D3), ref: 0316AC5C
CreateFileW.KERNEL32(031921E8,40000000,00000002,00000000,00000004,00000080,00000000), ref: 0316AC79
SetFilePointer.KERNEL32 ref: 0316AC92
lstrlenW.KERNEL32(00000000,00000000,00000000), ref: 0316ACA5
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0316ACAF
CloseHandle.KERNEL32(00000000), ref: 0316ACB6
ReleaseMutex.KERNEL32(?), ref: 0316ACC3

Strings

[, xrefs: 0316AB0E
[esc], xrefs: 0316AC1E, 0316AC40

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: File$ClipboardCloseGlobal_memsetlstrlen$CountCreateHandleMutexObjectPointerReleaseSingleTickWaitWritewsprintf$DataExchangeInterlockedLockOpenSizeSleepUnlock_memmove
String ID: [$[esc]
API String ID: 3350212475-1978609555
Opcode ID: a449e0976562fc04f95f18e3867be43d1f35f2868d939e08d7935b16078c83b8
Instruction ID: 1284baf8f84d94aa13c728adb6e62257c0b041dece9d4363b0a2ee14ac35f11e
Opcode Fuzzy Hash: a449e0976562fc04f95f18e3867be43d1f35f2868d939e08d7935b16078c83b8
Instruction Fuzzy Hash: 5071F7B5600215ABD724EBA1DC49FDA7779BF1C700F094549FA05A6184DFB0A9C1CFB4

Function 000C659B Relevance: 42.5, APIs: 28, Instructions: 452windowkeyboardCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 000C65D0
GetWindowRect.USER32(?,?), ref: 000C65F3
PtInRect.USER32(?,?,?), ref: 000C6601

Part of subcall function 000F3D3F: RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 000F3DB6

GetAsyncKeyState.USER32(00000012), ref: 000C6626
ScreenToClient.USER32(?,?), ref: 000C6674
IsWindow.USER32(?), ref: 000C66BB
IsWindow.USER32(?), ref: 000C66FE
GetWindowRect.USER32(?,?), ref: 000C671E
PtInRect.USER32(?,?,?), ref: 000C672E
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 000C6763
PtInRect.USER32(-00000054,?,?), ref: 000C67AE
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 000C67D3
ScreenToClient.USER32(?,?), ref: 000C682B
PtInRect.USER32(?,?,?), ref: 000C683B
GetParent.USER32(?), ref: 000C68C5
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 000C6958
GetFocus.USER32 ref: 000C695E
WindowFromPoint.USER32(?,?,00000000), ref: 000C6996
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 000C69E0
GetSystemMenu.USER32(?,00000000,?,?,75C0A000,?), ref: 000C6A69
IsMenu.USER32(?), ref: 000C6A8B
EnableMenuItem.USER32(?,0000F030,00000000), ref: 000C6AA8
EnableMenuItem.USER32(?,0000F120,00000000), ref: 000C6AB3
IsZoomed.USER32(?), ref: 000C6AC1
IsIconic.USER32(?), ref: 000C6AE0
EnableMenuItem.USER32(?,0000F120,00000003), ref: 000C6AF4
TrackPopupMenu.USER32(?,00000100,?,?,00000000,?,00000000), ref: 000C6B1C
SendMessageW.USER32(?,00000112,00000000,00000000), ref: 000C6B36

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$MenuRect$MessageSend$EnableItem$ClientScreen$AsyncFocusFromIconicParentPointPopupRedrawStateSystemTrackVisibleZoomed
String ID:
API String ID: 3398603409-0
Opcode ID: 60dbb26145fd6f27e19d17b831a0cc1352876894f67d0331728065d0d78e3fe5
Instruction ID: bea4cb46c939359c69b248b25cf4c99e027a7d6d130580b8f84d160e4c230693
Opcode Fuzzy Hash: 60dbb26145fd6f27e19d17b831a0cc1352876894f67d0331728065d0d78e3fe5
Instruction Fuzzy Hash: 4EF13B71A00209AFDB609FA4DD84EADBBF9FB08300B14456DF545E7261DB72AD80DF61

Function 000D87A3 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 325windowkeyboardCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000D87AD
GetKeyState.USER32(00000001), ref: 000D87F2
GetKeyState.USER32(00000002), ref: 000D87FF
GetKeyState.USER32(00000004), ref: 000D880C
GetParent.USER32(?), ref: 000D8831
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 000D88E5
_memset.LIBCMT ref: 000D88F9
ScreenToClient.USER32(?,?), ref: 000D8920
_memset.LIBCMT ref: 000D892E
GetCursorPos.USER32(?), ref: 000D8984
SendMessageW.USER32(?,00000412,00000000,?), ref: 000D89A8
SendMessageW.USER32(?,00000432,00000000,?), ref: 000D8A08
SendMessageW.USER32(?,00000401,00000001,00000000), ref: 000D8A2E
SendMessageW.USER32(?,00000411,00000001,?), ref: 000D8A4A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000213), ref: 000D8A5D
SendMessageW.USER32(?,00000433,00000000,?), ref: 000D8A88
_memset.LIBCMT ref: 000D8AB0
_free.LIBCMT ref: 000D8ADA
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 000D8AF1
GetParent.USER32(?), ref: 000D8B1E

Strings

,, xrefs: 000D8945

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$State_memset$Parent$ClientCursorH_prolog3_ScreenWindow_free
String ID: ,
API String ID: 2464378573-3772416878
Opcode ID: ec40982b90f0b7b4b8e6b0858d317a94da6ed471a4cbb4e0fa6eee8c59e97c00
Instruction ID: 18fad647dc8414e6b6c808b81b4a367fe4df80206da6482edf51a7b2fd23b7c6
Opcode Fuzzy Hash: ec40982b90f0b7b4b8e6b0858d317a94da6ed471a4cbb4e0fa6eee8c59e97c00
Instruction Fuzzy Hash: 54C19FB0A007159FEF649F64CC85BAD77B1FF04710F24856BEA45A73A2DBB19880CB61

Function 03164D50 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 127threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03164D6F
_memset.LIBCMT ref: 03164D9B
_memset.LIBCMT ref: 03164DD0
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 03164DE4

Part of subcall function 03165330: _vswprintf_s.LIBCMT ref: 03165341

GetFileAttributesA.KERNEL32(?), ref: 03164E11
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 03164E61
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 03164E8D
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00003000,00000040), ref: 03164EA5
GetThreadContext.KERNEL32(?,?,?,?,00000000,?,00003000,00000040), ref: 03164EC7
SetThreadContext.KERNEL32(?,00010007,?,?,00000000,?,00003000,00000040), ref: 03164EE5
ResumeThread.KERNEL32(?,?,?,00000000,?,00003000,00000040), ref: 03164EFA

Strings

D, xrefs: 03164DAF
Windows\System32\svchost.exe, xrefs: 03164E22
Windows\SysWOW64\svchost.exe, xrefs: 03164DEA
%s%s, xrefs: 03164DF6, 03164E28

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 2170139861-2473635271
Opcode ID: 7d4eea69f14e98ee51a20461e6eb182e42f6353ea9feb8e36a443277d7a0495e
Instruction ID: 1cafdf615ff4c0e99029cd0c981f54daa9267cefdbe73b36dd071d4055c05446
Opcode Fuzzy Hash: 7d4eea69f14e98ee51a20461e6eb182e42f6353ea9feb8e36a443277d7a0495e
Instruction Fuzzy Hash: 554164B5A00358ABDB25DB61DC85BEE77BCAB58B00F1401D9A60DA61C0DFB46AC48F64

Function 0316A6D0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130synchronizationfilestringCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,031921E8,74DEE010,74DF2FA0,?,?,031630AE,?), ref: 0316A6F5
lstrcatW.KERNEL32(031921E8,\sys_vdio.key,?,?,031630AE,?), ref: 0316A705
CreateMutexW.KERNEL32(00000000,00000000,031921E8,?,?,031630AE,?), ref: 0316A714
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,031630AE,?), ref: 0316A722
CreateFileW.KERNEL32(031921E8,40000000,00000002,00000000,00000004,00000080,00000000,?,?,031630AE,?), ref: 0316A73F
GetFileSize.KERNEL32(00000000,00000000,?,?,031630AE,?), ref: 0316A74A
CloseHandle.KERNEL32(00000000,?,?,031630AE,?), ref: 0316A753
DeleteFileW.KERNEL32(031921E8,?,?,031630AE,?), ref: 0316A766
ReleaseMutex.KERNEL32(?,?,?,031630AE,?), ref: 0316A773
DirectInput8Create.DINPUT8(?,00000800,031871F4,03192680,00000000,?,?,031630AE,?), ref: 0316A78E
GetTickCount.KERNEL32 ref: 0316A840

Strings

\sys_vdio.key, xrefs: 0316A6FB
<, xrefs: 0316A812

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeTickWaitlstrcat
String ID: <$\sys_vdio.key
API String ID: 3264482950-1798576524
Opcode ID: c01e0a03d0d2cd72108886447887d2bc5d0bd48c91d9301d3d714626113e8a6b
Instruction ID: 2d6d6d1185bff30c98196434afd90b56c8449c31aca98036ce87b00b045915cf
Opcode Fuzzy Hash: c01e0a03d0d2cd72108886447887d2bc5d0bd48c91d9301d3d714626113e8a6b
Instruction Fuzzy Hash: 6841E4B0740306BFD704EFA6DC45F8E7BB9AF4C701F114556FA11AB284CBB0A8428BA4

Function 0008AB3A Relevance: 21.3, APIs: 14, Instructions: 280keyboardwindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0008AC1E
SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 0008AC3A
GetCapture.USER32 ref: 0008ACB4
GetKeyState.USER32(00000011), ref: 0008AD16
GetKeyState.USER32(00000010), ref: 0008AD23
ImmGetContext.IMM32(?), ref: 0008AD31
ImmGetOpenStatus.IMM32(00000000,?), ref: 0008AD3E
ImmReleaseContext.IMM32(?,00000000,?), ref: 0008AD60
GetFocus.USER32 ref: 0008AD8A
IsWindow.USER32(?), ref: 0008ADCB
IsWindow.USER32(?), ref: 0008AE51
ClientToScreen.USER32(?,?), ref: 0008AE61
IsWindow.USER32(?), ref: 0008AE87
ClientToScreen.USER32(?,?), ref: 0008AEB6

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$ClientContextScreenState$CaptureFocusMessageOpenReleaseSendStatus
String ID:
API String ID: 1155058817-0
Opcode ID: 8ce390b6d6e2aa4948a5097349a32661c22f75ad795595f439f60f06c93af5c6
Instruction ID: 0d54210217508fa0f090f85948a6d59afa9a83d675c089fe2b7c93a2a2afd3cf
Opcode Fuzzy Hash: 8ce390b6d6e2aa4948a5097349a32661c22f75ad795595f439f60f06c93af5c6
Instruction Fuzzy Hash: F2A1A031700602ABEF64BFA0CC85ABE77E5BB06301F14442BE5D6D6C52D771D990DB52

Function 03164520 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,?,?,03169EB2), ref: 03164537
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,03169EB2), ref: 0316453E
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0316455A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03164577
CloseHandle.KERNEL32(?), ref: 03164581
GetModuleHandleA.KERNEL32(NtDll.dll,NtSetInformationProcess,?,?,?,?,?,?,?,03169EB2), ref: 03164591
GetProcAddress.KERNEL32(00000000), ref: 03164598
GetCurrentProcessId.KERNEL32 ref: 031645BA
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 031645C7

Strings

SeDebugPrivilege, xrefs: 0316454C
NtSetInformationProcess, xrefs: 03164587
NtDll.dll, xrefs: 0316458C

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Process$CurrentHandleOpenToken$AddressAdjustCloseLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 1802016953-1577477132
Opcode ID: b8ca6f08e1f12b08a284de6e1ba67564ec507bea71b3bbf285eac3982f0cbf4a
Instruction ID: 819f39a6955811a0b83f8fb8779f77ba85eddfe7b30b90035437ec6ac878d295
Opcode Fuzzy Hash: b8ca6f08e1f12b08a284de6e1ba67564ec507bea71b3bbf285eac3982f0cbf4a
Instruction Fuzzy Hash: E2214F71A4020AAFDB14FBE59C4ABEF7B78EB0C700F100119BA15AA1C4DFB059408BB9

Function 00090A4A Relevance: 20.8, APIs: 13, Instructions: 1300COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00090A54
Polygon.GDI32(?,?,00000004), ref: 00090B6E
CreatePolygonRgn.GDI32(?,00000008,00000002), ref: 00091295
InflateRect.USER32(?,000000FF,00000000), ref: 000912F8
GetClientRect.USER32(?,?), ref: 00091391
Polyline.GDI32(00000007,?,00000008), ref: 00091430
CreatePolygonRgn.GDI32(?,?,00000002), ref: 00090E9E

Part of subcall function 0005A40A: __EH_prolog3.LIBCMT ref: 0005A411
Part of subcall function 0005A40A: CreatePen.GDI32(?,?,?), ref: 0005A432

Part of subcall function 0005A336: SelectObject.GDI32(?,00000000), ref: 0005A35C
Part of subcall function 0005A336: SelectObject.GDI32(?,?), ref: 0005A372

Part of subcall function 00059D3E: MoveToEx.GDI32(?,?,?,?), ref: 00059D68
Part of subcall function 00059D3E: MoveToEx.GDI32(?,?,?,?), ref: 00059D79

Part of subcall function 0005A45E: __EH_prolog3.LIBCMT ref: 0005A465
Part of subcall function 0005A45E: CreateSolidBrush.GDI32(00000000), ref: 0005A480

FillRect.USER32(0000000A,?,?), ref: 000919B9

Part of subcall function 000597C1: MoveToEx.GDI32(?,?,?,00000000), ref: 000597DE
Part of subcall function 000597C1: LineTo.GDI32(?,?,?), ref: 000597ED

CreateRectRgnIndirect.GDI32(?), ref: 000916A8
OffsetRect.USER32(?,00000001,00000000), ref: 00091975
FillRect.USER32(0000000A,?), ref: 000919E3
OffsetRect.USER32(?,00000000), ref: 00091A9B
CreateRectRgnIndirect.GDI32(?), ref: 00091BAE

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Create$MovePolygon$FillH_prolog3IndirectObjectOffsetSelect$BrushClientH_prolog3_InflateLinePolylineSolid
String ID:
API String ID: 3550269515-0
Opcode ID: dd6d8c25839de790a528247cf15c2644683a99ecb265cbbccd0a2b97900457b4
Instruction ID: f98594d3b8789b50fcd30ff1e4401a36e6c5c646f7b51fd48487af51ea13d375
Opcode Fuzzy Hash: dd6d8c25839de790a528247cf15c2644683a99ecb265cbbccd0a2b97900457b4
Instruction Fuzzy Hash: 3DC21670A0021ADFDF64DF68CD85BEEB7B5BF48300F1085AAE919A7251DB309A85DF50

Function 000CE3B0 Relevance: 16.9, APIs: 11, Instructions: 446COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 000CE432
SetRectEmpty.USER32(?), ref: 000CE44B
InflateRect.USER32(?,000000FE,00000000), ref: 000CE49F
OffsetRect.USER32(?,00000000,00000000), ref: 000CE691
GetSystemMetrics.USER32(00000002), ref: 000CE6DA
InflateRect.USER32(?,00000000,00000000), ref: 000CE703
InflateRect.USER32(?,000000FF,000000FF), ref: 000CE8D0
InvalidateRect.USER32(?,?,00000001), ref: 000CE8DF
GetClientRect.USER32(?,?), ref: 000CE8FA
InvalidateRect.USER32(?,?,00000001), ref: 000CE926
UpdateWindow.USER32(?), ref: 000CE92F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Inflate$ClientInvalidate$EmptyMetricsOffsetSystemUpdateWindow
String ID:
API String ID: 159692204-0
Opcode ID: b566cc98a97236af2af7973bb8dff8030d596edcb09641460d94ef297fce3008
Instruction ID: 47dbfcf0757be89d294fb8849ab6c95f17136e667d86c418db9646f697a2e724
Opcode Fuzzy Hash: b566cc98a97236af2af7973bb8dff8030d596edcb09641460d94ef297fce3008
Instruction Fuzzy Hash: 58021471900655CFCF64CF68C988AAD77B5FF49300F2841BAEC49AF25ADB70A945CB60

Function 000E8144 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 000E81D4
_memset.LIBCMT ref: 000E81E2
_free.LIBCMT ref: 000E820E
IsWindow.USER32(?), ref: 000E832F

Strings

0, xrefs: 000E81F8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ClientScreenWindow_free_memset
String ID: 0
API String ID: 2869304798-4108050209
Opcode ID: af9f9b67b6663802b42e15b3df6e5f17568ccb7ae6b2041d0b1f642694900f2e
Instruction ID: c7b371cbae38a7c54e1d109567a6499a816de4fb1ea16e4f3692b58fe399378a
Opcode Fuzzy Hash: af9f9b67b6663802b42e15b3df6e5f17568ccb7ae6b2041d0b1f642694900f2e
Instruction Fuzzy Hash: A351AF30A00684DFDF649FA6D888BADBBF5FF04710F10812AE959B7291DFB19981CB51

Function 03164A70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 03164A89
OpenProcessToken.ADVAPI32(00000000), ref: 03164A90
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03164AB6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03164ACC
GetLastError.KERNEL32 ref: 03164AD2
CloseHandle.KERNEL32(?), ref: 03164AE0
CloseHandle.KERNEL32(?), ref: 03164AFB

Strings

SeShutdownPrivilege, xrefs: 03164AA2

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: 07a04befd6a8eb20dd282a1936200e8284c68afb1110c60a9f3fc3d4faa52183
Instruction ID: 2f688351014f0840f8439a1650312a04e0ffa73e538f8663f566c14701c37867
Opcode Fuzzy Hash: 07a04befd6a8eb20dd282a1936200e8284c68afb1110c60a9f3fc3d4faa52183
Instruction Fuzzy Hash: DA118271B0020AABDB14EBA6DC4ABEF7B78EB1C701F400518E901AB180DF70A94187A8

Function 000B6712 Relevance: 13.6, APIs: 9, Instructions: 141clipboardwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 000B6719

Part of subcall function 0005A078: __EH_prolog3.LIBCMT ref: 0005A07F
Part of subcall function 0005A078: GetWindowDC.USER32(00000000,00000004,00067938,00000000,?,?,00178F40), ref: 0005A0AB

CreateCompatibleDC.GDI32(00000000), ref: 000B673F
CreateCompatibleBitmap.GDI32(?,?,?), ref: 000B6768
FillRect.USER32(?,?), ref: 000B67E5
OpenClipboard.USER32(?), ref: 000B6847
EmptyClipboard.USER32 ref: 000B6855
CloseClipboard.USER32 ref: 000B686C

Part of subcall function 0005769F: __EH_prolog3.LIBCMT ref: 000576A6

SetClipboardData.USER32(00000002,00000000), ref: 000B6882
CloseClipboard.USER32 ref: 000B6899

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseCompatibleCreateH_prolog3$BitmapDataEmptyFillH_prolog3_catch_OpenRectWindow
String ID:
API String ID: 519079464-0
Opcode ID: 37d89240fc0303dc9530edd49aa862ca679ac52d42ef5b6d6867ae576618d24e
Instruction ID: ce293426b9218c89f7e71ddbf0cce4f002bb98bd0835921942a0c4007c47da78
Opcode Fuzzy Hash: 37d89240fc0303dc9530edd49aa862ca679ac52d42ef5b6d6867ae576618d24e
Instruction Fuzzy Hash: F7516E70D00248EFDB05EFA8CD859EEBBB8AF19305F104159F416A3292DB755A48DB61

Function 03164420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

PathIsDirectoryA.SHLWAPI(C:\Program Files\VMware\VMware Tools\), ref: 03164439
_memset.LIBCMT ref: 03164461
GlobalMemoryStatusEx.KERNEL32(?), ref: 03164493

Strings

VMware, xrefs: 03164470
C:\Program Files\VMware\VMware Tools\, xrefs: 03164434
@, xrefs: 03164489

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: DirectoryGlobalMemoryPathStatus_memset
String ID: @$C:\Program Files\VMware\VMware Tools\$VMware
API String ID: 3437834110-3945705589
Opcode ID: b6b513d059f87994fb1e5e1127781176737647cf692ff09704e6c59402c2d57d
Instruction ID: 58b63b6995b6e771453f49efb7a60a50d9633c1f846dbd7ffa712e5ad554bf5d
Opcode Fuzzy Hash: b6b513d059f87994fb1e5e1127781176737647cf692ff09704e6c59402c2d57d
Instruction Fuzzy Hash: 7C01C474A15218ABDF24FBA5AC46BEEB7B9EF0C601F040199D8095B141DF305A64CB96

Function 03167893 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32(?,03188160), ref: 031678B6
ClearEventLogW.ADVAPI32(00000000), ref: 031678C4
CloseEventLog.ADVAPI32(00000000), ref: 031678CB

Strings

Application, xrefs: 03167893
Security, xrefs: 0316789B
System, xrefs: 031678A3

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 077fd3702d2796e3dfe9f0f059965c329ddb5df3fc0d3c34da2cbc03d727d2f4
Instruction ID: 203fefae32635743de5ab40c353cb8b56a6f56a789fbaea93ebf1d6989fb5071
Opcode Fuzzy Hash: 077fd3702d2796e3dfe9f0f059965c329ddb5df3fc0d3c34da2cbc03d727d2f4
Instruction Fuzzy Hash: 48F0A0362042109FC225FF65E9CC8AFF7E4FB8D709F54062DE98AAA100CF214855CB6A

Function 000FC056 Relevance: 9.1, APIs: 6, Instructions: 122timekeyboardCOMMON

Download Yara Rule

APIs

GetParent.USER32(0017DE08), ref: 000FC06E
KillTimer.USER32(0017DE08,00000003,00000000), ref: 000FC0B5
SetRectEmpty.USER32(?), ref: 000FC0CC
GetAsyncKeyState.USER32(00000001), ref: 000FC108
ScreenToClient.USER32(0017DE08,?), ref: 000FC12F
KillTimer.USER32(0017DE08,00000001), ref: 000FC157

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: KillTimer$AsyncClientEmptyParentRectScreenState
String ID:
API String ID: 3040166693-0
Opcode ID: a931803da7f83bab357eaeae169c776688000adbd4124015352f4363adb8f44f
Instruction ID: 83f692b1a923e9b40b8b14529f9f6a4bc901b0d1ef4b78b3710ad38adc31f95b
Opcode Fuzzy Hash: a931803da7f83bab357eaeae169c776688000adbd4124015352f4363adb8f44f
Instruction Fuzzy Hash: CF418B71600208DFDF209F60CD85AFA77B5FF49301F04457AEA1A9A6A2CB709850EF60

Function 000805D8 Relevance: 9.1, APIs: 6, Instructions: 116keyboardwindowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000362,0000E002,00000000), ref: 0008065A
UpdateWindow.USER32(?), ref: 00080671
GetKeyState.USER32(00000079), ref: 00080696
GetKeyState.USER32(00000012), ref: 000806A3
GetParent.USER32(?), ref: 00080759
PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 00080775

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageState$Exception@8ParentPostSendThrowUpdateWindow
String ID:
API String ID: 3830675576-0
Opcode ID: 68710b1823cab81f31845b80749cca104403333e1f4a9c7f6388935d69d2e2c8
Instruction ID: 94721fcbb03e3dba4f9bc90eabb5ca79773eaab161fa3b43ab17feb963f245b1
Opcode Fuzzy Hash: 68710b1823cab81f31845b80749cca104403333e1f4a9c7f6388935d69d2e2c8
Instruction Fuzzy Hash: 1041B031600B46DBE7E0AB20C848FAA77E5BF40351F144928E9DA57291DBB5A888DF14

Function 03164640 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,031647FC), ref: 03164656
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,031647FC,?,?,?,?,?,?,74DF0630), ref: 0316465D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 03164685
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 031646B9

Strings

SeDebugPrivilege, xrefs: 0316467E

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: f86b8120d85298ea7a749a3abea8b6fafdce076fa9b4bb779abd7af5f887b084
Instruction ID: 95a13ea7c43c06614172600d76817fd1ee3d25281091830897b4f9ab56f10a07
Opcode Fuzzy Hash: f86b8120d85298ea7a749a3abea8b6fafdce076fa9b4bb779abd7af5f887b084
Instruction Fuzzy Hash: D5115EB1B44209ABDB04EFE5DC46BEFB7B8EB4C700F104158E505AB280EF74A9448B65

Function 000AC98F Relevance: 7.6, APIs: 5, Instructions: 86keyboardwindowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000AC9C3
GetKeyState.USER32(00000012), ref: 000AC9F5
GetKeyState.USER32(00000011), ref: 000AC9FE
SendMessageW.USER32(?,00000157,00000000,00000000), ref: 000ACA17
SendMessageW.USER32(?,0000014F,00000001,00000000), ref: 000ACA28

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSendState$Parent
String ID:
API String ID: 1284845784-0
Opcode ID: dc003f8d454c380704a500099df19aea2f402ad6bbf7f52ead71888031c2f74c
Instruction ID: a3f81801b790a3ed8a49e18c383777fa5dac1aa58c15d945b225c435341b3032
Opcode Fuzzy Hash: dc003f8d454c380704a500099df19aea2f402ad6bbf7f52ead71888031c2f74c
Instruction Fuzzy Hash: 37216E3634060C9BFE35E6F8CC41E7E32D6BBE3B48F164529E245DB555EA709C408762

Function 0317112F Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 031738B6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 031738CB
UnhandledExceptionFilter.KERNEL32(03184E30), ref: 031738D6
GetCurrentProcess.KERNEL32(C0000409), ref: 031738F2
TerminateProcess.KERNEL32(00000000), ref: 031738F9

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 0f6df3b0ea3b4df95d066650d8ec69ad579fb6937256970da9ee8799110b462d
Instruction ID: 372432381d5239d9e83620762cf6d107fb31788ed74ffe3cbf38d75e76943c0e
Opcode Fuzzy Hash: 0f6df3b0ea3b4df95d066650d8ec69ad579fb6937256970da9ee8799110b462d
Instruction Fuzzy Hash: 1821DAB9904206BFD709EF26F189A883BB4BB0C300B05413BE51886358EBB154C58F29

Function 000549C6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000800,00000003,?,00000004), ref: 00054A0D
__snwprintf_s.LIBCMT ref: 00054A3F
LoadLibraryW.KERNEL32(?), ref: 00054A7A

Part of subcall function 00148FB0: __getptd_noexit.LIBCMT ref: 00148FB0

Strings

LOC, xrefs: 000549ED

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: InfoLibraryLoadLocale__getptd_noexit__snwprintf_s
String ID: LOC
API String ID: 3175857669-519433814
Opcode ID: f6b34d50c01c47704b0bd883b36511df699cf94b1cc801c678b8ac08920a7cee
Instruction ID: 615e4c6ad6121141272b2718280e65a2f2fd22d34868b66114751f3ae4a74641
Opcode Fuzzy Hash: f6b34d50c01c47704b0bd883b36511df699cf94b1cc801c678b8ac08920a7cee
Instruction Fuzzy Hash: 1611B771900204AAD750FB64CC49BEF73ADEB50315F140465FA05A71A2EF749E4D87A5

Function 0005810C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,00000000,00000005), ref: 00058137
LoadResource.KERNEL32(?,00000000), ref: 0005813F
LockResource.KERNEL32(00000000), ref: 00058151
FreeResource.KERNEL32(00000000), ref: 0005819F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 3a10353dea940839bd790c1db6baf97864323e2ba1df45a6c74cc93b8e745db5
Instruction ID: bdb76278aba9f6dda579fed84a3d170f2e635d4e9e28f626010d3c304e01f0c1
Opcode Fuzzy Hash: 3a10353dea940839bd790c1db6baf97864323e2ba1df45a6c74cc93b8e745db5
Instruction Fuzzy Hash: 94118E35500A10EFD7608FA5C858A77B7F8FF44312F10C429ED8263650EB70AD49DBA0

Function 0316EBA0 Relevance: 4.6, APIs: 3, Instructions: 84networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,?,-0000001D), ref: 0316EBD8
htons.WS2_32(00000000), ref: 0316EC22
bind.WS2_32(?,00000002,-0000001D), ref: 0316EC46

Part of subcall function 0316C420: InterlockedIncrement.KERNEL32(0319100C), ref: 0316C42C
Part of subcall function 0316C420: InterlockedIncrement.KERNEL32(0319100C), ref: 0316C437

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: IncrementInterlockedbind$htons
String ID:
API String ID: 1901664375-0
Opcode ID: ef277dafa9d1133600bfa5a71e14ea8bab6293d67a93cdc88902f4dfae6b93dc
Instruction ID: 0e45e756d43bc52b1c43736b9d7ee87d9f40e6e277503d660834fba6c132030c
Opcode Fuzzy Hash: ef277dafa9d1133600bfa5a71e14ea8bab6293d67a93cdc88902f4dfae6b93dc
Instruction Fuzzy Hash: BC21C5769001198BCB24DFA8D9859BFB3A8EB09320B14475AFC25CB181E775C8A0C7E1

Function 000F094D Relevance: 4.5, APIs: 3, Instructions: 43windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000F096A

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

IsIconic.USER32(?), ref: 000F0993
GetParent.USER32(?), ref: 000F09A0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Parent$Exception@8IconicThrow
String ID:
API String ID: 2923462127-0
Opcode ID: 2d81d7a8bbdffc04350c54c5b787b7a7f454f74bb102ae2931ab87ca168885ac
Instruction ID: 7e66280c126150bdea5ae1dd753380c29986d9123047f91b272f3c73516065a5
Opcode Fuzzy Hash: 2d81d7a8bbdffc04350c54c5b787b7a7f454f74bb102ae2931ab87ca168885ac
Instruction Fuzzy Hash: C2F068327082096BEB612A71DC44A777AA9EF903A5B105435F98993A13FAB0DC14A6E0

Function 0316D850 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 484COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0316DD48

Strings

[RO] %ld bytes, xrefs: 0316D8D8, 0316D9EC, 0316DA73, 0316DCCC, 0316DD90

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _memmove
String ID: [RO] %ld bytes
API String ID: 4104443479-772938740
Opcode ID: b2ae75c83bb49867ab26c31867dfc41b89eebf5c3225213d194b05d94f4d7a31
Instruction ID: 664fdfddbd65fbec0a1bac6acba27c25d7c9aead6529f7caef32e5c5ad46bd42
Opcode Fuzzy Hash: b2ae75c83bb49867ab26c31867dfc41b89eebf5c3225213d194b05d94f4d7a31
Instruction Fuzzy Hash: 97224B70A00B05DFCB24CF69D984AAABBF1FF88300F14895DD89A8B755D770E991CB90

Function 00086268 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

SetForegroundWindow.USER32(?), ref: 00086295
IsIconic.USER32(?), ref: 0008629E

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ForegroundIconicWindow
String ID:
API String ID: 1248896474-0
Opcode ID: 08726dd8a24d2e78092711bea651301a2f39a2e832691632d0cf489f8812df32
Instruction ID: 5099cc0c065fa7d895b2de5af7db148a98dbbffad9be27a1f4bede783edd92d8
Opcode Fuzzy Hash: 08726dd8a24d2e78092711bea651301a2f39a2e832691632d0cf489f8812df32
Instruction Fuzzy Hash: F9E02B33204A119BD7203B75EC09E7E37A6FFC4731F160269F995962E1EF618C415BA0

Function 0008630C Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0008632C

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 3458b6951db1065dff60056fb3118577cec12fd352371081ebd75d8385da2d81
Instruction ID: 8803fd78e87c0269190cb03c58ea672ad94edc73a017de88969e6eaa18e4d36c
Opcode Fuzzy Hash: 3458b6951db1065dff60056fb3118577cec12fd352371081ebd75d8385da2d81
Instruction Fuzzy Hash: 5AE026333585012BD7657A39FC05D7A27EAFBC9B11B110A2DF586D2691DF52DC024660

Function 03167941 Relevance: 1.5, APIs: 1, Instructions: 16shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03164A70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03164A89
Part of subcall function 03164A70: OpenProcessToken.ADVAPI32(00000000), ref: 03164A90
Part of subcall function 03164A70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03164AB6
Part of subcall function 03164A70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03164ACC
Part of subcall function 03164A70: GetLastError.KERNEL32 ref: 03164AD2
Part of subcall function 03164A70: CloseHandle.KERNEL32(?), ref: 03164AE0

ExitWindowsEx.USER32(00000004), ref: 0316794E

Part of subcall function 03164A70: CloseHandle.KERNEL32(?), ref: 03164AFB

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 47d2ae3f34261ae549b721523a4adb1e8a7851c65dc0e6f44d3b905188858233
Instruction ID: 278c96543f3d3df92763c0a9cf84445561ca97016984b5f8ec354c69fc933501
Opcode Fuzzy Hash: 47d2ae3f34261ae549b721523a4adb1e8a7851c65dc0e6f44d3b905188858233
Instruction Fuzzy Hash: 8CD0C73930820157C528F7B6785677EB351DBCD311F40112E960B4D0808E2604544169

Function 03167972 Relevance: 1.5, APIs: 1, Instructions: 16shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03164A70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03164A89
Part of subcall function 03164A70: OpenProcessToken.ADVAPI32(00000000), ref: 03164A90
Part of subcall function 03164A70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03164AB6
Part of subcall function 03164A70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03164ACC
Part of subcall function 03164A70: GetLastError.KERNEL32 ref: 03164AD2
Part of subcall function 03164A70: CloseHandle.KERNEL32(?), ref: 03164AE0

ExitWindowsEx.USER32(00000006), ref: 0316797F

Part of subcall function 03164A70: CloseHandle.KERNEL32(?), ref: 03164AFB

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: c9c7cd6ba7b4176278da060f302efb9c0d681c05ce2d7cc47b2190bb264a6b11
Instruction ID: 3f01b8c07e09417ff71f101e6ff9ddfbba0ddee870dad6b38dc06125b32e8c27
Opcode Fuzzy Hash: c9c7cd6ba7b4176278da060f302efb9c0d681c05ce2d7cc47b2190bb264a6b11
Instruction Fuzzy Hash: 56D0C73930820057C528F7B6785677EB351DBCD311F40112E950B4D0808E1704648165

Function 031679A3 Relevance: 1.5, APIs: 1, Instructions: 16shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03164A70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03164A89
Part of subcall function 03164A70: OpenProcessToken.ADVAPI32(00000000), ref: 03164A90
Part of subcall function 03164A70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03164AB6
Part of subcall function 03164A70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03164ACC
Part of subcall function 03164A70: GetLastError.KERNEL32 ref: 03164AD2
Part of subcall function 03164A70: CloseHandle.KERNEL32(?), ref: 03164AE0

ExitWindowsEx.USER32(00000005), ref: 031679B0

Part of subcall function 03164A70: CloseHandle.KERNEL32(?), ref: 03164AFB

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 2c357aeedd9bd6b3e38b7cf0ccfca4c6d4c07a75a4839a31683bf8bd0793afd9
Instruction ID: 9eec94703f47d48867a93860aba635d9f6e2c994b5d708cc06447bbc7df4ed8c
Opcode Fuzzy Hash: 2c357aeedd9bd6b3e38b7cf0ccfca4c6d4c07a75a4839a31683bf8bd0793afd9
Instruction Fuzzy Hash: FBD0C73930824057C528F7B6785677EB355DBCD311F41112E950B4D0808E1604544565

Function 031837A9 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 031837A9

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ddf74d343ffc13ba073414a063cc5f5ced8ce0b163da101451c211fc8d1e5564
Instruction ID: 9b5ca02968253505564dc3ceb3a335df95795a7ba540c66c81a83a936cfa2558
Opcode Fuzzy Hash: ddf74d343ffc13ba073414a063cc5f5ced8ce0b163da101451c211fc8d1e5564
Instruction Fuzzy Hash: A9C08C78002202AFD308FB22B90E3143AE3A30C702F14042BF02E89109CB7008C0CF38

Function 03165530 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d5bdda972c8bf4e358910236a17f6b625761a3f17e03a1928c3ebfa68fbd1f
Instruction ID: a207444529db7b41e46a35613586b4f09db1e71bd0945a7c2db787f9a3219ce9
Opcode Fuzzy Hash: 03d5bdda972c8bf4e358910236a17f6b625761a3f17e03a1928c3ebfa68fbd1f
Instruction Fuzzy Hash: C2226277E5151A8BDB08CA95CC515D9B3E3BBC8314B1F9129C819E3305EE79B9478BC0

Function 000B6908 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 323fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000B6912
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000A90,000B6EC6,?,00000000,00000084,000B736D,0000000A,0000000A,0000000A,00000000,00000014,000AF32A), ref: 000B69C1
__wsplitpath_s.LIBCMT ref: 000B69ED
__wsplitpath_s.LIBCMT ref: 000B6A0C
__wmakepath_s.LIBCMT ref: 000B6A39
_wcslen.LIBCMT ref: 000B6A45
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000A90,000B6EC6,?,00000000,00000084,000B736D,0000000A,0000000A), ref: 000B6A7D

Strings

, xrefs: 000B6DB9

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: File__wsplitpath_s$CreateH_prolog3_ModuleName__wmakepath_s_wcslen
String ID:
API String ID: 1221639053-3916222277
Opcode ID: 90cdc9b4c23115ed1a285e8c0310584663b24ffd505bd4aa0643a16d623f306d
Instruction ID: d2788601a3a0bf26f7ee0adb097fee63ab864dd3121fd2737a20810c624cadd4
Opcode Fuzzy Hash: 90cdc9b4c23115ed1a285e8c0310584663b24ffd505bd4aa0643a16d623f306d
Instruction Fuzzy Hash: 76D11A75A00228AADF20AF60CD85AEEB7B8BB0A315F1040A9F509A2951DB755FC4DF52

Function 0317479B Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 031747A3
__mtterm.LIBCMT ref: 031747AF

Part of subcall function 0317447A: DecodePointer.KERNEL32(00000008,031729FC,031729E2,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317448B
Part of subcall function 0317447A: TlsFree.KERNEL32(0000001E,031729FC,031729E2,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 031744A5
Part of subcall function 0317447A: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,031729FC,031729E2,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317B8D8
Part of subcall function 0317447A: _free.LIBCMT ref: 0317B8DB
Part of subcall function 0317447A: DeleteCriticalSection.KERNEL32(0000001E,?,?,031729FC,031729E2,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317B902

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 031747C5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 031747D2
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 031747DF
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 031747EC
TlsAlloc.KERNEL32(?,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317483C
TlsSetValue.KERNEL32(00000000,?,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03174857
__init_pointers.LIBCMT ref: 03174861
EncodePointer.KERNEL32(?,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03174872
EncodePointer.KERNEL32(?,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317487F
EncodePointer.KERNEL32(?,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317488C
EncodePointer.KERNEL32(?,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03174899
DecodePointer.KERNEL32(Function_000145FE,?,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 031748BA
__calloc_crt.LIBCMT ref: 031748CF
DecodePointer.KERNEL32(00000000,?,?,03172939,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 031748E9
GetCurrentThreadId.KERNEL32 ref: 031748FB

Strings

FlsSetValue, xrefs: 031747D4
FlsGetValue, xrefs: 031747C7
KERNEL32.DLL, xrefs: 0317479E
FlsAlloc, xrefs: 031747BF
FlsFree, xrefs: 031747E1

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 3d05a80733e5604b0c7dc129b1c5e3b5d1ca152f808dfaebb913d8ccca2b4483
Instruction ID: 66d6ab281f0ee00988cbc2186f658c948658643d1ad9e56f2582f518fce899ec
Opcode Fuzzy Hash: 3d05a80733e5604b0c7dc129b1c5e3b5d1ca152f808dfaebb913d8ccca2b4483
Instruction Fuzzy Hash: 0C313D35908317ABC719FBF6B8986597EB5AB4C770709062BE414926A8EF30A1C1CB74

Function 03168670 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 170stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03168692
_wcsrchr.LIBCMT ref: 0316869A
_memset.LIBCMT ref: 031686D1
_wcsrchr.LIBCMT ref: 031686D9
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 031686E6
_memset.LIBCMT ref: 03168754
wsprintfW.USER32 ref: 0316876C
_memset.LIBCMT ref: 03168780
_memset.LIBCMT ref: 0316879B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000002), ref: 031687D1
lstrcatW.KERNEL32(?,0318785C), ref: 03168819
lstrcatW.KERNEL32(?,?), ref: 03168823
_memset.LIBCMT ref: 0316883A

Strings

WinSta0\Default, xrefs: 03168852
%s\shell\open\command, xrefs: 03168766
D, xrefs: 03168846
"%1, xrefs: 031687DD

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _memset$_wcsrchrlstrcat$EnvironmentExpandStringslstrlenwsprintf
String ID: "%1$%s\shell\open\command$D$WinSta0\Default
API String ID: 3970221696-33419044
Opcode ID: 3a69a9f22050595b3260c53c8b8757efc875a6c66833fed7db3cb0931bc31dfb
Instruction ID: ba3cc8295e2fe9437759d99c4ca9f562869f4cda9d27eb75a93a092ba4e02ba5
Opcode Fuzzy Hash: 3a69a9f22050595b3260c53c8b8757efc875a6c66833fed7db3cb0931bc31dfb
Instruction Fuzzy Hash: 1051CCB6A4031D67DB24F7A1DC45FEA737CAF1C700F044599A609AA080EF70A694CFB6

Function 031666A0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 308windowCOMMON

Download Yara Rule

APIs

GdipGetImagePixelFormat.GDIPLUS(031662F0,?,?,00000000), ref: 031666CB
GdipGetImageHeight.GDIPLUS(031662F0,?,?,00000000), ref: 0316674C
GdipGetImageWidth.GDIPLUS(031662F0,?,?,00000000), ref: 03166774
GdipGetImagePaletteSize.GDIPLUS(031662F0,?,?,00000000), ref: 031667CF
__alloca_probe_16.LIBCMT ref: 031667F9
_malloc.LIBCMT ref: 03166810

Part of subcall function 03171DDE: __FF_MSGBANNER.LIBCMT ref: 03171DF7
Part of subcall function 03171DDE: __NMSG_WRITE.LIBCMT ref: 03171DFE
Part of subcall function 03171DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171E23

_free.LIBCMT ref: 03166850
GdipGetImagePalette.GDIPLUS(?,00000008,?,80070216,?,00000000), ref: 03166878
GdipBitmapLockBits.GDIPLUS(031662F0,?,00000001,?,?,?,00000000), ref: 03166951
_free.LIBCMT ref: 03166973
_memcpy_s.LIBCMT ref: 031669C2
GdipBitmapUnlockBits.GDIPLUS(?,?,?,00000000), ref: 03166A0F
GdipCreateBitmapFromScan0.GDIPLUS(?,?,03188294,00022009,?,00000000,?,00000000), ref: 03166A6B
GdipGetImageGraphicsContext.GDIPLUS(00000000,00022009,?,00000000), ref: 03166A8B
GdipDrawImageI.GDIPLUS(00000000,031662F0,00000000,00000000,?,00000000), ref: 03166AA6
GdipDeleteGraphics.GDIPLUS(?,?,00000000), ref: 03166AB3
GdipDisposeImage.GDIPLUS(00000000,?,00000000), ref: 03166ABA
_free.LIBCMT ref: 03166AD5

Strings

&, xrefs: 03166731

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Gdip$Image$Bitmap_free$BitsGraphicsPalette$AllocateContextCreateDeleteDisposeDrawFormatFromHeapHeightLockPixelScan0SizeUnlockWidth__alloca_probe_16_malloc_memcpy_s
String ID: &
API String ID: 1957643072-3042966939
Opcode ID: 96a2a9856d7f858a9e0362adc13682837181531a208dda98e44386d1c724cf75
Instruction ID: 889c57adce48d8e3aed861fedf4648e9c54a4d4c42506aa170a132d5238846e2
Opcode Fuzzy Hash: 96a2a9856d7f858a9e0362adc13682837181531a208dda98e44386d1c724cf75
Instruction Fuzzy Hash: B3C133B5A003199BDB24DF95CC80B9AB7B8EF4C304F0485ADDA09A7201D774ADD5CFA9

Function 03163B70 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 146memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(75BF73E0), ref: 03163B9A

Part of subcall function 031639A0: GetCurrentProcessId.KERNEL32(76CB4AAF,00000944,00000000,75BF73E0,00000000,0318326B,000000FF,?,03163BAC,00000000), ref: 031639C8
Part of subcall function 031639A0: OpenProcess.KERNEL32(00000400,00000000,00000000,?,03163BAC,00000000), ref: 031639D7
Part of subcall function 031639A0: OpenProcessToken.ADVAPI32(00000000,00000008,?,?,03163BAC,00000000), ref: 031639F0
Part of subcall function 031639A0: CloseHandle.KERNEL32(00000000,?,03163BAC,00000000), ref: 031639FB

_memset.LIBCMT ref: 03163BBB
GetVersionExW.KERNEL32(?), ref: 03163BD4
GetCurrentProcess.KERNEL32(00000008,?), ref: 03163C0B
OpenProcessToken.ADVAPI32(00000000), ref: 03163C12
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 03163C38
GetLastError.KERNEL32 ref: 03163C42
LocalAlloc.KERNEL32(00000040,?), ref: 03163C56
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 03163C7A
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 03163C87
GetSidSubAuthority.ADVAPI32 ref: 03163C95
LocalFree.KERNEL32(00000000), ref: 03163C9E
CloseHandle.KERNEL32(?), ref: 03163CB1
wsprintfW.USER32 ref: 03163D27

Strings

%d/, xrefs: 03163CF3
%d/, xrefs: 03163CD5
%d/None/%s, xrefs: 03163CE4
%d/, xrefs: 03163D21
%d/, xrefs: 03163D12

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocal$AllocCountErrorFreeLastVersion_memsetwsprintf
String ID: %d/$%d/$%d/$%d/$%d/None/%s
API String ID: 982326441-3175268128
Opcode ID: ab04a2c3fab31d15290e8e72b38d167110929c4f7d589b701d83f2572e37f4a8
Instruction ID: 6e8be2d638af7e206117d36c75e1241291285ad2398e2c5f355098c5fc451327
Opcode Fuzzy Hash: ab04a2c3fab31d15290e8e72b38d167110929c4f7d589b701d83f2572e37f4a8
Instruction Fuzzy Hash: A451C079A00219AFDB24EBA1DC88EEFB778EB4D310F044899F91597140DB709DA1CFA4

Function 0005E64D Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000627C8: GetWindowLongW.USER32(?,000000F0), ref: 000627D3

GetParent.USER32(?), ref: 0005E687
SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 0005E6A8
GetWindowRect.USER32(?,?), ref: 0005E6C7
GetWindowLongW.USER32(00000000,000000F0), ref: 0005E6F9
MonitorFromWindow.USER32(00000000,00000001), ref: 0005E72D
GetMonitorInfoW.USER32(00000000), ref: 0005E734
CopyRect.USER32(?,?), ref: 0005E748
CopyRect.USER32(?,?), ref: 0005E752
GetWindowRect.USER32(00000000,?), ref: 0005E75B
MonitorFromWindow.USER32(00000000,00000002), ref: 0005E768
GetMonitorInfoW.USER32(00000000), ref: 0005E76F
CopyRect.USER32(?,?), ref: 0005E77D

Strings

(, xrefs: 0005E70F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Rect$Monitor$Copy$FromInfoLong$MessageParentSend
String ID: (
API String ID: 783970248-3887548279
Opcode ID: f522ba9266080c310f8a31f8488f756a73eb15db3e71d868f60c2badd0ef540d
Instruction ID: ee3ee77c6b7130e5a3d903edf4cc0e7f6cd5fc0e4699fee7d679590f8276a63a
Opcode Fuzzy Hash: f522ba9266080c310f8a31f8488f756a73eb15db3e71d868f60c2badd0ef540d
Instruction Fuzzy Hash: 0A6119B1E00269ABCB14DFA8DD889EEBBB9FF48711F140116E945F3251D770AE44CBA0

Function 03164B80 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 141libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll), ref: 03164BC3
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 03164BD7
FreeLibrary.KERNEL32(00000000), ref: 03164BF7
GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 03164C16
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 03164C53
_memset.LIBCMT ref: 03164C7E
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 03164C8C
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 03164CDB
CloseHandle.KERNEL32(?), ref: 03164CF9
Sleep.KERNEL32(00000001), ref: 03164D01
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 03164D0D
FreeLibrary.KERNEL32(00000000), ref: 03164D28

Strings

MSIE 6.0, xrefs: 03164BE1
InternetReadFile, xrefs: 03164C86
InternetCloseHandle, xrefs: 03164D07
InternetOpenUrlW, xrefs: 03164C10
InternetOpenW, xrefs: 03164BD1
wininet.dll, xrefs: 03164BA6

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 1463273941-1099148085
Opcode ID: 2b9f9dd61410f5bcb9f8156e16c2ed0b20a5c14eba66d126d888a9b9dcd2c47c
Instruction ID: e3ed8d7b48f50b64e4954e89a26a6a345ff359e709cc818e962955d21b8fd4ba
Opcode Fuzzy Hash: 2b9f9dd61410f5bcb9f8156e16c2ed0b20a5c14eba66d126d888a9b9dcd2c47c
Instruction Fuzzy Hash: 0841A471A40218ABD720EB659C41FDEB7F8BF4C700F14C1E9E659A6280DF705A858FE8

Function 03172910 Relevance: 27.1, APIs: 18, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

__heap_init.LIBCMT ref: 03172924

Part of subcall function 03176B9E: HeapCreate.KERNEL32(00000000,00001000,00000000,03172929,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03176BA7

__RTC_Initialize.LIBCMT ref: 03172944
GetCommandLineA.KERNEL32(031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03172949
___crtGetEnvironmentStringsA.LIBCMT ref: 03172954

Part of subcall function 03177DDE: GetEnvironmentStringsW.KERNEL32(?,?), ref: 03177DE8

__ioinit.LIBCMT ref: 0317295E

Part of subcall function 03177815: GetStartupInfoW.KERNEL32(?), ref: 03177822
Part of subcall function 03177815: __calloc_crt.LIBCMT ref: 0317782E

__ioterm.LIBCMT ref: 03172997

Part of subcall function 03177A5A: DeleteCriticalSection.KERNEL32(0000000D,00000000,?,031729CC,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 03177A7D
Part of subcall function 03177A5A: _free.LIBCMT ref: 03177A96

__mtterm.LIBCMT ref: 03172967

Part of subcall function 0317447A: DecodePointer.KERNEL32(00000008,031729FC,031729E2,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317448B
Part of subcall function 0317447A: TlsFree.KERNEL32(0000001E,031729FC,031729E2,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 031744A5
Part of subcall function 0317447A: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,031729FC,031729E2,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317B8D8
Part of subcall function 0317447A: _free.LIBCMT ref: 0317B8DB
Part of subcall function 0317447A: DeleteCriticalSection.KERNEL32(0000001E,?,?,031729FC,031729E2,031891B8,00000008,03172ACD,?,?,?,031891D8,0000000C,03172B88,?), ref: 0317B902

__setargv.LIBCMT ref: 0317296E
__setenvp.LIBCMT ref: 03172977
__cinit.LIBCMT ref: 03172982
__ioterm.LIBCMT ref: 031729C7
__mtterm.LIBCMT ref: 031729CC

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalDeleteSection$EnvironmentStrings__ioterm__mtterm_free$CommandCreateDecodeFreeHeapInfoInitializeLinePointerStartup___crt__calloc_crt__cinit__heap_init__ioinit__setargv__setenvp
String ID:
API String ID: 4115978036-0
Opcode ID: f11c0f6f0c576bf1876f8d37e2396a56496d93bcca17d8b23b4f38d0ba8d6735
Instruction ID: c6085fdaf274ac23a56971dbb8547dd3709e1ddfa132ff1bd7362c2bf798cff7
Opcode Fuzzy Hash: f11c0f6f0c576bf1876f8d37e2396a56496d93bcca17d8b23b4f38d0ba8d6735
Instruction Fuzzy Hash: CF31E6396087129BDB39FBB2A80467D36B9AF4D360B2D1D66D491D9084EF31C1C3C572

Function 000A4685 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 230windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000A468C
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 000A46D7
ClientToScreen.USER32(?,?), ref: 000A470C
_memset.LIBCMT ref: 000A474C
SendMessageW.USER32 ref: 000A476B
SHGetDesktopFolder.SHELL32(?), ref: 000A4793
GetParent.USER32(?), ref: 000A47BB
CreatePopupMenu.USER32 ref: 000A47FD

Strings

$, xrefs: 000A48A5

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$ClientCreateDesktopFolderH_prolog3_MenuParentPopupScreen_memset
String ID: $
API String ID: 937397865-3993045852
Opcode ID: 6791e0557e391ea2674d7cd409f9f1a68ee1730990ca9c7f3288bf37a2bdd845
Instruction ID: 93824ea7ec1fd8956858322e8c7bab8ff514cd0ed81e055f398c1dc9e1330421
Opcode Fuzzy Hash: 6791e0557e391ea2674d7cd409f9f1a68ee1730990ca9c7f3288bf37a2bdd845
Instruction Fuzzy Hash: 83913774A00219AFCB11DFE4CC889EEBBB9FF4A710B244519F545EB261DBB19950CFA0

Function 031631E0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 222stringcomregistryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0316321B
lstrcatW.KERNEL32(03193360,03187834,?,76CB4AAF,00000000,000009A8,75BF73E0), ref: 0316325D
lstrcatW.KERNEL32(03193360,0318785C,?,76CB4AAF,00000000,000009A8,75BF73E0), ref: 03163269
CoCreateInstance.OLE32(03184500,00000000,00000017,03188050,?,?,76CB4AAF,00000000,000009A8,75BF73E0), ref: 031632B0
_memset.LIBCMT ref: 0316335E
wsprintfW.USER32 ref: 031633C6
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 031633EF
_memset.LIBCMT ref: 03163406

Part of subcall function 031630E0: _memset.LIBCMT ref: 0316310C
Part of subcall function 031630E0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 03163118

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 031633C0

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}
API String ID: 1221949200-4035668053
Opcode ID: c1a4c78535fb260162fe9e87040fc3fc6d8e4c10bb82af9a7551fd1637e92dcb
Instruction ID: 5186dca5361b99c23808a63ad5d698b4d115f478f0bee78b25b2dbbcc500f789
Opcode Fuzzy Hash: c1a4c78535fb260162fe9e87040fc3fc6d8e4c10bb82af9a7551fd1637e92dcb
Instruction Fuzzy Hash: 128197B5A00229AFDB20DB95CC41FAEB778AF4C704F0445C9F629A7185DB74AE84CF64

Function 0007E3EF Relevance: 25.0, APIs: 11, Strings: 3, Instructions: 469windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0007E3F9
GetParent.USER32(?), ref: 0007E478
SendMessageW.USER32(?,00000117,?,?), ref: 0007E4DF
GetMenuItemCount.USER32(?), ref: 0007E4EE
_memset.LIBCMT ref: 0007E595

Strings

7, xrefs: 0007E5CB
@, xrefs: 0007E8EF
0, xrefs: 0007E5B2

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CountH_prolog3_ItemMenuMessageParentSend_memset
String ID: 0$7$@
API String ID: 2290845328-3997377745
Opcode ID: e734e8c64b90d9476980145038a77a420405dccd8620cec6e328f46d999b5723
Instruction ID: cf8e843852476e32168fd965ecd6ed9e3c3747330ce9121c9e4f01d95cf2cdd0
Opcode Fuzzy Hash: e734e8c64b90d9476980145038a77a420405dccd8620cec6e328f46d999b5723
Instruction Fuzzy Hash: 9F1288709012599BDB65DF64CC84BEEBBF5BF08300F1085E9E95DA6292DB34AE80CF54

Function 03166F90 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 245COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03166FDF
_memset.LIBCMT ref: 03167021
_memset.LIBCMT ref: 031670A5
swprintf.LIBCMT ref: 031670C4

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

_memset.LIBCMT ref: 03167196
swprintf.LIBCMT ref: 031671B5
_memset.LIBCMT ref: 03167211
swprintf.LIBCMT ref: 03167230

Strings

plugmark, xrefs: 03166FF6
onlyloadinmyself, xrefs: 03166FB4
%s %s, xrefs: 031670B3, 03167121, 031671A4, 0316721F

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID: %s %s$onlyloadinmyself$plugmark
API String ID: 1873853019-591889663
Opcode ID: 1c5a4b701a25cf8b00acbd31a798f78127e073d3d78da5174eaa9d053f4f1730
Instruction ID: 3e66180aa78bfe396c085a7217092aa5b78d3d205a9ce0536b0b24683014f2f1
Opcode Fuzzy Hash: 1c5a4b701a25cf8b00acbd31a798f78127e073d3d78da5174eaa9d053f4f1730
Instruction Fuzzy Hash: 4D81C6B9A403017BE314EB64DC85F577364AF0C714F184624F9196B382EBB1F9608BE6

Function 00054A92 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000548E0: ActivateActCtx.KERNEL32(?,?,0019DF70,00000010,00054AC8,KERNEL32.DLL), ref: 00054900

GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 00054AD7
_memset.LIBCMT ref: 00054B03
_wcstoul.LIBCMT ref: 00054B4B

Part of subcall function 001491D5: wcstoxl.LIBCMT ref: 001491E5

_wcslen.LIBCMT ref: 00054B6C

Part of subcall function 00148FB0: __getptd_noexit.LIBCMT ref: 00148FB0

GetUserDefaultUILanguage.KERNEL32 ref: 00054B7C
ConvertDefaultLocale.KERNEL32(?), ref: 00054BA3
ConvertDefaultLocale.KERNEL32(?), ref: 00054BB2
GetSystemDefaultUILanguage.KERNEL32 ref: 00054BBB
ConvertDefaultLocale.KERNEL32(?), ref: 00054BD7
ConvertDefaultLocale.KERNEL32(?), ref: 00054BE6
GetModuleFileNameW.KERNEL32(00050000,?,00000105), ref: 00054C1E

Strings

KERNEL32.DLL, xrefs: 00054AB6
e, xrefs: 00054B22
GetThreadPreferredUILanguages, xrefs: 00054AD1

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Default$ConvertLocale$Language$ActivateAddressFileModuleNameProcSystemUser__getptd_noexit_memset_wcslen_wcstoulwcstoxl
String ID: GetThreadPreferredUILanguages$KERNEL32.DLL$e
API String ID: 2246399177-2285706205
Opcode ID: e303cd5b6b355d4750516d26faeafd7c1fbffc8fbb7b72836f3e39546162b004
Instruction ID: 673bf6da1b607c6868e137118dafe866de9432d95238e39863a8cc83be404172
Opcode Fuzzy Hash: e303cd5b6b355d4750516d26faeafd7c1fbffc8fbb7b72836f3e39546162b004
Instruction Fuzzy Hash: BB419371A002286BDB61AFA4DC45BEE77F8AF88705F0104BAE90DE7141DB74AE858F50

Function 0005A721 Relevance: 24.2, APIs: 16, Instructions: 245windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005A728
CreateCompatibleDC.GDI32(00000000), ref: 0005A783
CreateCompatibleDC.GDI32(00000000), ref: 0005A797
CreateCompatibleDC.GDI32(00000000), ref: 0005A7AB
GetObjectW.GDI32(00000004,00000018,?), ref: 0005A7C7
CreateBitmap.GDI32(?,?,?,?,00000000), ref: 0005A7F4
CreateBitmap.GDI32(00000008,00000008,00000001,00000001,0016E0EC), ref: 0005A814
CreatePatternBrush.GDI32(?), ref: 0005A822

Part of subcall function 0005A27D: DeleteObject.GDI32(00000000), ref: 0005A28C

CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0005A844

Part of subcall function 0005A2DA: SelectObject.GDI32(?,?), ref: 0005A2E5

GetPixel.GDI32(?,00000000,00000000), ref: 0005A884

Part of subcall function 000595F0: SetBkColor.GDI32(?,?), ref: 0005960E
Part of subcall function 000595F0: SetBkColor.GDI32(?,?), ref: 0005961B

BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0005A8B0
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00EE0086), ref: 0005A8D4
FillRect.USER32(?,?,?), ref: 0005A938
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0005A968
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 0005A97F
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0005A992

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Create$BitmapCompatibleObject$Color$BrushDeleteFillH_prolog3_PatternPixelRectSelect
String ID:
API String ID: 1818846147-0
Opcode ID: e77914a238cf5c002a6c4e721180677579d3e39785595284ca509ca487601369
Instruction ID: 9389812fe3a944b2ded540c588b6cb359623ec4d7b8f46da5f0efe021e92948f
Opcode Fuzzy Hash: e77914a238cf5c002a6c4e721180677579d3e39785595284ca509ca487601369
Instruction Fuzzy Hash: 5691F0B1E00208AEDF11AFE4DD819EEBFB9EF08341F144129F919B6162DB715E59DB20

Function 000B2AEC Relevance: 24.2, APIs: 16, Instructions: 157windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000B2AF3
CreateCompatibleDC.GDI32(00000000), ref: 000B2B29
GetObjectW.GDI32(?,00000018,?), ref: 000B2B40
SelectObject.GDI32(?,?), ref: 000B2B6C
CreateCompatibleBitmap.GDI32(?,?,?), ref: 000B2B8E
SelectObject.GDI32(?,00000000), ref: 000B2BA1
CreateCompatibleDC.GDI32(?), ref: 000B2BB4
SelectObject.GDI32(?,?), ref: 000B2BC5
SelectObject.GDI32(?,00000000), ref: 000B2BD6
DeleteObject.GDI32(?), ref: 000B2BDB
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 000B2C07
GetPixel.GDI32(?,?,?), ref: 000B2C26
SetPixel.GDI32(?,?,?,00000000), ref: 000B2C6D
SelectObject.GDI32(?,?), ref: 000B2C91
SelectObject.GDI32(?,00000000), ref: 000B2C99
DeleteObject.GDI32(?), ref: 000B2CA1

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Object$Select$CompatibleCreate$DeletePixel$BitmapH_prolog3
String ID:
API String ID: 3639146769-0
Opcode ID: ab84d76676dbd6248dc4dfccb98620bfc4dcd983ed4a9152ac1a17eb1f3726a6
Instruction ID: 1ce6b7d806fc30a2e642128b5b93327d61b7ffe23f5d0aa742ff9245a5222007
Opcode Fuzzy Hash: ab84d76676dbd6248dc4dfccb98620bfc4dcd983ed4a9152ac1a17eb1f3726a6
Instruction Fuzzy Hash: DC51E431800209EBCF52EFA4CD45AEEBFB1FF58311F244125E515B21A2DB315A96EF61

Function 000ECBE8 Relevance: 22.8, APIs: 15, Instructions: 259COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 000ECBFF
LoadCursorW.USER32(00000000,00007F00), ref: 000ECC6D
SetCursor.USER32(00000000), ref: 000ECC74
SetRectEmpty.USER32(?), ref: 000ECC8D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Cursor$CaptureEmptyLoadRect
String ID:
API String ID: 2438408-0
Opcode ID: 3afd1dbbbe03fe9144b4dee8f6f8509cd47c83b70a7dd90241b9d39c5769559f
Instruction ID: a7e8b571896e50b95471e326cdeb68ac56889cddce344ca26c5cce8164fa9f88
Opcode Fuzzy Hash: 3afd1dbbbe03fe9144b4dee8f6f8509cd47c83b70a7dd90241b9d39c5769559f
Instruction Fuzzy Hash: 0AA12971E012599FDF14DFA9CD888EEBBB6FF48301B14412AE806FB215DB71A946CB50

Function 03169910 Relevance: 22.8, APIs: 15, Instructions: 254COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D), ref: 03169923
SetLastError.KERNEL32(000000C1), ref: 03169942

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 85d88d3aa32d76c43608d7a9185a05ac47f5c392b9b52aeab08d4bbb4eeff9c6
Instruction ID: af76134161fcd95476375a939be5c2371cdfc2618d15694cac94551a3956be0d
Opcode Fuzzy Hash: 85d88d3aa32d76c43608d7a9185a05ac47f5c392b9b52aeab08d4bbb4eeff9c6
Instruction Fuzzy Hash: 6581B3727006059BD720DFEAEC84B6AB7E8FB4C315F184569E909DB640EB71E460CBD0

Function 00078914 Relevance: 22.7, APIs: 15, Instructions: 232timeCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0007894A
InflateRect.USER32(?,00000000,00000000), ref: 00078979
SetRectEmpty.USER32(?), ref: 00078A17
SetRectEmpty.USER32(?), ref: 00078A20
GetSystemMetrics.USER32(00000002), ref: 00078A41
KillTimer.USER32(?,00000002), ref: 00078ADB
EqualRect.USER32(?,?), ref: 00078AFD
EqualRect.USER32(?,?), ref: 00078B0E
EqualRect.USER32(?,?), ref: 00078B5F
InvalidateRect.USER32(?,?,00000001), ref: 00078B78
InvalidateRect.USER32(?,?,00000001), ref: 00078B80
EqualRect.USER32(?,?), ref: 00078B94
InvalidateRect.USER32(?,?,00000001), ref: 00078BA7
InvalidateRect.USER32(?,?,00000001), ref: 00078BAF
UpdateWindow.USER32(?), ref: 00078BC2

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$EqualInvalidate$Empty$ClientInflateKillMetricsSystemTimerUpdateWindow
String ID:
API String ID: 2140115980-0
Opcode ID: 9284813e7dc53d4c777c0162d11e53a091f83eaff05483367d262e1583e3b72f
Instruction ID: 9e728b996c42b66332c611cba5fd86a427caf4c274d978d60421321902cd9543
Opcode Fuzzy Hash: 9284813e7dc53d4c777c0162d11e53a091f83eaff05483367d262e1583e3b72f
Instruction Fuzzy Hash: 7D91097194021A9FCF11CFA4C988AEE7BB5FF04300F1885B5ED09AB255DBB4A941CFA5

Function 0008093A Relevance: 22.7, APIs: 15, Instructions: 199windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 000809A4
GetDlgItem.USER32(?,?), ref: 00080A2E
ShowWindow.USER32(00000000,00000000), ref: 00080A39
GetMenu.USER32(?), ref: 00080A4B
InvalidateRect.USER32(?,00000000,00000001), ref: 00080A66

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

GetDlgItem.USER32(?,0000E900), ref: 00080AA3
SetWindowLongW.USER32(00000000,000000F4,0000EA21), ref: 00080AC0
GetDlgItem.USER32(0000EA21,0000EA21), ref: 00080AD9
GetDlgItem.USER32(0000E900,0000E900), ref: 00080AEF
SetWindowLongW.USER32(00000000,000000F4,0000EA21), ref: 00080B01
SetWindowLongW.USER32(?,000000F4,0000E900), ref: 00080B0D
InvalidateRect.USER32(00000001,00000000,00000001), ref: 00080B20
SetMenu.USER32(00000000,00000000), ref: 00080B37
GetDlgItem.USER32(?,00000000), ref: 00080B7E
ShowWindow.USER32(?,00000005), ref: 00080B8C

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ItemWindow$Long$InvalidateMenuRectShow$CtrlException@8Throw
String ID:
API String ID: 3179827820-0
Opcode ID: ecd39011517aa0a86b4effd819d0f86c165ce51a51cc54ebc65944360263586f
Instruction ID: fb8a7d8a894b18e24f0e1176d72e9ddfc88e7d66c35a03fc45898c1c812b4d05
Opcode Fuzzy Hash: ecd39011517aa0a86b4effd819d0f86c165ce51a51cc54ebc65944360263586f
Instruction Fuzzy Hash: 46815F30600604EFDBA1AF64CC88BA9BBF5FF85701F148969F8DA9B6A1D7719844DF40

Function 03168330 Relevance: 22.7, APIs: 15, Instructions: 176memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,76CB4AAF,?,00000000,?), ref: 0316836E
GlobalLock.KERNEL32(00000000), ref: 0316837A
_memmove.LIBCMT ref: 03168386
GlobalUnlock.KERNEL32(00000000), ref: 0316838F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 031683A5
EnterCriticalSection.KERNEL32(03191D64), ref: 031683E3
LeaveCriticalSection.KERNEL32(03191D64), ref: 031683F4

Part of subcall function 03166630: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 03166654
Part of subcall function 03166630: GdipDisposeImage.GDIPLUS(?), ref: 03166668

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0316841C

Part of subcall function 03166C90: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 03166CBD
Part of subcall function 03166C90: __alloca_probe_16.LIBCMT ref: 03166CEA
Part of subcall function 03166C90: _free.LIBCMT ref: 03166D33

GetHGlobalFromStream.OLE32(?,?), ref: 0316843D
GlobalLock.KERNEL32(?), ref: 03168447
GlobalFree.KERNEL32(00000000), ref: 0316845F

Part of subcall function 03166490: DeleteObject.GDI32(?), ref: 031664C2
Part of subcall function 03166490: EnterCriticalSection.KERNEL32(03191D64,?,?,?,0316646B), ref: 031664D3
Part of subcall function 03166490: EnterCriticalSection.KERNEL32(03191D64,?,?,?,0316646B), ref: 031664E8
Part of subcall function 03166490: GdiplusShutdown.GDIPLUS(00000000,?,?,?,0316646B), ref: 031664F4
Part of subcall function 03166490: LeaveCriticalSection.KERNEL32(03191D64,?,?,?,0316646B), ref: 03166505
Part of subcall function 03166490: LeaveCriticalSection.KERNEL32(03191D64,?,?,?,0316646B), ref: 0316650C

GlobalSize.KERNEL32(00000000), ref: 03168475
_memmove.LIBCMT ref: 0316848F
GlobalUnlock.KERNEL32(?), ref: 031684E8
GlobalFree.KERNEL32(00000000), ref: 03168510

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock_memmove$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown__alloca_probe_16_free
String ID:
API String ID: 2067358633-0
Opcode ID: d225512476bf69984be82edaa014e85e45eabc533a56086b9006525a581d60bb
Instruction ID: d2c57c53a7490c26869051eefe2e6ef43602241317e7fbd15b490a8b50ed95fd
Opcode Fuzzy Hash: d225512476bf69984be82edaa014e85e45eabc533a56086b9006525a581d60bb
Instruction Fuzzy Hash: A36127B5D00219AFCB14EFE9D88499EBBB9FF4C710F14852AE815A7341DB30A941CFA4

Function 0007C733 Relevance: 21.2, APIs: 14, Instructions: 206timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00000001), ref: 0007C744
KillTimer.USER32(?,00000002), ref: 0007C74B
IsWindow.USER32(?), ref: 0007C79B
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0007C7B8
GetCursorPos.USER32(?), ref: 0007C7F5
ScreenToClient.USER32(?,?), ref: 0007C802
KillTimer.USER32(?,00000001), ref: 0007C817
PtInRect.USER32(?,?,?), ref: 0007C846
KillTimer.USER32(?,00000002), ref: 0007C8BB
GetParent.USER32(?), ref: 0007C8D0
PtInRect.USER32(?,?,?), ref: 0007C8FB
KillTimer.USER32(?,00000014), ref: 0007C949
GetClientRect.USER32(?,?), ref: 0007C962
PtInRect.USER32(?,?,?), ref: 0007C972

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: KillTimer$Rect$Client$CursorMessageParentPostScreenWindow
String ID:
API String ID: 2803392424-0
Opcode ID: 1bc33e51721332624a65655665d9b3be282fe42562db775ac172725d6a99aac4
Instruction ID: 5f4ee3dd97fec523730be9b2521685880a82611fe5596e2f016db39a5a263809
Opcode Fuzzy Hash: 1bc33e51721332624a65655665d9b3be282fe42562db775ac172725d6a99aac4
Instruction Fuzzy Hash: B6718071A006059FDB619F64CC88EBEBBF6FF84700F10852EF58A96261DB74A840DF59

Function 0006A3CB Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0006A3D2

Part of subcall function 00054010: _DebugHeapAllocator.LIBCPMTD ref: 00054065

Part of subcall function 0005432D: _malloc.LIBCMT ref: 0005434B

Part of subcall function 000AF2E6: __EH_prolog3.LIBCMT ref: 000AF2ED

Strings

MFCMaskedEdit, xrefs: 0006A503
MFCColorButton, xrefs: 0006A427
MFCShellTree, xrefs: 0006A5D8
MFCMenuButton, xrefs: 0006A53A
MFCLink, xrefs: 0006A4CC
MFCEditBrowse, xrefs: 0006A45E
MFCVSListBox, xrefs: 0006A608
MFCShellList, xrefs: 0006A5A8
MFCButton, xrefs: 0006A3ED
MFCPropertyGrid, xrefs: 0006A571
MFCFontComboBox, xrefs: 0006A495

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$AllocatorDebugHeap_malloc
String ID: MFCButton$MFCColorButton$MFCEditBrowse$MFCFontComboBox$MFCLink$MFCMaskedEdit$MFCMenuButton$MFCPropertyGrid$MFCShellList$MFCShellTree$MFCVSListBox
API String ID: 1248039220-2110171958
Opcode ID: e219eab65aa9523deb68581ba47d0742e2136e811f19fd5566176edd4665fd1f
Instruction ID: 3b377452db26af9012816987ce08b21a42fd25620fd9de5f44688932e6a05ecf
Opcode Fuzzy Hash: e219eab65aa9523deb68581ba47d0742e2136e811f19fd5566176edd4665fd1f
Instruction Fuzzy Hash: 3851072074824496CF58FBA8D8017FE36E15F26709F28502DB80BF6193DFB04B459E97

Function 031688B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 164registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0316890D
_memset.LIBCMT ref: 0316891C
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,00000000), ref: 0316893F

Part of subcall function 03168AEE: RegCloseKey.ADVAPI32(80000000,03168ACA), ref: 03168AFB
Part of subcall function 03168AEE: RegCloseKey.ADVAPI32(00000000), ref: 03168B04

Strings

%08X, xrefs: 03168AA5

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Close_memset$Open
String ID: %08X
API String ID: 4292648718-3773563069
Opcode ID: fb2967ded2e0fe6c61614edbe168dd5ba0264185ecd34dd03f4014cd23548548
Instruction ID: e9c67af0e55a06f78c76df58a3cfeea801eabec9bd364afe8f4cf72ef582ae2e
Opcode Fuzzy Hash: fb2967ded2e0fe6c61614edbe168dd5ba0264185ecd34dd03f4014cd23548548
Instruction Fuzzy Hash: 655134B1900218ABDB24EF90DC85FEA7778EB4C704F405599F615AB180DB74AB84CFA5

Function 0005A4A1 Relevance: 19.7, APIs: 13, Instructions: 209windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0005A4A8
GetSysColor.USER32(00000014), ref: 0005A4E5

Part of subcall function 0005A45E: __EH_prolog3.LIBCMT ref: 0005A465
Part of subcall function 0005A45E: CreateSolidBrush.GDI32(00000000), ref: 0005A480

GetSysColor.USER32(00000010), ref: 0005A4F6
CreateCompatibleDC.GDI32(00000000), ref: 0005A50C
CreateCompatibleDC.GDI32(00000000), ref: 0005A520
GetObjectW.GDI32(00000004,00000018,?), ref: 0005A53F
CreateBitmap.GDI32(?,?,?,?,00000000), ref: 0005A564
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0005A582

Part of subcall function 0005A2DA: SelectObject.GDI32(?,?), ref: 0005A2E5

GetPixel.GDI32(?,00000000,00000000), ref: 0005A5C7

Part of subcall function 000595F0: SetBkColor.GDI32(?,?), ref: 0005960E
Part of subcall function 000595F0: SetBkColor.GDI32(?,?), ref: 0005961B

BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0005A5F4
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,001100A6), ref: 0005A619
BitBlt.GDI32(?,00000001,00000001,?,?,?,00000000,00000000,00E20746), ref: 0005A679
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00E20746), ref: 0005A698

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Create$Color$BitmapCompatibleH_prolog3Object$BrushPixelSelectSolid
String ID:
API String ID: 758415642-0
Opcode ID: ca8356e53e99bb7f61280df703d3f3c28547ea32c3db659ff08b0aed90729f22
Instruction ID: 6df1b4a8595550e63721aab810b3551a98de034e7add2daa000c85c0885c5da3
Opcode Fuzzy Hash: ca8356e53e99bb7f61280df703d3f3c28547ea32c3db659ff08b0aed90729f22
Instruction Fuzzy Hash: 418111B1D0010DBEDF01AFE4DD819EEBBB9EF08340F148129F915A61A2DB725E59DB60

Function 031639A0 Relevance: 19.7, APIs: 13, Instructions: 169COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(76CB4AAF,00000944,00000000,75BF73E0,00000000,0318326B,000000FF,?,03163BAC,00000000), ref: 031639C8
OpenProcess.KERNEL32(00000400,00000000,00000000,?,03163BAC,00000000), ref: 031639D7
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,03163BAC,00000000), ref: 031639F0
CloseHandle.KERNEL32(00000000,?,03163BAC,00000000), ref: 031639FB
SysStringLen.OLEAUT32(00000000), ref: 03163A4D
SysStringLen.OLEAUT32(00000000), ref: 03163A5B
_memmove.LIBCMT ref: 03163AAB
CloseHandle.KERNEL32(?), ref: 03163ABD
CloseHandle.KERNEL32(?), ref: 03163AC3
InterlockedDecrement.KERNEL32(?), ref: 03163AED
SysFreeString.OLEAUT32(00000000), ref: 03163AFA
InterlockedDecrement.KERNEL32(?), ref: 03163B24
SysFreeString.OLEAUT32(00000000), ref: 03163B31

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: String$CloseHandleProcess$DecrementFreeInterlockedOpen$CurrentToken_memmove
String ID:
API String ID: 3425131211-0
Opcode ID: 8c4ec8b9661fc8fbcb59a5a3c982a1ed2af990d1cb7380624659d03ac19bd646
Instruction ID: a3db4b96cde23b895dbec98c468242fdb320fa1bfaca7ff671558c80f5517700
Opcode Fuzzy Hash: 8c4ec8b9661fc8fbcb59a5a3c982a1ed2af990d1cb7380624659d03ac19bd646
Instruction Fuzzy Hash: 6751C6BAE002169BDB10DFE5DC80A6EB7FCEB0C754F084569E925E7241DB35E950CBA0

Function 000660FA Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 334windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00066104
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 000662D3
_wcspbrk.LIBCMT ref: 0006631C
_wcsrchr.LIBCMT ref: 00066374
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00066448
InvalidateRect.USER32(?,00000000,00000001), ref: 00066463
UpdateWindow.USER32(?), ref: 0006647B
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00066501
InvalidateRect.USER32(?,00000000,00000001), ref: 0006651C
UpdateWindow.USER32(?), ref: 00066534

Strings

:/\, xrefs: 0006630D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$InvalidateRectUpdateWindow$H_prolog3__wcspbrk_wcsrchr
String ID: :/\
API String ID: 2137326823-2793184486
Opcode ID: 41f148f40ce8017fe6992d89544d8089e200c4821a9a3a905065b4e9dcc6a072
Instruction ID: d9ac88bf754f2a5936764e46d7d6ef3e6baa33d9ebeb703e0b54b4566d0035c0
Opcode Fuzzy Hash: 41f148f40ce8017fe6992d89544d8089e200c4821a9a3a905065b4e9dcc6a072
Instruction Fuzzy Hash: 0FD14C719005199FCB24EB64CD99AEEB7B5FF44301F1006D9F65A972A2DB30AE88CF50

Function 00092A7E Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00092A88
_memset.LIBCMT ref: 00092AA8
_memset.LIBCMT ref: 00092ABF

Part of subcall function 00054010: _DebugHeapAllocator.LIBCPMTD ref: 00054065

__wsplitpath_s.LIBCMT ref: 00092B36
_wcslen.LIBCMT ref: 00092B42

Part of subcall function 00064197: __wcsicoll.LIBCMT ref: 000641B2

Strings

royale, xrefs: 00092C6A
homestead, xrefs: 00092C17
normalcolor, xrefs: 00092BFE
metallic, xrefs: 00092C30
Luna, xrefs: 00092B5D
Aero, xrefs: 00092B71

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: _memset$AllocatorDebugH_prolog3_Heap__wcsicoll__wsplitpath_s_wcslen
String ID: Aero$Luna$homestead$metallic$normalcolor$royale
API String ID: 3426151316-2881773410
Opcode ID: bb75f233ffc2f5417b919d04cc9a8ba9fbf8c6579de63c6531e1fc499bd4dadc
Instruction ID: 7c4ed2ffea262c287790b811ed48733e9c1e932fd13a4c00c4bb7917cf3cd383
Opcode Fuzzy Hash: bb75f233ffc2f5417b919d04cc9a8ba9fbf8c6579de63c6531e1fc499bd4dadc
Instruction Fuzzy Hash: 8A51D2B190012CAACF30EA64CC91FEFB7B9AF64310F040595B519A31C2DBB19FD4DAA5

Function 03163520 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03163552
RegOpenKeyExW.ADVAPI32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 03163572
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 031635B4
_memset.LIBCMT ref: 031635F0
_memset.LIBCMT ref: 0316361E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,000009A8,00000000,75BF73E0), ref: 0316364A
lstrlenW.KERNEL32(?,?,?,?,000009A8,00000000,75BF73E0), ref: 03163653
lstrlenW.KERNEL32(?,?,?,?,000009A8,00000000,75BF73E0), ref: 03163665
RegCloseKey.ADVAPI32(?,000009A8,00000000,75BF73E0), ref: 031636B5
lstrlenW.KERNEL32(?), ref: 031636C5

Strings

Software\Tencent\Plugin\VAS, xrefs: 03163568

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: 2328a0a20ff79cbcb9c695e97a8f78cddce59b997f92728ea53ea93e42929d75
Instruction ID: 7c0663478bad3593f688ffc70138564ba47e35387b00eae889dfcce85ce2f58f
Opcode Fuzzy Hash: 2328a0a20ff79cbcb9c695e97a8f78cddce59b997f92728ea53ea93e42929d75
Instruction Fuzzy Hash: 35419BF5A00219ABDB24EB94DC85FEA737CAB4C700F004599F715B7181EB706B858FA8

Function 000E2A14 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000E2A1B
GetObjectW.GDI32(00000018,00000018,00178F40), ref: 000E2A37
_memmove.LIBCMT ref: 000E2A95

Strings

, xrefs: 000E2A81

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3Object_memmove
String ID:
API String ID: 107514201-3916222277
Opcode ID: 2a3b5faf367f66f4e497cbb8fe5cc4594f0d771d1eb879f68f93aa8e4ef8284c
Instruction ID: e01c2a65d280b26796f2d8358c1f09d1856347ef02484890913c86882ce27c4e
Opcode Fuzzy Hash: 2a3b5faf367f66f4e497cbb8fe5cc4594f0d771d1eb879f68f93aa8e4ef8284c
Instruction Fuzzy Hash: 74412572C00159EFCF15EFA5CC818EEBBB9EF54300B148029E916B62A1DB305E44DBA0

Function 000A6AF0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 000A6B19
LoadCursorW.USER32(?,00007904), ref: 000A6B40
LoadCursorW.USER32(?,00007905), ref: 000A6B62
SendMessageW.USER32(?,0000120A,00000000,00000006), ref: 000A6BA9
SendMessageW.USER32(?,0000120A,00000001,00000006), ref: 000A6BCD
SendMessageW.USER32(?,00000401,00000001,00000000), ref: 000A6C07
SendMessageW.USER32(?,00000418,00000000,FFFFFFFF), ref: 000A6C21
GetParent.USER32(?), ref: 000A6C4B

Strings

Value, xrefs: 000A6BAF
d, xrefs: 000A6BB6
Property, xrefs: 000A6B81

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$CursorLoad$EmptyParentRect
String ID: Property$Value$d
API String ID: 2284761715-1409410049
Opcode ID: 70e13a40fcdd8d19b3082df7aff59c17172317566f0cabeb841eb1622c53afb1
Instruction ID: 2ce2f0086d3177e893ad15c716b91ecbdc0694c715350332bd2d42f2a2d5d4be
Opcode Fuzzy Hash: 70e13a40fcdd8d19b3082df7aff59c17172317566f0cabeb841eb1622c53afb1
Instruction Fuzzy Hash: 5C518E70A00604AFD711EFA4CD89EBEB7F9EF89300F140569F556D72A1DBB1A901CB50

Function 03163346 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 125stringregistryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0316335E
wsprintfW.USER32 ref: 031633C6
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 031633EF
_memset.LIBCMT ref: 03163406
RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,?,?,?), ref: 03163442
lstrcatW.KERNEL32(03193360,?), ref: 0316345E
lstrcatW.KERNEL32(03193360,0318785C), ref: 0316346A
RegCloseKey.ADVAPI32(00000000), ref: 03163473
lstrlenW.KERNEL32(03193360,?,76CB4AAF,00000000,000009A8,75BF73E0), ref: 031634B7
lstrcatW.KERNEL32(03193360,03187B94,?,76CB4AAF,00000000,000009A8,75BF73E0), ref: 031634CB

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 031633C0

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}
API String ID: 1671694837-4035668053
Opcode ID: d4b7c6dc983cdf69aa30f24142e0e5544b045a6f2c309a893bb57179b27fd515
Instruction ID: 286c234530cce7a2df108590dfa9622b210b25c083398891a5514bb3aa1ea5ed
Opcode Fuzzy Hash: d4b7c6dc983cdf69aa30f24142e0e5544b045a6f2c309a893bb57179b27fd515
Instruction Fuzzy Hash: CF4190B5A04228AFDB24DB95CC51FEEB7B8AB4C705F0441C9F359A6181DB749B80CF68

Function 000B63CB Relevance: 18.3, APIs: 12, Instructions: 318windowCOMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 000B63EC
IsRectEmpty.USER32(?), ref: 000B6418
IntersectRect.USER32(?,?,?), ref: 000B6497
IntersectRect.USER32(?,?,?), ref: 000B6533
IsRectEmpty.USER32(?), ref: 000B6571
IsRectEmpty.USER32(?), ref: 000B657F
SelectObject.GDI32(?), ref: 000B6595
IsRectEmpty.USER32(?), ref: 000B65AE
IsRectEmpty.USER32(?), ref: 000B65C6
StretchBlt.GDI32(00000000,?,?,?,?,?,?,?,?,00CC0020), ref: 000B666B
SelectObject.GDI32(?), ref: 000B667C
SetRectEmpty.USER32(?), ref: 000B66F7

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$IntersectObjectSelect$Stretch
String ID:
API String ID: 401711590-0
Opcode ID: bc8d02462d819db748b8b8f7118056631ceb8807b1bf89e6924bb0004dd84ef9
Instruction ID: 5a1728fdc244d7698b1d7a3708c6ab5156ad38909895115b4ed89a608ed6e476
Opcode Fuzzy Hash: bc8d02462d819db748b8b8f7118056631ceb8807b1bf89e6924bb0004dd84ef9
Instruction Fuzzy Hash: 2CC1E072A0050AAFCF54CFA8C9849EEBBB9FF48314F154229F815E7215D735E985CBA0

Function 0007C41B Relevance: 18.3, APIs: 12, Instructions: 257timewindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0007C436
GetCursorPos.USER32(?), ref: 0007C455
ScreenToClient.USER32(?,?), ref: 0007C462
GetParent.USER32(?), ref: 0007C505
SetTimer.USER32(?,00000002,FFFFFFFE,00000000), ref: 0007C55E
InvalidateRect.USER32(?,000000AB,00000001), ref: 0007C56D
UpdateWindow.USER32(?), ref: 0007C576
KillTimer.USER32(00000002,00000002,00000000), ref: 0007C583
KillTimer.USER32(?,00000002), ref: 0007C639
GetParent.USER32(?), ref: 0007C654
GetParent.USER32(?), ref: 0007C6AA
SendMessageW.USER32(?,0000011F,00000000,?), ref: 0007C726

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ParentTimer$KillWindow$ClientCursorInvalidateMessageRectScreenSendUpdate
String ID:
API String ID: 2010726786-0
Opcode ID: d2a2a6713f1b3c849fc2deeb7051a41d1811c1982b260e56d36de840ba60ec46
Instruction ID: 77aac1f1e13be870d0c437279929dc254afe16cd0a330cf6d60fbd5215990b7c
Opcode Fuzzy Hash: d2a2a6713f1b3c849fc2deeb7051a41d1811c1982b260e56d36de840ba60ec46
Instruction Fuzzy Hash: B191B071A007019FEB689F60C894FBA77F5FF44311F14846DE84A962A2DB78ED80DB58

Function 000AE9E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 234windowCOMMON

Download Yara Rule

APIs

RealizePalette.GDI32(?), ref: 000AEA28
InflateRect.USER32(?,000000FE,000000FE), ref: 000AEAFF
InflateRect.USER32(?,000000FF,000000FF), ref: 000AEB1B

Part of subcall function 000AE8AB: __EH_prolog3.LIBCMT ref: 000AE8B2
Part of subcall function 000AE8AB: GetSystemPaletteEntries.GDI32(?,00000000,00000100,00000004), ref: 000AE91A
Part of subcall function 000AE8AB: CreatePalette.GDI32(00000000), ref: 000AE965

InflateRect.USER32(?,000000FF,000000FF), ref: 000AEB37
GetNearestPaletteIndex.GDI32(?,000000FF), ref: 000AEB5A
FillRect.USER32(?,?,?), ref: 000AEB80
InflateRect.USER32(?,000000FE,000000FE), ref: 000AEBA7
FillRect.USER32(?,?), ref: 000AEBF9
InflateRect.USER32(?,000000FF,000000FF), ref: 000AEC40

Strings

iii, xrefs: 000AEB1D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Inflate$Palette$Fill$CreateEntriesH_prolog3IndexNearestRealizeSystem
String ID: iii
API String ID: 1028858568-940974255
Opcode ID: 734fbe6d6914cee8e927723e5b8f527f3eeaa649a0b9146d877c26855832c4a9
Instruction ID: 6a417ba82acd833ba4477efd04ca6e72932a50530be17c61b5106338c156fbb8
Opcode Fuzzy Hash: 734fbe6d6914cee8e927723e5b8f527f3eeaa649a0b9146d877c26855832c4a9
Instruction Fuzzy Hash: 87913B71901609AFCF01DFA4CD84ADEB7BAFF49320F204269F925A7291CB75AA45CF50

Function 000A099F Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000A09B4
SendMessageW.USER32(?,0000104B,00000000,?), ref: 000A09D6
SHGetDesktopFolder.SHELL32(?), ref: 000A0A15
CreatePopupMenu.USER32 ref: 000A0A89
GetMenuDefaultItem.USER32(00000000,00000000,00000000), ref: 000A0AB8
GetParent.USER32(?), ref: 000A0AE5
GetParent.USER32(?), ref: 000A0B2A
GetParent.USER32(?), ref: 000A0B39
SendMessageW.USER32(?,?,00000000,00000000), ref: 000A0B4E

Strings

$, xrefs: 000A0ADB

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Parent$MenuMessageSend$CreateDefaultDesktopFolderItemPopup_memset
String ID: $
API String ID: 2190390364-3993045852
Opcode ID: 1a47e5f1eafa26c4f926fae2307116b9cdd04e778ef2f120035441e480f40806
Instruction ID: cdc662a3e840b96f0b42d4e8f44a2c390b358a8c1aba968f328e4454564eaf5d
Opcode Fuzzy Hash: 1a47e5f1eafa26c4f926fae2307116b9cdd04e778ef2f120035441e480f40806
Instruction Fuzzy Hash: 71512770A10218EFCB109FA5CD88EAEBFB9EF49758F144459F909EB250D771D940CBA0

Function 03166C90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 03166CBD
__alloca_probe_16.LIBCMT ref: 03166CEA
_malloc.LIBCMT ref: 03166D01
_free.LIBCMT ref: 03166D33
GdipGetImageEncoders.GDIPLUS(?,?,00000008,80070216), ref: 03166D52
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 03166DC4
GdipDisposeImage.GDIPLUS(00000000), ref: 03166DCF
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 03166DF5
GdipDisposeImage.GDIPLUS(00000000), ref: 03166E0D

Strings

&, xrefs: 03166DA9

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream__alloca_probe_16_free_malloc
String ID: &
API String ID: 728874743-3042966939
Opcode ID: ff719baf6429071487b3de5e82a725588a91a84f5125861d4c44d20a908a8954
Instruction ID: eb508e18d0058ceb327e1e0d0a2c320e511a28fce02143efa78f1d26e713a477
Opcode Fuzzy Hash: ff719baf6429071487b3de5e82a725588a91a84f5125861d4c44d20a908a8954
Instruction Fuzzy Hash: 50515176A00219AFDB04EFE4DC449EEB7B8EF4C310F048519E905BB245EB34A965CBE0

Function 03163820 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03162220: InterlockedDecrement.KERNEL32(?), ref: 0316226C
Part of subcall function 03162220: SysFreeString.OLEAUT32(00000000), ref: 03162281
Part of subcall function 03162220: SysAllocString.OLEAUT32(031878F0), ref: 031622D2

GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,?,?,00000944,00000000), ref: 0316388B
GetLastError.KERNEL32 ref: 03163891
GetProcessHeap.KERNEL32(00000008,?), ref: 031638A9
HeapAlloc.KERNEL32(00000000), ref: 031638B0
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 031638D2
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 03163900
GetLastError.KERNEL32 ref: 0316390A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03163979
HeapFree.KERNEL32(00000000), ref: 03163980

Strings

NONE_MAPPED, xrefs: 03163917

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: 84248ef676f74eaf5f2308a7f6a664ccfcbe55a8469849bdd802650869409b61
Instruction ID: 0ee94ab7d8e8f1f586180c8b39c12c28cb5a75cde3b2295d22234bcd146dfdd1
Opcode Fuzzy Hash: 84248ef676f74eaf5f2308a7f6a664ccfcbe55a8469849bdd802650869409b61
Instruction Fuzzy Hash: 524194B5A00209ABDB24EB95DC84FEAB378EB8D700F048599E719A7140DF719EC58F64

Function 03168B30 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,AppEvents,00000000,00000002,?), ref: 03168B59
RegDeleteValueW.ADVAPI32(?), ref: 03168B64
RegCloseKey.ADVAPI32(?), ref: 03168B74
RegCreateKeyW.ADVAPI32(80000001,AppEvents,?), ref: 03168B93
lstrlenW.KERNEL32(?), ref: 03168BA1
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 03168BB4
RegCloseKey.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 03168BC2
RegCloseKey.ADVAPI32(?), ref: 03168BD0

Strings

Network, xrefs: 03168B46, 03168B84
AppEvents, xrefs: 03168B3F, 03168B53, 03168B7D, 03168B8D

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Close$Value$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3935456190-3733486940
Opcode ID: f0f89062b195d00d7d54664abdc8111e2119194013c5c88dc7c597f3e3df8f68
Instruction ID: e042206640ea078ac81eb784c89010ab6e32be2651c7bd8f2cac811329e0f4e2
Opcode Fuzzy Hash: f0f89062b195d00d7d54664abdc8111e2119194013c5c88dc7c597f3e3df8f68
Instruction Fuzzy Hash: B3116075600108BBD714EBA5DC49FABB76CEB4D311F104148FA0196140DB719E109BB8

Function 000D2990 Relevance: 16.9, APIs: 11, Instructions: 410windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 000D2A92
GetCursorPos.USER32(?), ref: 000D2AC1
GetParent.USER32(?), ref: 000D2B29
ReleaseCapture.USER32 ref: 000D2C6D
GetParent.USER32(?), ref: 000D2C7E
SendMessageW.USER32(?,00000363,00000000,00000000), ref: 000D2C94
GetWindowRect.USER32(?,?), ref: 000D2CD9
GetParent.USER32(?), ref: 000D2DB6
InvalidateRect.USER32(?,00000000,00000001,00000000), ref: 000D2DC5
GetParent.USER32(?), ref: 000D2DCE
UpdateWindow.USER32(?), ref: 000D2DD9

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Parent$Rect$Window$CaptureCursorEmptyInvalidateMessageReleaseSendUpdate
String ID:
API String ID: 2800639987-0
Opcode ID: dd78bb5ed85ed8fe7405a493b19f1565a9465f26e8ba1629a9e62cf36dadb69b
Instruction ID: ee3a1528911501705f1d67a4dc5610f00d57b1d9880726e617ce1b7a41a90223
Opcode Fuzzy Hash: dd78bb5ed85ed8fe7405a493b19f1565a9465f26e8ba1629a9e62cf36dadb69b
Instruction Fuzzy Hash: F5E13931A00215AFCB15DFA4C898EAEBBF9FF58711F14046AF946DB392DB709940CB61

Function 000A81C1 Relevance: 16.9, APIs: 11, Instructions: 392COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000A81C8
IsRectEmpty.USER32(?), ref: 000A81DF
FillRect.USER32(?,?,?), ref: 000A82A8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyFillH_prolog3_
String ID:
API String ID: 3863378599-0
Opcode ID: 81ff42dcaa014c7864db9b833d94839e68d903dc4a314ca354a96808854d0869
Instruction ID: 7c8dbc8437f982c511d25efeda65f407280222a04b59cc1592e57f23401843d9
Opcode Fuzzy Hash: 81ff42dcaa014c7864db9b833d94839e68d903dc4a314ca354a96808854d0869
Instruction Fuzzy Hash: 5AF13A3190061ADFCF55DFE4C884AEEB7B6BF0A301F148169E905BB251DB71AA45CF90

Function 000A863C Relevance: 16.7, APIs: 11, Instructions: 223windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000A8643
ClientToScreen.USER32(?,?), ref: 000A867A
GetWindowRect.USER32(?,?), ref: 000A8696
PtInRect.USER32(?,?,?), ref: 000A86A6
IsWindowVisible.USER32(?), ref: 000A86BC
IsWindowVisible.USER32(?), ref: 000A86CC
SetRectEmpty.USER32(?), ref: 000A86D6
GetCapture.USER32 ref: 000A86DF
ReleaseCapture.USER32 ref: 000A86E9
SendMessageW.USER32(?,00000030,?,00000001), ref: 000A88DB
SetCapture.USER32(?), ref: 000A88FF

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CaptureRectWindow$Visible$ClientEmptyH_prolog3_MessageReleaseScreenSend
String ID:
API String ID: 865670441-0
Opcode ID: 8fc0f31f129ce058ed44d28132cc21fa4c59ef6399b07da706dd6bbebbf718d7
Instruction ID: 46e67d132f9ebc72a0ae068f06e3e38665f4a062b137b0fd2f1f47a5ba74d695
Opcode Fuzzy Hash: 8fc0f31f129ce058ed44d28132cc21fa4c59ef6399b07da706dd6bbebbf718d7
Instruction Fuzzy Hash: 1A914871800608DFCF66DFA4D888AEDBBF4FF45300F14816AE845AB266DF749985CB61

Function 0012A0B0 Relevance: 16.7, APIs: 11, Instructions: 168windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,00000000), ref: 0012A0FE
SetRectEmpty.USER32(?), ref: 0012A114
IsRectEmpty.USER32(?), ref: 0012A125
InvalidateRect.USER32(?,00000000,00000001), ref: 0012A242
UpdateWindow.USER32(?), ref: 0012A24B
GetParent.USER32(?), ref: 0012A254
SendMessageW.USER32(?,00000111,?,?), ref: 0012A27D

Part of subcall function 00129DF3: OffsetRect.USER32(?,00000000,?), ref: 00129E2D
Part of subcall function 00129DF3: InflateRect.USER32(?,00000002,00000002), ref: 00129E3B
Part of subcall function 00129DF3: InvalidateRect.USER32(?,?,00000001,?,?,?,0012A0D9,?), ref: 00129E4A
Part of subcall function 00129DF3: UpdateWindow.USER32(?), ref: 00129E53

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyInvalidateUpdateWindow$ClientInflateMessageOffsetParentSend
String ID:
API String ID: 53779109-0
Opcode ID: 43ade7fc9397e14b44eeed7a922b1864848ce6bd97ebff9f9936c5f295c77979
Instruction ID: b894b776f77e3595aefcb24ab2b6977eddfac4d7ad962719fe21caf02834afdd
Opcode Fuzzy Hash: 43ade7fc9397e14b44eeed7a922b1864848ce6bd97ebff9f9936c5f295c77979
Instruction Fuzzy Hash: 6D516C71A00228DFCF15DFA4DC849EEBBBAFF58700F50016AE906EB251D7B19951CBA1

Function 00058A7B Relevance: 16.6, APIs: 11, Instructions: 149windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00058A85
GetMenuItemCount.USER32(?), ref: 00058AB7
GetSubMenu.USER32(?,?), ref: 00058AFB
GetMenuState.USER32(?,?,00000400), ref: 00058B14
GetSubMenu.USER32(?,?), ref: 00058B83
GetMenuStringW.USER32(?,?,?,00000100,00000400), ref: 00058BA8
_wcslen.LIBCMT ref: 00058BFF
AppendMenuW.USER32(00000000,00000010,00000000,?), ref: 00058C2D
GetMenuItemCount.USER32(00000000), ref: 00058C6C
GetMenuItemID.USER32(?,?), ref: 00058CA5
InsertMenuW.USER32(?,?,00000000,00000000), ref: 00058CBB

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$AppendH_prolog3_InsertStateString_wcslen
String ID:
API String ID: 881407318-0
Opcode ID: 9dfd5b720318bb51a822a407f0c35aa7a181bbd13af62841b31017ea02f40a5e
Instruction ID: a3cdfceb5c39c7aa7f1223ce32f68fe4306b84457bfd935e8fd6d84704f245ac
Opcode Fuzzy Hash: 9dfd5b720318bb51a822a407f0c35aa7a181bbd13af62841b31017ea02f40a5e
Instruction Fuzzy Hash: 1E71D37184122DAFDB609F54DC89BEEBBB4FB18311F1041E9E909A6261DB709EC4CF50

Function 000583B9 Relevance: 16.6, APIs: 11, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 000583C0
FindResourceW.KERNEL32(?,?,00000005,00000024,000BE5BC,?,?,?), ref: 000583F6
LoadResource.KERNEL32(?,00000000,?,?), ref: 000583FE

Part of subcall function 0005EE40: UnhookWindowsHookEx.USER32(?), ref: 0005EE70

LockResource.KERNEL32(?,00000024,000BE5BC,?,?,?), ref: 0005840F
GetDesktopWindow.USER32 ref: 00058442
IsWindowEnabled.USER32(?), ref: 00058450
EnableWindow.USER32(?,00000000), ref: 0005845F

Part of subcall function 00062946: IsWindowEnabled.USER32(?), ref: 0006294F

Part of subcall function 00062961: EnableWindow.USER32(?,?), ref: 00062972

EnableWindow.USER32(?,00000001), ref: 00058544
GetActiveWindow.USER32 ref: 0005854F
SetActiveWindow.USER32(?,?,00000024,000BE5BC,?,?,?), ref: 0005855D
FreeResource.KERNEL32(?,?,00000024,000BE5BC,?,?,?), ref: 00058579

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 733075baf3ac0a081ec587ba139a3a7d0fc3cebda7f9df4e37aa36bc6932149f
Instruction ID: 347d0dfbc4ad37a9faf5f9f244010e528c2278868e57256574c073b7109c0158
Opcode Fuzzy Hash: 733075baf3ac0a081ec587ba139a3a7d0fc3cebda7f9df4e37aa36bc6932149f
Instruction Fuzzy Hash: B5514F30A00A05CFDB61AFA5CC496BFBAF2BF44712F148029ED42B62A2DB754A45CF55

Function 000A6661 Relevance: 16.6, APIs: 11, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 000A669D
ReleaseCapture.USER32 ref: 000A66A7
GetClientRect.USER32(?,?), ref: 000A66C0
GetSystemMetrics.USER32(00000015), ref: 000A66E7
GetSystemMetrics.USER32(00000015), ref: 000A670B
SendMessageW.USER32(?,0000120C,00000000,00000001), ref: 000A6744
SendMessageW.USER32(?,0000120C,00000001,00000001), ref: 000A6766
GetCapture.USER32 ref: 000A678B
ReleaseCapture.USER32 ref: 000A6795
GetClientRect.USER32(?,?), ref: 000A67AE
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 000A67FC

Part of subcall function 000A59C1: __EH_prolog3_GS.LIBCMT ref: 000A59C8
Part of subcall function 000A59C1: IsRectEmpty.USER32(?), ref: 000A59E3
Part of subcall function 000A59C1: InvertRect.USER32(?,?), ref: 000A59F9
Part of subcall function 000A59C1: SetRectEmpty.USER32(?), ref: 000A5A07

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Capture$ClientEmptyMessageMetricsReleaseSendSystem$H_prolog3_InvertRedrawWindow
String ID:
API String ID: 174338775-0
Opcode ID: 9aa1a7eca33080a75a95d823141f1934aa3bf0fb38b5ad6cfb182a516c52df29
Instruction ID: a33118ca1cef40f22ffb960d05f439b9a959b2198234c8120bb2c8ded17887f1
Opcode Fuzzy Hash: 9aa1a7eca33080a75a95d823141f1934aa3bf0fb38b5ad6cfb182a516c52df29
Instruction Fuzzy Hash: C4512771A00609DFCB11DFA8CD849AEBBB6FF48305F25452DE49AA7251DB71AA408B90

Function 031672F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

%s_bin, xrefs: 031673E5

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID:
String ID: %s_bin
API String ID: 0-2665034546
Opcode ID: a429069f74d13d445f75647d44cca4baa0e0552c680b7eacca975e64ce7ce055
Instruction ID: f3185a5f53f78d958b5f8022265c5cf6a326642968f6c56e39d531c91994c2a7
Opcode Fuzzy Hash: a429069f74d13d445f75647d44cca4baa0e0552c680b7eacca975e64ce7ce055
Instruction Fuzzy Hash: D98122B5A00301ABE714EF64DC45B6A73A5EF9C728F0C4569E8598B2C1E771E910CBA2

Function 000823F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000823F7

Part of subcall function 000627C8: GetWindowLongW.USER32(?,000000F0), ref: 000627D3

swprintf.LIBCMT ref: 00082441
_wcslen.LIBCMT ref: 0008244A

Part of subcall function 000550CC: _wcsnlen.LIBCMT ref: 00055100
Part of subcall function 000550CC: _wmemcpy_s.LIBCPMTD ref: 00055134

_wcslen.LIBCMT ref: 00082465
_wcslen.LIBCMT ref: 0008249C
swprintf.LIBCMT ref: 000824C8
_wcslen.LIBCMT ref: 000824D1

Part of subcall function 0005538E: _wcslen.LIBCMT ref: 000553A0

Strings

- , xrefs: 0008245F, 00082464, 0008246C, 00082496, 0008249B, 000824A3
:%d, xrefs: 00082436, 000824BD

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: _wcslen$swprintf$H_prolog3_LongWindow_wcsnlen_wmemcpy_s
String ID: - $:%d
API String ID: 472068148-2359489159
Opcode ID: 67aa3b57ca44717215d233501e6a2b4903d00d8ed0aeb35b921809c519532c12
Instruction ID: 36a3768695e4f9e1180c227ee7cda4b7f49ad519f4152edf67b36676411f8686
Opcode Fuzzy Hash: 67aa3b57ca44717215d233501e6a2b4903d00d8ed0aeb35b921809c519532c12
Instruction Fuzzy Hash: 37313EB2900505ABD715FBE0CD96EEFB3ACBF14355F044425B902AB196EF64AE0887A0

Function 03168BE0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 03168BED
_memmove.LIBCMT ref: 03168C1F
_wcsrchr.LIBCMT ref: 03168C27

Part of subcall function 03164B80: LoadLibraryW.KERNEL32(wininet.dll), ref: 03164BC3
Part of subcall function 03164B80: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 03164BD7
Part of subcall function 03164B80: FreeLibrary.KERNEL32(00000000), ref: 03164BF7

GetFileAttributesW.KERNEL32(-00000002), ref: 03168C46
GetLastError.KERNEL32 ref: 03168C51
_memset.LIBCMT ref: 03168C64
CreateProcessW.KERNEL32(00000000,-00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 03168C91

Strings

WinSta0\Default, xrefs: 03168C8A
D, xrefs: 03168C83

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Library$AddressAttributesCreateErrorFileFreeLastLoadProcProcess_memmove_memset_wcsrchrlstrlen
String ID: D$WinSta0\Default
API String ID: 4287160851-1101385590
Opcode ID: 0782a251e54c566ce065f11ec316da69e11de3f7712885c1749af8a9acc7152d
Instruction ID: 99571738974722e56d70457f264de4cc6d9432be497e00755edb1d4a6c325516
Opcode Fuzzy Hash: 0782a251e54c566ce065f11ec316da69e11de3f7712885c1749af8a9acc7152d
Instruction Fuzzy Hash: BD1138B790120467D320E7E1AC45BFFB7BDAB5D710F080129FD06DA280EB25981182F5

Function 0316A8E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0316A901
GetForegroundWindow.USER32(?,74DEE010,74DF23A0), ref: 0316A909
GetWindowTextW.USER32(00000000,03192B48,00000800), ref: 0316A91F
_memset.LIBCMT ref: 0316A93D
lstrlenW.KERNEL32(03192B48,?,?,?,?,74DEE010,74DF23A0), ref: 0316A95C
GetLocalTime.KERNEL32(?,?,?,?,?,74DEE010,74DF23A0), ref: 0316A96D
wsprintfW.USER32 ref: 0316A9B4

Part of subcall function 0316A860: WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?,0316A9C5,?,?,?,?,74DEE010,74DF23A0), ref: 0316A86D
Part of subcall function 0316A860: CreateFileW.KERNEL32(031921E8,40000000,00000002,00000000,00000004,00000080,00000000,?,?,0316A9C5,?,?,?,?,74DEE010,74DF23A0), ref: 0316A88A
Part of subcall function 0316A860: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0316A8A0
Part of subcall function 0316A860: lstrlenW.KERNEL32(?,00000000,00000000), ref: 0316A8AD
Part of subcall function 0316A860: WriteFile.KERNEL32(00000000,?,00000000), ref: 0316A8B8
Part of subcall function 0316A860: CloseHandle.KERNEL32(00000000), ref: 0316A8BF
Part of subcall function 0316A860: ReleaseMutex.KERNEL32(?), ref: 0316A8CC

_memset.LIBCMT ref: 0316A9D0

Strings

[, xrefs: 0316A9AE

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: File_memset$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 2192163267-4056885943
Opcode ID: c86a8a54d648cfcc7f2877abb1a8cb29bf4a7b0b11e7b9df34652551e7a7a8b6
Instruction ID: 86e7f6780f2ce55b82100830b544460911fe877e1ba1510311c0f78b3936061e
Opcode Fuzzy Hash: c86a8a54d648cfcc7f2877abb1a8cb29bf4a7b0b11e7b9df34652551e7a7a8b6
Instruction Fuzzy Hash: 1C21D675A0022CBBD768EF559C41BAAB3F8FF0CB01F008496B885A6150EF7059D68BE4

Function 000D80E2 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51sleepthreadCOMMON

Download Yara Rule

APIs

PlaySoundW.WINMM(MenuCommand,00000000,00012002), ref: 000D8112
Sleep.KERNEL32(00000005), ref: 000D811C
PlaySoundW.WINMM(00000000,00000000,00000040), ref: 000D8131
__getptd_noexit.LIBCMT ref: 0014CDE4
CloseHandle.KERNEL32(?), ref: 0014CDF8
__freeptd.LIBCMT ref: 0014CDFF
ExitThread.KERNEL32 ref: 0014CE07

Strings

MenuPopup, xrefs: 000D8104
MenuCommand, xrefs: 000D810D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: PlaySound$CloseExitHandleSleepThread__freeptd__getptd_noexit
String ID: MenuCommand$MenuPopup
API String ID: 3964878549-2036262055
Opcode ID: 5de9a24df0635643aaaf3c82c426e85ba853bae9e89ef924ea2b9c6eb114cf44
Instruction ID: 127b5ad9fc3793cd2b1ac164897780bc6e45c6cc7f0843be35d359ab80b5f096
Opcode Fuzzy Hash: 5de9a24df0635643aaaf3c82c426e85ba853bae9e89ef924ea2b9c6eb114cf44
Instruction Fuzzy Hash: 8C0126316016147BD1605BB89C8AE3B2A9DEB49B70B108306F224D36F0CFA08CC2CBF0

Function 0008677B Relevance: 15.1, APIs: 10, Instructions: 111windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00086782

Part of subcall function 000846C9: GetObjectW.GDI32(?,00000054,?), ref: 000846E8

Part of subcall function 00059FE9: __EH_prolog3.LIBCMT ref: 00059FF0
Part of subcall function 00059FE9: GetDC.USER32(00000000), ref: 0005A01C

CreateCompatibleDC.GDI32(?), ref: 000867D2
SelectObject.GDI32(?,?), ref: 000867ED
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000074), ref: 0008681C
GdipDisposeImage.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000074), ref: 0008682F
GdipCreateFromHDC.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 0008683E
GdipSetInterpolationMode.GDIPLUS(?,00000007,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0008684F
GdipDeleteGraphics.GDIPLUS(?,?,00000007,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00086889
GdipDisposeImage.GDIPLUS(?,?,?,00000007,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00086891
SelectObject.GDI32(?,?), ref: 000868A1

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Gdip$CreateObject$DisposeFromH_prolog3ImageSelect$BitmapCompatibleDeleteGraphicsInterpolationMode
String ID:
API String ID: 3579439469-0
Opcode ID: 5aa87b19616171ba38e279638f5f160ea041c7f091c77c90be7f522d27b9bf2b
Instruction ID: 4499d20280d5f11231edaa2e2f74f548bd94c12a0197e9f5f30ad72d7187e71a
Opcode Fuzzy Hash: 5aa87b19616171ba38e279638f5f160ea041c7f091c77c90be7f522d27b9bf2b
Instruction Fuzzy Hash: C3414775C00219EFCF14EFA4C9819EEBBB4BF18300F15452AF946B7252DB719A48CBA1

Function 03167DF0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

_memset.LIBCMT ref: 03167E11
GetLastInputInfo.USER32(?), ref: 03167E26
GetTickCount.KERNEL32 ref: 03167E2C
wsprintfW.USER32 ref: 03167E55
GetForegroundWindow.USER32 ref: 03167E5E
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 03167E72
_memmove.LIBCMT ref: 03167EF0

Strings

%d min, xrefs: 03167E4F

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memmove_memsetwsprintf
String ID: %d min
API String ID: 2941202404-1947832151
Opcode ID: c0c3d57ebc8e342aa378e234d8de9bcbc67f11d91250a501bbdd9600230e4540
Instruction ID: 722fe58478efb4cbf10442224a12392dffc7794b6d2be0c2fd2626ad2526f6e6
Opcode Fuzzy Hash: c0c3d57ebc8e342aa378e234d8de9bcbc67f11d91250a501bbdd9600230e4540
Instruction Fuzzy Hash: 7731C6B9940209AFD714EFA4D885DAFBBB9EF5C304F044529E9159B340EB30A954CBE1

Function 03168540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0316857D
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0316859B
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 031685D8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 031685E3
lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 031685F0
wsprintfW.USER32 ref: 03168614

Strings

%s %s, xrefs: 0316860E

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: File$CloseCreateHandleWrite_memsetlstrlenwsprintf
String ID: %s %s
API String ID: 1326869720-2939940506
Opcode ID: bb9f7dbea9b4eeb572b4b65ad6c6781a491746ad86ef5f0833483d94e46a7a87
Instruction ID: 676b916cf226eee6a148fb00d5c1f8750b59ff2ec8ec63aec642b7da6db9d40e
Opcode Fuzzy Hash: bb9f7dbea9b4eeb572b4b65ad6c6781a491746ad86ef5f0833483d94e46a7a87
Instruction Fuzzy Hash: 3731D5726002196FDB24EBA4EC85FEB737DEB4C711F404199B605AA180EF706A84CFA5

Function 0006097D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 000609CB
SetActiveWindow.USER32(?), ref: 000609DD
SendMessageW.USER32(?,00000112,?,?), ref: 000609F3
IsWindow.USER32(?), ref: 00060A00
SetActiveWindow.USER32(?), ref: 00060A07
IsWindow.USER32(?), ref: 00060A0C
SetFocus.USER32(?), ref: 00060A16

Strings

u, xrefs: 00060A1E

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$ActiveFocus$MessageSend
String ID: u
API String ID: 1556911595-4067256894
Opcode ID: b45892c602821c644cc2a78bbbb431342dbb29b293d2322457a33c567fcfeaa0
Instruction ID: 6874190a033e925f696ffda7b0ef2841bb4919545fbbca6cd8498400f3ab8e06
Opcode Fuzzy Hash: b45892c602821c644cc2a78bbbb431342dbb29b293d2322457a33c567fcfeaa0
Instruction Fuzzy Hash: 56110432540309ABDB78ABF9CD18A7F7BE7EF44390F044025E982D25A2DB74DD40DAA1

Function 0012CBA9 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0012CBB0

Part of subcall function 0006872C: EnterCriticalSection.KERNEL32(001E0170,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068766
Part of subcall function 0006872C: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068778
Part of subcall function 0006872C: LeaveCriticalSection.KERNEL32(001E0170,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068785
Part of subcall function 0006872C: EnterCriticalSection.KERNEL32(?,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068795

GetProfileIntW.KERNEL32(windows,DragScrollInset,0000000B), ref: 0012CC00
GetProfileIntW.KERNEL32(windows,DragScrollDelay,00000032), ref: 0012CC0F
GetProfileIntW.KERNEL32(windows,DragScrollInterval,00000032), ref: 0012CC1E

Strings

DragScrollDelay, xrefs: 0012CC04
windows, xrefs: 0012CBFA, 0012CBFF, 0012CC09, 0012CC18
DragScrollInterval, xrefs: 0012CC13
DragScrollInset, xrefs: 0012CBF5

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CriticalSection$Profile$Enter$H_prolog3InitializeLeave
String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$windows
API String ID: 4229786687-1024936294
Opcode ID: 0e428a3b0e910e84ad1e4c644179443c77d95b1695ccd9cf3e62627d61b863a4
Instruction ID: ad8cd319fcc616064c8ff0dd69b6408c2a6fbcf2057a7c59721f42884d4a5ecb
Opcode Fuzzy Hash: 0e428a3b0e910e84ad1e4c644179443c77d95b1695ccd9cf3e62627d61b863a4
Instruction Fuzzy Hash: 8B01F7F06403549BD730FFA98C8270DB6E9BF54700F80060BF248AB6A1CBF545408F45

Function 0009A815 Relevance: 13.8, APIs: 9, Instructions: 286keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 0009A833
GetWindowRect.USER32(?,?), ref: 0009A89B
GetCursorPos.USER32(?), ref: 0009A8E5

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CursorRectStateWindow
String ID:
API String ID: 3412758350-0
Opcode ID: 4549fb95e98dd6946bb807b7a8399d758f8ee2011b5951054c893fdbb9db4b15
Instruction ID: 860eb8c51aa554ee82d4eddd3538c1ad2b473a6e075f605c270022cd41802762
Opcode Fuzzy Hash: 4549fb95e98dd6946bb807b7a8399d758f8ee2011b5951054c893fdbb9db4b15
Instruction Fuzzy Hash: 6FB10870A00205AFCF64DFA8D9849EEBBF6FF4A315F24446EE546A7251DB309880DF52

Function 000868D0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000868DA
GetWindowRect.USER32(?,?), ref: 00086929
OffsetRect.USER32(?,?,?), ref: 0008693F

Part of subcall function 00059FE9: __EH_prolog3.LIBCMT ref: 00059FF0
Part of subcall function 00059FE9: GetDC.USER32(00000000), ref: 0005A01C

CreateCompatibleDC.GDI32(?), ref: 000869B0
SelectObject.GDI32(?,?), ref: 000869D0
SelectObject.GDI32(?,?), ref: 00086A12
CreateCompatibleDC.GDI32(?), ref: 00086B2B
SelectObject.GDI32(?,?), ref: 00086B4B
SelectObject.GDI32(?,00000000), ref: 00086B7B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ObjectSelect$CompatibleCreateRect$H_prolog3H_prolog3_OffsetWindow
String ID:
API String ID: 2818906880-0
Opcode ID: 842d71a4b97cfc1f5453f96b613d438d380ae83386c0f707858891d793322167
Instruction ID: 5e7186e6db9407582df4b5058cbb5934ea46b84f4a0643bb769fe3e082909087
Opcode Fuzzy Hash: 842d71a4b97cfc1f5453f96b613d438d380ae83386c0f707858891d793322167
Instruction Fuzzy Hash: 52A10371D0021AEFCF15EFA4C985AEEBBB5BF08300F1141AAE949B7251DB315A45CFA1

Function 031709B0 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,76CB4AAF), ref: 031709E6
EnterCriticalSection.KERNEL32(?,76CB4AAF), ref: 03170A0D
SetLastError.KERNEL32(0000139F), ref: 03170A21
LeaveCriticalSection.KERNEL32(?), ref: 03170A28

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: b03a438fddfec1cc619e1510dd07fc779d7c9cde0105abe277edd85659354b65
Instruction ID: 0cda85d78bfd17cdebcaaa1eefd219103282b1ea71e17fdf6cfd71ebfcfb186f
Opcode Fuzzy Hash: b03a438fddfec1cc619e1510dd07fc779d7c9cde0105abe277edd85659354b65
Instruction Fuzzy Hash: 3451BD76A043019FD714EFA9D845B6AFBF4FB4C701F084A6EE50AD7780EB34A5048BA0

Function 0005AAA9 Relevance: 13.7, APIs: 9, Instructions: 158windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0005AAD7

Part of subcall function 00078BDB: GetClientRect.USER32(?,?), ref: 00078C0C
Part of subcall function 00078BDB: PtInRect.USER32(?,?,?), ref: 00078C26

ScreenToClient.USER32(?,?), ref: 0005AB49
PtInRect.USER32(?,?,?), ref: 0005AB59
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0005AB85
GetParent.USER32(?), ref: 0005ABA4
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0005AC0D
GetFocus.USER32 ref: 0005AC13
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0005AC50
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0005AC74

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Rect$Client$FocusParentScreenWindow
String ID:
API String ID: 4216724418-0
Opcode ID: 9816fbf836cf87175a5bfc9540bcb898bbba6f472f86575c0a622b0ae414a112
Instruction ID: 11f8c0383e00782665b65a4f7650a7f1586171d887a303f224565471f9fe60c2
Opcode Fuzzy Hash: 9816fbf836cf87175a5bfc9540bcb898bbba6f472f86575c0a622b0ae414a112
Instruction Fuzzy Hash: 4551A131700204AFDB21DFA4CD85AAE7BF9EB0A311B104666FD45DB261EB70ED84CB95

Function 0008042D Relevance: 13.6, APIs: 9, Instructions: 150windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00063661: GetFocus.USER32 ref: 00063667
Part of subcall function 00063661: GetParent.USER32(00000000), ref: 0006368F
Part of subcall function 00063661: GetWindowLongW.USER32(?,000000F0), ref: 000636AA
Part of subcall function 00063661: GetParent.USER32(?), ref: 000636B8
Part of subcall function 00063661: GetDesktopWindow.USER32 ref: 000636BC
Part of subcall function 00063661: SendMessageW.USER32(00000000,0000014F,00000000,00000000), ref: 000636D0

GetMenu.USER32(?), ref: 000804A7
GetMenuItemCount.USER32(?), ref: 000804D7
GetSubMenu.USER32(?,00000000), ref: 000804E8
GetMenuItemCount.USER32(?), ref: 0008050A
GetMenuItemID.USER32(?,00000000), ref: 0008052B
GetSubMenu.USER32(?,00000000), ref: 00080543
GetMenuItemID.USER32(?,00000000), ref: 0008055B
GetMenuItemCount.USER32(?), ref: 00080592
GetMenuItemID.USER32(?,00000000), ref: 000805AD

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$ParentWindow$DesktopFocusLongMessageSend
String ID:
API String ID: 4186786570-0
Opcode ID: ec5614fb52870ab47ebab0eed033a83140dd6a3204278033a2e7fc4d85958e94
Instruction ID: 2c44e08f5c02239c3be9a83f02093cf7eff85a320f28e9763940b7932e93b4f5
Opcode Fuzzy Hash: ec5614fb52870ab47ebab0eed033a83140dd6a3204278033a2e7fc4d85958e94
Instruction Fuzzy Hash: DE518E30A00A09DFCB91AFA4C984AAFBBF1FF48710F204565E896A6152D731ED48DF20

Function 000A4552 Relevance: 13.6, APIs: 9, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000A4559
_memset.LIBCMT ref: 000A4579
SendMessageW.USER32 ref: 000A45A1
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 000A45C1
SHGetDesktopFolder.SHELL32(?), ref: 000A45E9
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 000A4612
SendMessageW.USER32(?,00001115,00000000,?), ref: 000A4649
SendMessageW.USER32(000A3AD4,0000000B,00000001,00000000), ref: 000A4653
RedrawWindow.USER32(000A3AD4,00000000,00000000,00000105), ref: 000A465F

Part of subcall function 00061C89: __EH_prolog3_catch_GS.LIBCMT ref: 00061C93

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$DesktopFolderH_prolog3H_prolog3_catch_RedrawWindow_memset
String ID:
API String ID: 3540180273-0
Opcode ID: 543ad6c5085aaa23976dc782edb7a4d680c43f723c326348a6bce9b0ff0e05f0
Instruction ID: b79121d9979eafebc08ba65d0b3875a65bd855e0415abd33e98ad475d0ae88b2
Opcode Fuzzy Hash: 543ad6c5085aaa23976dc782edb7a4d680c43f723c326348a6bce9b0ff0e05f0
Instruction Fuzzy Hash: BB414FB4900209AFDB10DFA0CC85DEEBBB9FF49354F104528F556A62A1E7719D45CF50

Function 03170470 Relevance: 13.6, APIs: 9, Instructions: 96COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?,?,?,?,?,?,?,031830C0,000000FF), ref: 031704A5
TryEnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,031830C0,000000FF), ref: 031704CE
TryEnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,031830C0,000000FF), ref: 031704E5
SetLastError.KERNEL32(0000139F,?,?,?,?,?,?,?,031830C0,000000FF), ref: 03170503
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,031830C0,000000FF), ref: 0317050C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,031830C0,000000FF), ref: 03170512

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: f242d2750e1f97c477e3e2353498c5d90b3ec4cab4708536dc08b30147bd08e4
Instruction ID: 2e28b603b00760ded145334c21241551e96f9d5b74d02a6bbfcc86d23eb774d4
Opcode Fuzzy Hash: f242d2750e1f97c477e3e2353498c5d90b3ec4cab4708536dc08b30147bd08e4
Instruction Fuzzy Hash: 4D31C4B6A043049FD714DBAAE841BAFF7F8FB5C710F04452AE905D3640EB76A500CBA5

Function 000B0627 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000B062E

Part of subcall function 00060693: GetWindowTextLengthW.USER32(?), ref: 000606A4
Part of subcall function 00060693: GetWindowTextW.USER32(?,00000000,00000001), ref: 000606BB

InflateRect.USER32(?,?,?), ref: 000B074B
SetRectEmpty.USER32(?), ref: 000B0757
InflateRect.USER32(?,00000000,00000000), ref: 000B07E8
OffsetRect.USER32(?,00000001,00000001), ref: 000B0875
IsRectEmpty.USER32(?), ref: 000B0902

Strings

mmm, xrefs: 000B0896

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyInflateTextWindow$H_prolog3_LengthOffset
String ID: mmm
API String ID: 2648887860-1545505134
Opcode ID: 6945d0439d587121129f853f3c440803fab1020235217501272a1e5049918a95
Instruction ID: f294f918f7e8811ad752bec64db58effe3c67ea436b2e02493106f081602b32b
Opcode Fuzzy Hash: 6945d0439d587121129f853f3c440803fab1020235217501272a1e5049918a95
Instruction Fuzzy Hash: 55E13C71900609DFCF55CFA8C894AEEBBB5FF48300F184679E806AB156DB70A945CF60

Function 0316D4D0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 308COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0316D706

Part of subcall function 0316CAF0: __vswprintf.LIBCMT ref: 0316CB2A

_malloc.LIBCMT ref: 0316D6C0

Part of subcall function 03171DDE: __FF_MSGBANNER.LIBCMT ref: 03171DF7
Part of subcall function 03171DDE: __NMSG_WRITE.LIBCMT ref: 03171DFE
Part of subcall function 03171DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171E23

Strings

[RI] %d bytes, xrefs: 0316D4FE
input wins: %lu, xrefs: 0316D75F
input probe, xrefs: 0316D732
input psh: sn=%lu ts=%lu, xrefs: 0316D673
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 0316D63E

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc_memmove
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 1438150933-868042568
Opcode ID: 71b59d75833e04490e9228352db24290768b96e07ffcf5a6406e02a7f2ea2213
Instruction ID: e2bb80d216e9af14c6dead2039cb76433f6cfeac2b054830c48bc685068af89c
Opcode Fuzzy Hash: 71b59d75833e04490e9228352db24290768b96e07ffcf5a6406e02a7f2ea2213
Instruction Fuzzy Hash: 13B1A475B002059FCB18DFA9E890AAEB7B5BF4C314F0845ADDC599B346E730D960CB91

Function 03169BF0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 03169C12
SetLastError.KERNEL32(0000007F), ref: 03169D15

Strings

Main, xrefs: 03169BFF, 03169C3C

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: e4ea0b49927699d2948247b6bb698b0cfd264791db337560a0244932300f1a09
Instruction ID: 0a8d50d97d60f5553758d0a79026220f95e7f1cabcb84ca7b3c7159ed7ffcbe3
Opcode Fuzzy Hash: e4ea0b49927699d2948247b6bb698b0cfd264791db337560a0244932300f1a09
Instruction Fuzzy Hash: C441D372A002059FD724DF99DC81BAAF3F4FF59315F0885A9D8059B342EB74E851CB90

Function 000E0A63 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000E0ADD
IsWindow.USER32(?), ref: 000E0B16
GetWindowPlacement.USER32(?,?), ref: 000E0B54
ShowWindow.USER32(?,00000009), ref: 000E0B63
PostMessageW.USER32(?,00000111,0000FF00,00000000), ref: 000E0B7B
SendMessageW.USER32(?,00000111,0000FF00,00000000), ref: 000E0B83

Strings

,, xrefs: 000E0B4D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Message$ParentPlacementPostSendShow
String ID: ,
API String ID: 3417538037-3772416878
Opcode ID: 0c9d8af86f3c01a0693331d5e3c024d68ee906916357c1f0f7b8d89561e915fd
Instruction ID: 0f4001b9840254d21485b00ce4675367b2c1c0b413938d59a1af9195618802b7
Opcode Fuzzy Hash: 0c9d8af86f3c01a0693331d5e3c024d68ee906916357c1f0f7b8d89561e915fd
Instruction Fuzzy Hash: 0A419170A00744DFCB759F7AD84886EB7F9FF84714B24492AE192E2665DBB09CC0CB51

Function 000A40F7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100windowmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000A40FE
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?,00000078,000A43E4,?,000A4462), ref: 000A4121

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

SHGetDesktopFolder.SHELL32(?,?,000A4462), ref: 000A4136
GlobalAlloc.KERNEL32(00000040,0000000C,?,000A4462), ref: 000A414B
SendMessageW.USER32(?,00001132,00000000,?), ref: 000A41F4
SendMessageW.USER32(?,00001102,00000002,00000000), ref: 000A4201

Strings

g, xrefs: 000A4144

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: FolderMessageSend$AllocDesktopException@8GlobalH_prolog3LocationSpecialThrow
String ID: g
API String ID: 4142625628-30677878
Opcode ID: 9eef35454acd9a93715bb696e06b98be1e48b04fe17cf8d8ca3c2824192cf099
Instruction ID: 60188a69f29ba3fb1997f1ea36678bbf945b3b97089a55e9636ebff1e3733d72
Opcode Fuzzy Hash: 9eef35454acd9a93715bb696e06b98be1e48b04fe17cf8d8ca3c2824192cf099
Instruction Fuzzy Hash: D7317EB1A002199FCB10DFA4CC85AEEBBF9FF89300F114569F955EB291DBB49941CB60

Function 000A493D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,?), ref: 000A4984
_memset.LIBCMT ref: 000A4991
SendMessageW.USER32(?,00001102,00008001,?), ref: 000A49FA

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 000A49C3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 000A49CE
SendMessageW.USER32(?,0000110B,00000009,?), ref: 000A49E8

Strings

@, xrefs: 000A49A2

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Exception@8Throw_memset
String ID: @
API String ID: 3355562902-2766056989
Opcode ID: 46cf98a9fa3a16861e1eed9aa3b02330bd52757753481b410ac1227304fcaa09
Instruction ID: 8aba592e0f3bd03cb1f2961323682adab4ce4510025a99b477a50b6758ea56dc
Opcode Fuzzy Hash: 46cf98a9fa3a16861e1eed9aa3b02330bd52757753481b410ac1227304fcaa09
Instruction Fuzzy Hash: 4421C676600309BBEB21AB95CC82FEB7BE8FF99750F104011F745AA1A1E6F1DC548B60

Function 000904F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000904F7
GetSysColorBrush.USER32(00000018), ref: 00090510
FillRect.USER32(00000000,?,00000000), ref: 0009051C
GetSysColor.USER32(00000017), ref: 00090544
GetSysColor.USER32(00000017), ref: 0009056E
GetSysColor.USER32(00000017), ref: 00090573

Strings

mmm, xrefs: 0009053B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Color$BrushFillH_prolog3Rect
String ID: mmm
API String ID: 24942539-1545505134
Opcode ID: 18cc3d10954687f4e14b42226fed5c9daae56172efe798e15f41a16ade1e07c1
Instruction ID: da54e455d612585d18a1dafddbd20f480249a14d0c4c7c71b176447a539ca929
Opcode Fuzzy Hash: 18cc3d10954687f4e14b42226fed5c9daae56172efe798e15f41a16ade1e07c1
Instruction Fuzzy Hash: 97114C71200209EFCB10EFA8CC84EAE77A9FF88710B054518FA468B291CB70DD41CFA1

Function 000C6193 Relevance: 12.2, APIs: 8, Instructions: 239windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 000C61C2
IsWindowVisible.USER32(?), ref: 000C61D1
GetWindowRect.USER32(?,?), ref: 000C6223
IsZoomed.USER32(?), ref: 000C6232
SetWindowRgn.USER32(?,00000000,00000001), ref: 000C629F
_memset.LIBCMT ref: 000C62BF
GetSystemMetrics.USER32(00000004), ref: 000C6309
_memset.LIBCMT ref: 000C63DA

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Visible_memset$MetricsRectSystemZoomed
String ID:
API String ID: 3274878110-0
Opcode ID: afba0c1dc00316e1d2f4cff9626b0053bfe50a1bd329d9735cb4cc7e8c80271e
Instruction ID: 9601ef349aefd3bf068a69a2d2ed75f4ab6c68b82b95693dc8c232956d971c0f
Opcode Fuzzy Hash: afba0c1dc00316e1d2f4cff9626b0053bfe50a1bd329d9735cb4cc7e8c80271e
Instruction Fuzzy Hash: 199118B1A002589FCF65DFA8C884FEEBBB5FF48700F144169E905AB256D731A941CFA1

Function 000B41A5 Relevance: 12.2, APIs: 8, Instructions: 204windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000B41AC
EnterCriticalSection.KERNEL32(001E1A6C,00000014,00093845,?,?,00000000,00000000,00000000,00000000), ref: 000B41D1
SelectObject.GDI32(?,00000014), ref: 000B42C0
LeaveCriticalSection.KERNEL32(001E1A6C,00000020,?,00000014,00093845,?,?,00000000,00000000,00000000,00000000), ref: 000B42DF
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 000B4302
SelectObject.GDI32(00000000), ref: 000B4311
CreateCompatibleDC.GDI32(00000000), ref: 000B439B
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 000B43BB

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Create$BitmapCompatibleCriticalObjectSectionSelect$EnterH_prolog3Leave
String ID:
API String ID: 4255533662-0
Opcode ID: 5fb42a6d50602aaf1a26a97190ced2359b2e7754bbd4c7f344ee1950808d81f9
Instruction ID: 93ccdd6ba2b1a30ac00e075f0684bb568094ad67349943fa65093b1aed884d59
Opcode Fuzzy Hash: 5fb42a6d50602aaf1a26a97190ced2359b2e7754bbd4c7f344ee1950808d81f9
Instruction Fuzzy Hash: 8B717D30A00B01DFCB75DF74C881AAAB7E1FF94701B64892DE496C7A52D7B0AA85DB01

Function 000A2B87 Relevance: 12.1, APIs: 8, Instructions: 146windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 000A2BD0
ScreenToClient.USER32(00000000,?), ref: 000A2C15
SendMessageW.USER32(?,0000102C,00000000,00000003), ref: 000A2C53
SetCapture.USER32(?), ref: 000A2C79
ReleaseCapture.USER32 ref: 000A2CB4
ScreenToClient.USER32(?,?), ref: 000A2CD3
GetSystemMetrics.USER32(00000044), ref: 000A2D0E
GetSystemMetrics.USER32(00000045), ref: 000A2D2A

Part of subcall function 000A2141: SendMessageW.USER32(000A2BB7,00001018,00000000,00000000), ref: 000A214D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CaptureClientMessageMetricsScreenSendSystem$FocusRelease
String ID:
API String ID: 3871486171-0
Opcode ID: caa233a4b7cd496bd5ae20639ae57971e4f9e6c0f80587cd7b585c075fb8dd15
Instruction ID: c27427edb26a1a9ee5a24d17ec39e7a3edd8cb7cc75b337cfb0b5ab5fb1dc7d7
Opcode Fuzzy Hash: caa233a4b7cd496bd5ae20639ae57971e4f9e6c0f80587cd7b585c075fb8dd15
Instruction Fuzzy Hash: 42514D75A00605AFDB60DFB8C984AEA7BF5FF19310F108529F59AD7251DBB0E980CB90

Function 0009073B Relevance: 12.1, APIs: 8, Instructions: 138windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00090742
IsWindowVisible.USER32(?), ref: 0009079B
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 000907D1
CreateRectRgn.GDI32(00000000,00000000,00000005,00000005), ref: 000907EC
CreateEllipticRgn.GDI32(00000000,00000000,0000000B,0000000B), ref: 00090817
CreateRectRgn.GDI32(?,00000000,?,00000005), ref: 0009084B
CreateEllipticRgn.GDI32(?,00000000,?,0000000B), ref: 0009087E

Part of subcall function 0006BAD5: CombineRgn.GDI32(?,?,?,?), ref: 0006BAFA

SetWindowRgn.USER32(?,00000000,00000001), ref: 000908B0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Create$Rect$EllipticWindow$CombineH_prolog3Visible
String ID:
API String ID: 2498130849-0
Opcode ID: a1134151f6f965f55f6d75bc57d491e269002fa673a07d9d2fe73278dda8db8c
Instruction ID: ecd7424bd4a6dd007557dae25bbd1e8cbe3028ed4d4feab6c52c3e0acf2b0cac
Opcode Fuzzy Hash: a1134151f6f965f55f6d75bc57d491e269002fa673a07d9d2fe73278dda8db8c
Instruction Fuzzy Hash: C2510CB2E00209AACB11EBA4CD96EEFB778EF15351F104219B512B71D2DB746B05CBA1

Function 001369DF Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001369E6
EqualRect.USER32(?,?), ref: 00136A05
EqualRect.USER32(?,?), ref: 00136A16
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00136A66
CreateRectRgn.GDI32(?,00000000,?,?), ref: 00136A99
CreateRectRgnIndirect.GDI32(?), ref: 00136AA5
SetWindowRgn.USER32(?,?,00000000), ref: 00136ACC
RedrawWindow.USER32(?,00000000,00000000,00000105,001DFAF0,?,?,?,00000001,00000058), ref: 00136B44

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Create$EqualWindow$H_prolog3IndirectRedraw
String ID:
API String ID: 1234839666-0
Opcode ID: 8d423c0b777ce99d27f3323b3b71f6d640cb5e90bd1c5a8d13903776e0e9082b
Instruction ID: 466f10b67c735f68ea6b1a2402b105ebbf34653f776b6a3edd5d67509a61d68f
Opcode Fuzzy Hash: 8d423c0b777ce99d27f3323b3b71f6d640cb5e90bd1c5a8d13903776e0e9082b
Instruction Fuzzy Hash: 2151177290011AEFDF05DFA4C985AEF7B79EF04340F018119FD05AB256DBB0AA55CBA0

Function 000865D6 Relevance: 12.1, APIs: 8, Instructions: 124windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000865DD
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00086613
GetParent.USER32(?), ref: 00086638
GetTopWindow.USER32(?), ref: 000866F2
GetWindow.USER32(?,00000002), ref: 00086710
IsWindow.USER32(?), ref: 00086730
GetParent.USER32(?), ref: 0008673D
DestroyWindow.USER32(?), ref: 0008674B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Parent$DestroyH_prolog3MessageSend
String ID:
API String ID: 3234442123-0
Opcode ID: a68c594a75017b3a046a48d429631d7035f80bc9d313400f057b4925add039b0
Instruction ID: 5546459a534c0e7d5b7f4546e77fd88f6262d478bbffc75f6a9031ccd44d3cf2
Opcode Fuzzy Hash: a68c594a75017b3a046a48d429631d7035f80bc9d313400f057b4925add039b0
Instruction Fuzzy Hash: 02419E716002059FCB20BFA4C9859EEBBF6BF48304F55082CF696A7262DB31AD50CB90

Function 0316B930 Relevance: 12.1, APIs: 8, Instructions: 121synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000009,000000FF,76CB4AAF), ref: 0316B97D
SetLastError.KERNEL32(00000000), ref: 0316B98B
CloseHandle.KERNEL32(?), ref: 0316B9A8
CloseHandle.KERNEL32(?), ref: 0316B9CB
CloseHandle.KERNEL32(?), ref: 0316B9EE
DeleteCriticalSection.KERNEL32(?), ref: 0316BA18
_free.LIBCMT ref: 0316BA55
CloseHandle.KERNEL32(00000002), ref: 0316BA71

Part of subcall function 0316F2F0: GetCurrentThreadId.KERNEL32 ref: 0316F2F4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CloseHandle$CriticalCurrentDeleteErrorLastObjectSectionSingleThreadWait_free
String ID:
API String ID: 3924219484-0
Opcode ID: f14c4a92fce7aa8efb85687b71617f6cd5a8c9724492a4c2f6416b4d8af62e8f
Instruction ID: 3c2d176961406d1c798a3d7b962e8fd9e6eb4fa75eb765d3de713150f239bd0e
Opcode Fuzzy Hash: f14c4a92fce7aa8efb85687b71617f6cd5a8c9724492a4c2f6416b4d8af62e8f
Instruction Fuzzy Hash: F441D3B5504746EBCB20EFFACC84A5ABBE8EF1C314F148A6DE556D7240DB34A914CB60

Function 0006E78F Relevance: 12.1, APIs: 8, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 000BC309: ReleaseCapture.USER32 ref: 000BC337
Part of subcall function 000BC309: IsWindow.USER32(?), ref: 000BC35B
Part of subcall function 000BC309: DestroyWindow.USER32(?), ref: 000BC36B

SetRectEmpty.USER32(?), ref: 0006E7C2
ReleaseCapture.USER32 ref: 0006E7C8
SetCapture.USER32(?), ref: 0006E7D7
GetCapture.USER32 ref: 0006E819
ReleaseCapture.USER32 ref: 0006E829
SetCapture.USER32(?), ref: 0006E838
RedrawWindow.USER32(?,?,?,00000505), ref: 0006E8A3
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 0006E8E2

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Capture$Window$Release$Redraw$DestroyEmptyRect
String ID:
API String ID: 2209428161-0
Opcode ID: c045524b903bf46a8d7c1eb9ea25f6ead06a98b07544742e0a7a536c65c04624
Instruction ID: 7e8bf493c4b8246791bac47fc7595207b93ab08ea457d0b7a72082720499434c
Opcode Fuzzy Hash: c045524b903bf46a8d7c1eb9ea25f6ead06a98b07544742e0a7a536c65c04624
Instruction Fuzzy Hash: C0415B356007409FDB24AB34CC59FAB7BE6BF84721F25066DF4AA972A1DF70E9408B50

Function 000B02E2 Relevance: 12.1, APIs: 8, Instructions: 102windowtimeCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000B037C
SendMessageW.USER32(?,00000111,?,?), ref: 000B03AA
IsWindow.USER32(?), ref: 000B03B9
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,000A9F92,?,?,?), ref: 000B03C9
IsWindow.USER32(?), ref: 000B03D9
ReleaseCapture.USER32 ref: 000B03E7
KillTimer.USER32(?,00000001,?,?,?,?,?,000A9F92,?,?,?), ref: 000B0400
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 000B041F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$MessageSend$CaptureKillParentRedrawReleaseTimer
String ID:
API String ID: 3014619129-0
Opcode ID: 0758be8f613719b665245edffc7f384c4f408ad9aa4f829499e0eb7df4732766
Instruction ID: 085d953d5ba3e98a0cfeac1cc578f5985aab2cf5805f59e8a87e9360871eff12
Opcode Fuzzy Hash: 0758be8f613719b665245edffc7f384c4f408ad9aa4f829499e0eb7df4732766
Instruction Fuzzy Hash: 97314970A00B00EFD7719B35CC48BEBBAE9FB84B01F14492EE5DA92115E772A980CB51

Function 0007CA6F Relevance: 12.1, APIs: 8, Instructions: 100COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 0007CA8C
GetParent.USER32(?), ref: 0007CAA3
GetClientRect.USER32(?,?), ref: 0007CB31
MapWindowPoints.USER32(?,?,?,00000002), ref: 0007CB44
PtInRect.USER32(?,?,?), ref: 0007CB54

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ClientRect$ParentPointsScreenWindow
String ID:
API String ID: 1402249346-0
Opcode ID: 8337408490506804f41a63af67b0ae3276143e8513ba536ec5ee5ac7504f089b
Instruction ID: 2204443f72b785b351964af0f7c72d0515d046bc71e1e2e03dfec4cebb6239e3
Opcode Fuzzy Hash: 8337408490506804f41a63af67b0ae3276143e8513ba536ec5ee5ac7504f089b
Instruction Fuzzy Hash: 6F315E72A00109AFDB119FA5CC49CBEBBF9FF48740B144129F94AE7261EB74DA00DB65

Function 0008843A Relevance: 12.1, APIs: 8, Instructions: 80windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00088441
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0008845A
DestroyAcceleratorTable.USER32(?), ref: 0008849B
GetTopWindow.USER32(?), ref: 000884D0
GetWindow.USER32(?,00000002), ref: 000884E9
IsWindow.USER32(?), ref: 00088508
GetParent.USER32(?), ref: 00088513
DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,0000001C), ref: 0008851F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Destroy$AcceleratorH_prolog3MessageParentSendTable
String ID:
API String ID: 271420684-0
Opcode ID: c908b74c7b4876320237a37608612dcc68fc54e49ad5ed92567999e0df5927d8
Instruction ID: 62659ccd75fe5a3da9957e06c62ed198a9f300e0f537fd556d3a4eaba247fae7
Opcode Fuzzy Hash: c908b74c7b4876320237a37608612dcc68fc54e49ad5ed92567999e0df5927d8
Instruction Fuzzy Hash: D9316D71900605AFCB14EFA4CCC5AEDBBB5FB08310F94552DE486B7651DF706D808BA0

Function 00058717 Relevance: 12.1, APIs: 8, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 00058729
GetMenuItemCount.USER32(?), ref: 00058731
GetSubMenu.USER32(?,-00000001), ref: 0005874E
GetMenuItemCount.USER32(00000000), ref: 0005875E
GetSubMenu.USER32(00000000,00000000), ref: 0005876F
RemoveMenu.USER32(00000000,00000000,00000400), ref: 0005878C
GetSubMenu.USER32(?,?), ref: 000587A6
RemoveMenu.USER32(?,?,00000400), ref: 000587C4

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Menu$CountItem$Remove
String ID:
API String ID: 3494307843-0
Opcode ID: aeadb2487aedce5c3478eb8d1a6f14727a8776cc501902467ec03d7ec6a66549
Instruction ID: 3efe893b11b2753e6d04a1893a3e106aeeadcfaf0c36339568df120d0a57d614
Opcode Fuzzy Hash: aeadb2487aedce5c3478eb8d1a6f14727a8776cc501902467ec03d7ec6a66549
Instruction Fuzzy Hash: 0E212571A0460DFBDF119FA4CC859AEBBB5FB08342F2084A2ED01B2111DB71DE54AF90

Function 000547AC Relevance: 12.1, APIs: 8, Instructions: 66memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 000547CB
lstrcmpW.KERNEL32(00000000,?), ref: 000547D8
OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 000547EA
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0005480A
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00054812
GlobalLock.KERNEL32(00000000), ref: 0005481C
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 00054829
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00054841

Part of subcall function 000633CB: GlobalFlags.KERNEL32(?), ref: 000633DA
Part of subcall function 000633CB: GlobalUnlock.KERNEL32(?), ref: 000633EB
Part of subcall function 000633CB: GlobalFree.KERNEL32(?), ref: 000633F5

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: f603c410a0fe252d8dc410eac7224e83940bd078c36e0f3c83ca71f9b54f33b4
Instruction ID: a0e42f64f4e8b8513c96f092c91ac02c9571eeb55979bf7f179f54ba9a38ed6d
Opcode Fuzzy Hash: f603c410a0fe252d8dc410eac7224e83940bd078c36e0f3c83ca71f9b54f33b4
Instruction Fuzzy Hash: FD119E72900544BADF22ABA5CD89DBF7AFDEB85B49B100429FA14D6021DB31DA84D760

Function 0006687A Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000031), ref: 00066890
GetSystemMetrics.USER32(00000032), ref: 0006689A
SetRectEmpty.USER32(001DFF04), ref: 000668A9
EnumDisplayMonitors.USER32(00000000,00000000,000667F5,001DFF04,?,?,?,00057A3A,?), ref: 000668B9
SystemParametersInfoW.USER32(00000030,00000000,001DFF04,00000000), ref: 000668D4
SystemParametersInfoW.USER32(00001002,00000000,001DFF30,00000000), ref: 000668F4
SystemParametersInfoW.USER32(00001012,00000000,001DFF34,00000000), ref: 0006690C
SystemParametersInfoW.USER32 ref: 0006692C

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: System$InfoParameters$Metrics$DisplayEmptyEnumMonitorsRect
String ID:
API String ID: 2614369430-0
Opcode ID: 5286dddc81608b96de00e2536f25a9a77d76ed4a5d0b6ec190e57fb205c8990d
Instruction ID: a9f21c9fe0ada1e6b1c08b0d777073e80e6c57aa4a66552d7cbcf873be712ae2
Opcode Fuzzy Hash: 5286dddc81608b96de00e2536f25a9a77d76ed4a5d0b6ec190e57fb205c8990d
Instruction Fuzzy Hash: 8C11DA71601744AFE3319B669D49EE7BAECEFC6B40F00491EE59A86140D7B16441CA60

Function 00058945 Relevance: 12.1, APIs: 8, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GlobalSize.KERNEL32(?), ref: 00058956
GlobalAlloc.KERNEL32(00002002,00000000), ref: 00058968
GlobalSize.KERNEL32(?), ref: 00058979
GlobalLock.KERNEL32(?), ref: 0005898A
GlobalLock.KERNEL32(?), ref: 00058990
GlobalSize.KERNEL32(?), ref: 0005899B
GlobalUnlock.KERNEL32(?), ref: 000589AE
GlobalUnlock.KERNEL32(?), ref: 000589B3

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Global$Size$LockUnlock$Alloc
String ID:
API String ID: 2344174106-0
Opcode ID: e2ac0d568ed23cc3e0e3bbc564e5549a5bba8b614c5fc3de04ee11267e544bdd
Instruction ID: adefaf18f1ff8277f807566f50533d6cc002f38c4ce2576ef52d92fd42db3c41
Opcode Fuzzy Hash: e2ac0d568ed23cc3e0e3bbc564e5549a5bba8b614c5fc3de04ee11267e544bdd
Instruction Fuzzy Hash: FF017C71A00218BBDB116F659C858BFBFACEF542A57148022FC08A3211DAB1DD14DBA0

Function 00068809 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 00068818
GetSystemMetrics.USER32(0000000C), ref: 0006881F
GetSystemMetrics.USER32(00000002), ref: 00068826
GetSystemMetrics.USER32(00000003), ref: 00068830
GetDC.USER32(00000000), ref: 0006883A
GetDeviceCaps.GDI32(00000000,00000058), ref: 0006884B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00068853
ReleaseDC.USER32(00000000,00000000), ref: 0006885B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: 126693f329018129781697fab8f2f1f89f527a96c83179b1bfe24fd7fcda6913
Instruction ID: 96b341803d22107392433733d696005aeea71a0130c9be7dcddf335279bc2e16
Opcode Fuzzy Hash: 126693f329018129781697fab8f2f1f89f527a96c83179b1bfe24fd7fcda6913
Instruction Fuzzy Hash: B2F06DB1E40754ABE7106FB29C49B267F68FB44722F004917E6049B680DBF598818FD0

Function 0012AB90 Relevance: 12.0, APIs: 8, Instructions: 36windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0012AB97
DestroyIcon.USER32(?,00000004,000BE358,00000004,000BE5D7,?,?,?), ref: 0012ABBA
DestroyIcon.USER32(?,?,?), ref: 0012ABC2
DestroyIcon.USER32(?,?,?), ref: 0012ABCA
DestroyIcon.USER32(?,?,?), ref: 0012ABD2
DestroyIcon.USER32(?,?,?), ref: 0012ABDA
DestroyIcon.USER32(?,?,?), ref: 0012ABE2

Part of subcall function 00059FD0: DeleteDC.GDI32(00000000), ref: 00059FE2

~_Task_impl.LIBCPMT ref: 0012AC1C

Part of subcall function 000E01CC: __EH_prolog3.LIBCMT ref: 000E01D3

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: DestroyIcon$H_prolog3$DeleteTask_impl
String ID:
API String ID: 3077829688-0
Opcode ID: a6565228cd7ab97d31c8ef98fa39e2de627f52502f957339b1006edce8108f70
Instruction ID: 97d5c123b76fec1736b035fb694a373b48d77c3711a642d854fc4fc9bebb2f94
Opcode Fuzzy Hash: a6565228cd7ab97d31c8ef98fa39e2de627f52502f957339b1006edce8108f70
Instruction Fuzzy Hash: 84015674002784DACB22BB70CD05BDEBAA2AF81300F154958E4AA172A2CFB12A05DB12

Function 0007A6F8 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 367stringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0007A702
IsMenu.USER32(?), ref: 0007A726

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0007A86E
lstrlenW.KERNEL32(?), ref: 0007A87B

Part of subcall function 000BFDA0: __EH_prolog3.LIBCMT ref: 000BFDA7

Part of subcall function 000BEB15: __EH_prolog3.LIBCMT ref: 000BEB1C

Strings

Recent File, xrefs: 0007A81C
&%d %s, xrefs: 0007A913

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$CurrentDirectoryException@8H_prolog3_MenuThrowlstrlen
String ID: &%d %s$Recent File
API String ID: 2040550558-3015484766
Opcode ID: 6666e612992fc0f3d586f00e5ea4fe7127537d7020e9dbbe8139ee7140de8b2e
Instruction ID: a883624093394cc8c67a3ee603f1b80cc6e81fc9c817cf39683c51410a52b74b
Opcode Fuzzy Hash: 6666e612992fc0f3d586f00e5ea4fe7127537d7020e9dbbe8139ee7140de8b2e
Instruction Fuzzy Hash: 1AE18E70B012159FDB66DF64CC94BEDB3F9AF89300F1481A8E50997292DB74AE80CF56

Function 000EE250 Relevance: 10.8, APIs: 7, Instructions: 348COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000EE257
GetWindow.USER32(?,00000005), ref: 000EE2BB

Part of subcall function 000ED940: __EH_prolog3.LIBCMT ref: 000ED947
Part of subcall function 000ED940: GetWindow.USER32(?,00000005), ref: 000ED967
Part of subcall function 000ED940: GetWindow.USER32(?,00000002), ref: 000ED99D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$H_prolog3
String ID:
API String ID: 1351209170-0
Opcode ID: 8fb561f2f248428859aa9da780dd25379b111e4555b947d97c87af2f69e25d19
Instruction ID: f50f16c08cb13f41afa49467ea07ea2aed40e7ea6e75996aa464a13f7fc935ae
Opcode Fuzzy Hash: 8fb561f2f248428859aa9da780dd25379b111e4555b947d97c87af2f69e25d19
Instruction Fuzzy Hash: 26D16E70A0028A9FDF14EFA5C899AFEB7F5BF48301F040569E946A7292DF749D44CB50

Function 000D67C4 Relevance: 10.8, APIs: 7, Instructions: 325windowstringCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000D67CE
GetMenuItemCount.USER32(0000000D), ref: 000D6817
GetMenuItemID.USER32(0000000D,?), ref: 000D683A

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Part of subcall function 000BA2FA: __EH_prolog3.LIBCMT ref: 000BA301

Part of subcall function 00054010: _DebugHeapAllocator.LIBCPMTD ref: 00054065

Part of subcall function 000632B4: __EH_prolog3.LIBCMT ref: 000632BB

lstrlenW.KERNEL32(00000000,?), ref: 000D695C
CharUpperBuffW.USER32(00000002,00000001), ref: 000D6971
lstrlenW.KERNEL32(00000000), ref: 000D6979
GetSubMenu.USER32(00000000,?), ref: 000D6AAB

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Menu$H_prolog3Itemlstrlen$AllocatorBuffCharCountDebugException@8H_prolog3_HeapThrowUpper
String ID:
API String ID: 3129970023-0
Opcode ID: b997736578e9f1d2cf15535a6033529d7508f0d814b465b258d302b2e57a14ce
Instruction ID: 73a8767b68907e081cfc42327e6393647f636635c73b2131e42da536fa69ab13
Opcode Fuzzy Hash: b997736578e9f1d2cf15535a6033529d7508f0d814b465b258d302b2e57a14ce
Instruction Fuzzy Hash: 07D15831900228ABDF25EB64CC55BEEB7B4AF09320F5042DAE559A32D2DB315F84DF61

Function 00062331 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 243COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00062361

Strings

AfxControlBar100su, xrefs: 000623DD
@, xrefs: 00062506
@, xrefs: 0006246D
AfxMDIFrame100su, xrefs: 00062402
AfxFrameOrView100su, xrefs: 00062427

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: _memset
String ID: @$@$AfxControlBar100su$AfxFrameOrView100su$AfxMDIFrame100su
API String ID: 2102423945-4089759438
Opcode ID: 514068395f99c79194c7e518165040ae07d818d6e12eb8c1f7946920cf92a116
Instruction ID: 18ea85b2733fc8313fb095132475c25aff687febdd038c61e2598f5dc5bb1715
Opcode Fuzzy Hash: 514068395f99c79194c7e518165040ae07d818d6e12eb8c1f7946920cf92a116
Instruction Fuzzy Hash: 17913071C00619AADB50DFE8C585BEEBBF9AF04384F158165FD48F6182EBB48B44CB91

Function 000BC7D7 Relevance: 10.7, APIs: 7, Instructions: 233COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 000BC83F
GetWindowRect.USER32(?,?), ref: 000BC84C
GetWindowRect.USER32(?,?), ref: 000BC897
IntersectRect.USER32(?,?,?), ref: 000BC8A9

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

PtInRect.USER32(?,?,?), ref: 000BC92C
GetWindowRect.USER32(?,?), ref: 000BC963
PtInRect.USER32(?,?,?), ref: 000BC973

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$CursorException@8IntersectThrow
String ID:
API String ID: 3420418273-0
Opcode ID: e2252ff02bb6410560b893172c1c17668b4121ce6defe2c37c0e5fad3e14cf65
Instruction ID: 12bf06ba4929b5a6dfd1e5508a7f378b01b1c921e48237c449608a895f27761d
Opcode Fuzzy Hash: e2252ff02bb6410560b893172c1c17668b4121ce6defe2c37c0e5fad3e14cf65
Instruction Fuzzy Hash: 4F91E2B1E0021DAFDF14DFA9DA848EDBBB9FF08705F25855AE401E2254EB309945CF91

Function 03170DB0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

bad allocation, xrefs: 03170EB8

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID:
String ID: bad allocation
API String ID: 0-2104205924
Opcode ID: 02ca5709d75e5d7bb6cae4edda5a377b97d61b266fb45047864d378cfd54243a
Instruction ID: 8db819ab109ea1d973e0edfd2c0f1055cfbcf7668ba7b2129e83038f9ae9d105
Opcode Fuzzy Hash: 02ca5709d75e5d7bb6cae4edda5a377b97d61b266fb45047864d378cfd54243a
Instruction Fuzzy Hash: 5651B176A147159BCB18DF98D881AAEF7B4FB4C720F18827EE915E7340DB31A9118BD0

Function 000EE6AA Relevance: 10.7, APIs: 7, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 000EC4A6: __EH_prolog3_GS.LIBCMT ref: 000EC4AD
Part of subcall function 000EC4A6: GetDesktopWindow.USER32 ref: 000EC4BB
Part of subcall function 000EC4A6: SetRectEmpty.USER32(?), ref: 000EC4F2
Part of subcall function 000EC4A6: SetRectEmpty.USER32(?), ref: 000EC504
Part of subcall function 000EC4A6: CopyRect.USER32(?,?), ref: 000EC50F
Part of subcall function 000EC4A6: CopyRect.USER32(?,?), ref: 000EC52B

SetRectEmpty.USER32(?), ref: 000EE6E6
ClientToScreen.USER32(?,?), ref: 000EE70E
IsRectEmpty.USER32(?), ref: 000EE737
GetParent.USER32(?), ref: 000EE744
GetCursorPos.USER32(?), ref: 000EE769
IsRectEmpty.USER32(?), ref: 000EE81F
EqualRect.USER32(?,?), ref: 000EE831

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$Copy$ClientCursorDesktopEqualH_prolog3_ParentScreenWindow
String ID:
API String ID: 1345960709-0
Opcode ID: d9069d4be6d8c0e11e051ccdf9dfd3f2f6326d0bd77f5ec27325af6ea08f1783
Instruction ID: 0a400246e94a076d1f996295fe765902a367d284589102cbaf795cbc7d988a59
Opcode Fuzzy Hash: d9069d4be6d8c0e11e051ccdf9dfd3f2f6326d0bd77f5ec27325af6ea08f1783
Instruction Fuzzy Hash: DA513A71A00159AFCF15DFA5CD888EEBBBAEF48310F14412AF815F7291DB719D458BA0

Function 0316CD10 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0316CD58
_free.LIBCMT ref: 0316CD96
_free.LIBCMT ref: 0316CDD5
_free.LIBCMT ref: 0316CE15
_free.LIBCMT ref: 0316CE3D
_free.LIBCMT ref: 0316CE61
_free.LIBCMT ref: 0316CE99

Part of subcall function 03171DA4: HeapFree.KERNEL32(00000000,00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171DBA
Part of subcall function 03171DA4: GetLastError.KERNEL32(00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000), ref: 03171DCC

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c593613c4c196f0e66c53c5f0af311c875d407a6f9b954e767454721b4a1eba0
Instruction ID: be7fa4c10c94193bd472d74cd43a116ad6e70d23ea98e61a7c5a072f32c662c6
Opcode Fuzzy Hash: c593613c4c196f0e66c53c5f0af311c875d407a6f9b954e767454721b4a1eba0
Instruction Fuzzy Hash: D7512CB6A002519FC714DF99C584899BBB6BF8D31471E80BAC5499B321C732BD62CBE1

Function 03170B90 Relevance: 10.6, APIs: 7, Instructions: 150networktimeCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,76CB4AAF), ref: 03170BE8
EnterCriticalSection.KERNEL32(?,76CB4AAF), ref: 03170C0E
WSASetLastError.WS2_32(00002746), ref: 03170C27
LeaveCriticalSection.KERNEL32(?), ref: 03170C2E
timeGetTime.WINMM ref: 03170C98
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,03183118,000000FF), ref: 03170CDF
LeaveCriticalSection.KERNEL32(?), ref: 03170D07

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLast$EnterTimetime
String ID:
API String ID: 3731243816-0
Opcode ID: cb3ad5b65adb3de93e401a9d031c96d63c33d34819e1b2cc9f3bbcf9e8f35db2
Instruction ID: 7a5bf80bb0da6a5b2192ec63143e93227c5cdc77030d0e96997ef8b2ed27f443
Opcode Fuzzy Hash: cb3ad5b65adb3de93e401a9d031c96d63c33d34819e1b2cc9f3bbcf9e8f35db2
Instruction Fuzzy Hash: D651BE766047048FD724DF69D885B6AB7F8FB4C724F0846AAE85AC7780E735E940CB50

Function 000AA8AB Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 000AA8B2

Part of subcall function 0006A349: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 0006A369

Part of subcall function 000A1ADD: __EH_prolog3.LIBCMT ref: 000A1AE4

Part of subcall function 0006A2D8: __EH_prolog3.LIBCMT ref: 0006A2DF

Strings

MFCMaskedEdit_Mask, xrefs: 000AA924
MFCMaskedEdit_ValidChars, xrefs: 000AAA16
MFCMaskedEdit_SelectByGroup, xrefs: 000AA8EF
MFCMaskedEdit_DefaultChar, xrefs: 000AA996
MFCMaskedEdit_InputTemplate, xrefs: 000AA95B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$ByteCharH_prolog3_catchMultiWide
String ID: MFCMaskedEdit_DefaultChar$MFCMaskedEdit_InputTemplate$MFCMaskedEdit_Mask$MFCMaskedEdit_SelectByGroup$MFCMaskedEdit_ValidChars
API String ID: 207285973-975932772
Opcode ID: a8faf48395301536b37a04863efd4ce52a17dca2841c8ff4ec4080c6a6e5c3de
Instruction ID: b7727cf39556062efc5b3d2b3924f5d29f67cd9a6dde57ecdbeaca343d46e82f
Opcode Fuzzy Hash: a8faf48395301536b37a04863efd4ce52a17dca2841c8ff4ec4080c6a6e5c3de
Instruction Fuzzy Hash: 8A516C71A01109AEDB05EBE4C952AFFB7B9AF16311F144159F811B32C2DF34AE04CB62

Function 0006EAD5 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 000B9249: __EH_prolog3_catch.LIBCMT ref: 000B9250

UpdateWindow.USER32(?), ref: 0006EB69
EqualRect.USER32(?,?), ref: 0006EB9F
InflateRect.USER32(?,00000002,00000002), ref: 0006EBB7
InvalidateRect.USER32(?,?,00000001), ref: 0006EBC6
InflateRect.USER32(?,00000002,00000002), ref: 0006EBDB
InvalidateRect.USER32(?,?,00000001), ref: 0006EBED
UpdateWindow.USER32(?), ref: 0006EBF6

Part of subcall function 0006E6A3: InvalidateRect.USER32(?,?,00000001), ref: 0006E718
Part of subcall function 0006E6A3: InflateRect.USER32(?,?,?), ref: 0006E75E
Part of subcall function 0006E6A3: RedrawWindow.USER32(?,?,00000000,00000401,?,?), ref: 0006E771

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$InflateInvalidateWindow$Update$EqualH_prolog3_catchRedraw
String ID:
API String ID: 1041772997-0
Opcode ID: 4587785c424432f70e3d6db818e11e7657626a624ed5d73c45c65ef42afa7d0a
Instruction ID: 0198acf4e273a8588f3b57cfcf8a083b1d0bcd4a997dcc70c1f9c33d27b19a42
Opcode Fuzzy Hash: 4587785c424432f70e3d6db818e11e7657626a624ed5d73c45c65ef42afa7d0a
Instruction Fuzzy Hash: 2F416B766002059FCF11DF68CC89BAA77AAFF48314F144279ED0AEB196DB709945CFA0

Function 000E61F4 Relevance: 10.6, APIs: 7, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0005E5BF: __EH_prolog3_catch.LIBCMT ref: 0005E5C6

SendMessageW.USER32(?,00000147,00000000,00000000), ref: 000E6251
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 000E6275

Part of subcall function 00093C58: __EH_prolog3_catch.LIBCMT ref: 00093C62
Part of subcall function 00093C58: CloseHandle.KERNEL32(000E58E5,?,000E58E5,00000080,000E58E5,?,00000000,?,00000000), ref: 00093C9B
Part of subcall function 00093C58: GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,000E58E5,00000080,000E58E5,?,00000000,?,00000000), ref: 00093CC2
Part of subcall function 00093C58: GetTempFileNameW.KERNEL32(00000000,AFX,00000000,00000000,00000104,00000000,?,00000000), ref: 00093CF9
Part of subcall function 00093C58: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,04000100,00000000,?,00000000), ref: 00093D1B

SendMessageW.USER32(?,00000150,00000000,00000000), ref: 000E629A
LoadIconW.USER32(?,?), ref: 000E62CB
LoadIconW.USER32(00000000,00007F00), ref: 000E62DE
GetClassLongW.USER32(?,000000F2), ref: 000E6323
SendMessageW.USER32(?,00000170,?,00000000), ref: 000E635F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$FileH_prolog3_catchIconLoadTemp$ClassCloseCreateHandleLongNamePath
String ID:
API String ID: 308549110-0
Opcode ID: 4b609d3c8153509c1a52cab52c9b289c6d97074504fa29634ec4b06d9bb28838
Instruction ID: 1b9e585d9f6017e991b8de949161d9b0ed6fa6aee04c194ed16d437e7203505c
Opcode Fuzzy Hash: 4b609d3c8153509c1a52cab52c9b289c6d97074504fa29634ec4b06d9bb28838
Instruction Fuzzy Hash: BF41DF70200B40AFC721AB75DD55FABBBF9AF88756F10011CF91AA7291EB71AA40CB14

Function 000CC7C7 Relevance: 10.6, APIs: 7, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000CC7CE

Part of subcall function 000D48D9: __EH_prolog3.LIBCMT ref: 000D48E0

Part of subcall function 000AF2E6: __EH_prolog3.LIBCMT ref: 000AF2ED

SetRectEmpty.USER32(?), ref: 000CC964
SetRectEmpty.USER32(?), ref: 000CC96D
SetRectEmpty.USER32(?), ref: 000CC99A
SetRectEmpty.USER32(?), ref: 000CCA00
SetRectEmpty.USER32(?), ref: 000CCA09
SetRectEmpty.USER32(?), ref: 000CCA12

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect$H_prolog3
String ID:
API String ID: 3752103406-0
Opcode ID: f486c5fbbc062dff136cb5814c4db8101b11b10d254fa609fc9497e5589f7f94
Instruction ID: 7af7bd4db96da9483d50b78136b78306ee8337e0686d9d061ad7025e25863dfb
Opcode Fuzzy Hash: f486c5fbbc062dff136cb5814c4db8101b11b10d254fa609fc9497e5589f7f94
Instruction Fuzzy Hash: 636137B0806B458FD361EFBAC5897DAFBE8BFA5300F10491F91AE82261DBB46145CF15

Function 000B042C Relevance: 10.6, APIs: 7, Instructions: 119windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000407,00000000,?), ref: 000B046F
GetParent.USER32(?), ref: 000B049F
SendMessageW.USER32(?,00000111,?), ref: 000B04C4
GetParent.USER32(?), ref: 000B04E7
RedrawWindow.USER32(?,00000000,00000000,00000105,00000000), ref: 000B054F
GetParent.USER32(?), ref: 000B0558
GetWindowLongW.USER32(?,000000F4), ref: 000B0572

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Parent$MessageSendWindow$LongRedraw
String ID:
API String ID: 4271267155-0
Opcode ID: db940726776450547200b7c0b47d66be8403a0b67a653283601b2ea17bed1311
Instruction ID: 7e8f7b9997f15a9bbbfe090de299ff0edb638b13d6f8a91816f584f6cd00ef75
Opcode Fuzzy Hash: db940726776450547200b7c0b47d66be8403a0b67a653283601b2ea17bed1311
Instruction Fuzzy Hash: 0B41D771104704EBFB745B20CC85BFB76E5FB44741F144529FAC6A6592D7B0DC80CA60

Function 0005E845 Relevance: 10.6, APIs: 7, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0005E878
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0005E89C
UpdateWindow.USER32(?), ref: 0005E8B7
SendMessageW.USER32(?,00000121,00000000,?), ref: 0005E8D8
SendMessageW.USER32(?,0000036A,00000000,00000002), ref: 0005E8F0
UpdateWindow.USER32(?), ref: 0005E933
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0005E964

Part of subcall function 000627C8: GetWindowLongW.USER32(?,000000F0), ref: 000627D3

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 0ca65cbaf51f8f1e3c5a4011944a1400429662ea44efd117016da65f3bd4f6b7
Instruction ID: f9321fd173cb6316b9bad01ceade2ed581253c924f2ce42a0b5f93b53847fa19
Opcode Fuzzy Hash: 0ca65cbaf51f8f1e3c5a4011944a1400429662ea44efd117016da65f3bd4f6b7
Instruction Fuzzy Hash: A3418F70900689EBDB659F66CC48EAFBBF5FF81702F10452DE8D5A21A1DB718A44CB60

Function 0316C920 Relevance: 10.6, APIs: 7, Instructions: 116networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000000,00000C00,?), ref: 0316C9C7
_free.LIBCMT ref: 0316C9E0

Part of subcall function 03171DA4: HeapFree.KERNEL32(00000000,00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171DBA
Part of subcall function 03171DA4: GetLastError.KERNEL32(00000000,?,031745D5,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000), ref: 03171DCC

WSASetLastError.WS2_32(00000000), ref: 0316C9ED
_memmove.LIBCMT ref: 0316CA33
freeaddrinfo.WS2_32(?), ref: 0316CA41
htons.WS2_32(?), ref: 0316CA50
WSASetLastError.WS2_32(00002AF9), ref: 0316CA71

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorLast$FreeHeap_free_memmovefreeaddrinfogetaddrinfohtons
String ID:
API String ID: 189201043-0
Opcode ID: 4a098cf3a857ebc51f23af538b3138cdb1bfeee70fe329a0286784d83e396d10
Instruction ID: c554c62baa8c6bdc9919ac359cea34efd37974ddf0dfeea58a47d7e90f3a6e64
Opcode Fuzzy Hash: 4a098cf3a857ebc51f23af538b3138cdb1bfeee70fe329a0286784d83e396d10
Instruction Fuzzy Hash: 4C412F75A003159FDB64DF69DC41BAAB7F5EF8C310F0581AAD84ED7200EB309A848FA1

Function 000AC78D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000AC794

Part of subcall function 0006A349: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 0006A369

Part of subcall function 000A1ADD: __EH_prolog3.LIBCMT ref: 000A1AE4

Part of subcall function 000A1B1A: __EH_prolog3.LIBCMT ref: 000A1B21

Strings

TRUE, xrefs: 000AC868
MFCLink_UrlPrefix, xrefs: 000AC811
MFCLink_Tooltip, xrefs: 000AC895
MFCLink_FullTextTooltip, xrefs: 000AC843
MFCLink_Url, xrefs: 000AC7DF

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCLink_FullTextTooltip$MFCLink_Tooltip$MFCLink_Url$MFCLink_UrlPrefix$TRUE
API String ID: 2949695960-3373932565
Opcode ID: bb8e9630af8225b83bdc77de6dc6d44c6ef5ad2a8b9322a122cc38494ed6bdc1
Instruction ID: 4f1b04b0d88722757b68d1e0873865fbed5604eeab58a83191f773b0d08b0df9
Opcode Fuzzy Hash: bb8e9630af8225b83bdc77de6dc6d44c6ef5ad2a8b9322a122cc38494ed6bdc1
Instruction Fuzzy Hash: 8641187194115AAADF09FBF4CC529FFB778AF25311F040668F922B22D3DF245A08CA65

Function 00086445 Relevance: 10.6, APIs: 7, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000863B2: _malloc.LIBCMT ref: 000863C5

_free.LIBCMT ref: 0008646E
_memset.LIBCMT ref: 00086487
_memset.LIBCMT ref: 000864C1
_memcpy_s.LIBCMT ref: 000864DB
CreateDIBSection.GDI32(00000000,00000000,00000000,00000008,00000000,00000000), ref: 000864F4
_free.LIBCMT ref: 00086506
_free.LIBCMT ref: 00086539

Part of subcall function 00147BF1: HeapFree.KERNEL32(00000000,00000000,?,0014E1C9,00000000,?,00000000,00148FB5,00147D05,00000000,?,00054350,8007000E,00000000,?,000588A7), ref: 00147C07
Part of subcall function 00147BF1: GetLastError.KERNEL32(00000000,?,0014E1C9,00000000,?,00000000,00148FB5,00147D05,00000000,?,00054350,8007000E,00000000,?,000588A7,0000000C), ref: 00147C19

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: _free$_memset$CreateErrorFreeHeapLastSection_malloc_memcpy_s
String ID:
API String ID: 2204576675-0
Opcode ID: 580d7c8b82587f8780b3832c26d2828ff73e77404b9cc85a049a8fcbc6a37212
Instruction ID: ccfe930bebf1de9f7b4d8d5c184da6766d261264d71492b17df327e8caa7ba0b
Opcode Fuzzy Hash: 580d7c8b82587f8780b3832c26d2828ff73e77404b9cc85a049a8fcbc6a37212
Instruction Fuzzy Hash: 2231C572900615ABDB20EF24CC52BAF73A8FF11764F124919F885E7251DB72EE008790

Function 0316EF50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 0316EF72
SetLastError.KERNEL32(00000000), ref: 0316EF9A
GetLastError.KERNEL32 ref: 0316EFC7
WSAGetLastError.WS2_32(?,00000001,0316FBD3), ref: 0316EFF6

Strings

<C-CNNID: %Iu> recv 0 bytes (detect package), xrefs: 0316F01B
<C-CNNID: %Iu> OnReceive() event return 'HR_ERROR', connection will be closed !, xrefs: 0316EFBA

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorLast$recv
String ID: <C-CNNID: %Iu> OnReceive() event return 'HR_ERROR', connection will be closed !$<C-CNNID: %Iu> recv 0 bytes (detect package)
API String ID: 316788870-281152440
Opcode ID: 82f83c051846ccadecf8fb4e604b767e56fb9a93ca1e3974418e86a5d486edee
Instruction ID: b510eb5999e1129a6c64be2dc3741d480bf80cd97395a376ab2a3fdb2a85b6b8
Opcode Fuzzy Hash: 82f83c051846ccadecf8fb4e604b767e56fb9a93ca1e3974418e86a5d486edee
Instruction Fuzzy Hash: B031A7B96007018FD334DFADE884A57B7E9EB8C314F144A2EE45AC7640EB75E4558B60

Function 000CE943 Relevance: 10.6, APIs: 7, Instructions: 90windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 000CE973
GetCursorPos.USER32(?), ref: 000CE995
GetSystemMetrics.USER32(00000044), ref: 000CE9B5
GetCapture.USER32 ref: 000CE9BD
ReleaseCapture.USER32 ref: 000CE9EF
GetParent.USER32(?), ref: 000CEA0C
SendMessageW.USER32(?,?,?,00000000), ref: 000CEA30

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Capture$Release$CursorMessageMetricsParentSendSystem
String ID:
API String ID: 237134002-0
Opcode ID: 67ab2f2585308febaab630230ac537993f89175aa0514ca128a0d829739866dc
Instruction ID: 12784801d2536be896be7a4717722364618dc8b4975cfca70b98204aa7f29491
Opcode Fuzzy Hash: 67ab2f2585308febaab630230ac537993f89175aa0514ca128a0d829739866dc
Instruction Fuzzy Hash: DE31A072500294EFCF65AFB4CC89EAE7BB5FF48351F10492EF49692261DB709980DB50

Function 000565A3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 000565DE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00056609
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00056634
RegCloseKey.ADVAPI32(?), ref: 00056648
RegCloseKey.ADVAPI32(?), ref: 00056652

Part of subcall function 000564C8: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 000564DA
Part of subcall function 000564C8: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 000564EA

Strings

software, xrefs: 000565C0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CloseCreate$AddressHandleModuleOpenProc
String ID: software
API String ID: 550756860-2010147023
Opcode ID: 6fd521dc0656a3cc2ca09ab07fbec7cb2c2173df63c921edd3a720174d139f07
Instruction ID: e0eab2d430b9ad89ddfe44af93394a132e2774517f422f0569bad141b377195b
Opcode Fuzzy Hash: 6fd521dc0656a3cc2ca09ab07fbec7cb2c2173df63c921edd3a720174d139f07
Instruction Fuzzy Hash: 7A212C35A00058FB8F219B85CC48CEFBFBEEBC5715B64415AF905A3115DB725A88DB60

Function 0005E135 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0005E13C
GetProcAddress.KERNEL32(00000000,RegisterTouchWindow), ref: 0005E199
GetProcAddress.KERNEL32(UnregisterTouchWindow,00000000), ref: 0005E1BB

Part of subcall function 000548E0: ActivateActCtx.KERNEL32(?,?,0019DF70,00000010,00054AC8,KERNEL32.DLL), ref: 00054900

Strings

RegisterTouchWindow, xrefs: 0005E193
UnregisterTouchWindow, xrefs: 0005E1B0
user32.dll, xrefs: 0005E15B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AddressProc$ActivateH_prolog3
String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
API String ID: 1001276555-2470269259
Opcode ID: aabbe9698a4e4c33207efd95fc00ca21cf04066caf3c07c719d0f0d246be8bae
Instruction ID: fc75bc18fd5ae21ec52cc9288dcacc99e0b6f9625772dff9cfa208dc498feec3
Opcode Fuzzy Hash: aabbe9698a4e4c33207efd95fc00ca21cf04066caf3c07c719d0f0d246be8bae
Instruction Fuzzy Hash: 48117F706136499BD7589B3CDC45F5A3BE0BB04315F24802EEC82869E0CB708BA9CB54

Function 00054630 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00054642
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryInProgress), ref: 0005465F
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryFinished), ref: 00054669

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Strings

KERNEL32.DLL, xrefs: 0005463A
ApplicationRecoveryFinished, xrefs: 00054661
ApplicationRecoveryInProgress, xrefs: 00054659

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AddressProc$Exception@8HandleModuleThrow
String ID: ApplicationRecoveryFinished$ApplicationRecoveryInProgress$KERNEL32.DLL
API String ID: 2144170044-4287352451
Opcode ID: 00113f46aa40e36ac4d414d10da782a8a68569c9c080c382dc72a9eb85e8dad7
Instruction ID: cf1e389cdb09af6bd0a8e3944fe12a6e259d9516ac8d12dd03a2fec1de43abb9
Opcode Fuzzy Hash: 00113f46aa40e36ac4d414d10da782a8a68569c9c080c382dc72a9eb85e8dad7
Instruction Fuzzy Hash: 5A01B132A00619AFD7109BB29C48BBF77E8DFC6766F110069E901A3200EBB0DD8586A1

Function 000545C4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 000545D1
GetProcAddress.KERNEL32(00000000,RegisterApplicationRestart), ref: 000545EE
GetProcAddress.KERNEL32(00000000,RegisterApplicationRecoveryCallback), ref: 000545F8

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Strings

KERNEL32.DLL, xrefs: 000545CC
RegisterApplicationRestart, xrefs: 000545E8
RegisterApplicationRecoveryCallback, xrefs: 000545F0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AddressProc$Exception@8HandleModuleThrow
String ID: KERNEL32.DLL$RegisterApplicationRecoveryCallback$RegisterApplicationRestart
API String ID: 2144170044-723216104
Opcode ID: 341841fc8da7a4300e5ba6873a7d0a5c499012a2be21253bec1ef893c9982c9a
Instruction ID: 5f475bf6a64b2437be1f08665d880508e475f72e95c10d5f7c2dacdc4336a29d
Opcode Fuzzy Hash: 341841fc8da7a4300e5ba6873a7d0a5c499012a2be21253bec1ef893c9982c9a
Instruction Fuzzy Hash: E7F0683670421AB78F615EA59C00DFB3ED9DF95797F014025FD0092111DBB1CC699AE2

Function 0316A860 Relevance: 10.5, APIs: 7, Instructions: 42filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?,0316A9C5,?,?,?,?,74DEE010,74DF23A0), ref: 0316A86D
CreateFileW.KERNEL32(031921E8,40000000,00000002,00000000,00000004,00000080,00000000,?,?,0316A9C5,?,?,?,?,74DEE010,74DF23A0), ref: 0316A88A
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0316A8A0
lstrlenW.KERNEL32(?,00000000,00000000), ref: 0316A8AD
WriteFile.KERNEL32(00000000,?,00000000), ref: 0316A8B8
CloseHandle.KERNEL32(00000000), ref: 0316A8BF
ReleaseMutex.KERNEL32(?), ref: 0316A8CC

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: 6643acfb8d327421ea63d5a9e68a6d78452d08e808b67dd045c89225a3db6aa6
Instruction ID: 584cfd0440d88a7b3b21121da5ba8a3372add3559c7d1035486787e079fe2069
Opcode Fuzzy Hash: 6643acfb8d327421ea63d5a9e68a6d78452d08e808b67dd045c89225a3db6aa6
Instruction Fuzzy Hash: 01F04FB1240205BBE618AB96FC0EFAA3B6CEB5DB11F114205F711A61C4DFB0294187B9

Function 031744B7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,03189218,00000008,031745BF,00000000,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C), ref: 031744C8
__lock.LIBCMT ref: 031744FC

Part of subcall function 0317B9EB: __mtinitlocknum.LIBCMT ref: 0317BA01
Part of subcall function 0317B9EB: __amsg_exit.LIBCMT ref: 0317BA0D
Part of subcall function 0317B9EB: EnterCriticalSection.KERNEL32(00000000,00000000,?,0317468F,0000000D,03189240,00000008,03174786,00000000,?,03172A68,00000000,031891B8,00000008,03172ACD,?), ref: 0317BA15

InterlockedIncrement.KERNEL32(?), ref: 03174509
__lock.LIBCMT ref: 0317451D
___addlocaleref.LIBCMT ref: 0317453B

Strings

KERNEL32.DLL, xrefs: 031744C3

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 50ddd279f5533ded63aa385e2b375fc424bf2812927833e06b965edfb60d6540
Instruction ID: 35d97d0bec02a4ecbd3b295109c9f9fbfdeedc21fc73d54d649b5b08b513cf03
Opcode Fuzzy Hash: 50ddd279f5533ded63aa385e2b375fc424bf2812927833e06b965edfb60d6540
Instruction Fuzzy Hash: 3D01C076400B00DFD720EF6AD844349FBF0AF5C710F148A0DE0A6AA2A0CFB4A640CF69

Function 000687C3 Relevance: 10.5, APIs: 7, Instructions: 30COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 000687D1
GetSysColor.USER32(00000010), ref: 000687D8
GetSysColor.USER32(00000014), ref: 000687DF
GetSysColor.USER32(00000012), ref: 000687E6
GetSysColor.USER32(00000006), ref: 000687ED
GetSysColorBrush.USER32(0000000F), ref: 000687FA
GetSysColorBrush.USER32(00000006), ref: 00068801

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: f26ee33af87438ed8774d9804e42c765e1d013275a862c6043c5811abd0ee0fc
Instruction ID: ff4caf3b49b29343a887a721efb98e55e341c12999c8ecbe61e6389d52d11790
Opcode Fuzzy Hash: f26ee33af87438ed8774d9804e42c765e1d013275a862c6043c5811abd0ee0fc
Instruction Fuzzy Hash: 7AF0FE719407485BD730BBB65D09B57BAD1FFC4710F02092EE2858B990D6B6E441DF40

Function 0317806F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03178090

Part of subcall function 031745E4: __getptd_noexit.LIBCMT ref: 031745E7
Part of subcall function 031745E4: __amsg_exit.LIBCMT ref: 031745F4

__getptd.LIBCMT ref: 031780A1
__getptd.LIBCMT ref: 031780AF

Strings

MOC, xrefs: 03178082
RCC, xrefs: 0317807B
csm, xrefs: 03178089

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 7e3bf4b765b8d53e2a5d32d05a4cce22e9951bf9490a18b9bfdbb2a344a06d31
Instruction ID: 4b14a04ae0533f08da18b8082a2acbcf9ddd6f23b5c36b1cace0973db69fbb14
Opcode Fuzzy Hash: 7e3bf4b765b8d53e2a5d32d05a4cce22e9951bf9490a18b9bfdbb2a344a06d31
Instruction Fuzzy Hash: A8E01A381403148FC720EB79C44EB6876F5BF4D214F1E41E2D50DCF222CB28E5908943

Function 000B4603 Relevance: 9.5, APIs: 6, Instructions: 469COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000B460D
GetObjectW.GDI32(?,00000018,?), ref: 000B46C0
DeleteObject.GDI32(?), ref: 000B478C
_memset.LIBCMT ref: 000B497B
_memset.LIBCMT ref: 000B49BF
DeleteObject.GDI32(?), ref: 000B4B75

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Object$Delete_memset$H_prolog3
String ID:
API String ID: 1235337548-0
Opcode ID: ac226aea46e3486ff346366f25606341e5adc9d701a2a5ce8dce66eeebc4c680
Instruction ID: 62d931e8a973264cda500cebf7905710ed5ccdf25b44268b65d8de199583c74f
Opcode Fuzzy Hash: ac226aea46e3486ff346366f25606341e5adc9d701a2a5ce8dce66eeebc4c680
Instruction Fuzzy Hash: 5B126AB0D00229DFCF25DFA4C984AEDBBB5FF09700F10819AE559A7252DB709A94CF94

Function 000707E8 Relevance: 9.3, APIs: 6, Instructions: 299COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00070862
GetClientRect.USER32(?,?), ref: 00070875
GetWindowRect.USER32(?,?), ref: 000708C3
GetParent.USER32(?), ref: 000708CC
GetParent.USER32(?), ref: 00070AE9
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 00070B0D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Parent$RectWindow$ClientRedraw
String ID:
API String ID: 443302174-0
Opcode ID: d71c7ed124f454bc98d91e5ac904e84b7905faddd218db3c8b35c2371784b412
Instruction ID: a2f072d6567e8ef3be056930e8754f6a668f6bdfc3c4e25b1fb8e3c7fd5a24a4
Opcode Fuzzy Hash: d71c7ed124f454bc98d91e5ac904e84b7905faddd218db3c8b35c2371784b412
Instruction Fuzzy Hash: 1AB11871E00219EFCF15DFA8C8989EEBBB5FF48710F148269E40AEB255DB349940CB55

Function 0009A2AE Relevance: 9.2, APIs: 6, Instructions: 221COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0009A2E0

Part of subcall function 000627E2: GetWindowLongW.USER32(?,000000EC), ref: 000627ED

GetWindowRect.USER32(?,?), ref: 0009A3DB
GetParent.USER32(?), ref: 0009A3E8
GetParent.USER32(?), ref: 0009A402
OffsetRect.USER32(?,?,?), ref: 0009A4CF
OffsetRect.USER32(?,?,?), ref: 0009A4DB

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$OffsetParent$Long
String ID:
API String ID: 2171155602-0
Opcode ID: f4eb6331553b30abb64d9b19dc468c69950db347795b6119d076ffbf33fe3fa1
Instruction ID: 28cfc639055b6f97ab2a560c9e9a755e4d8dc78a34183bef05882cfaf2dd9d27
Opcode Fuzzy Hash: f4eb6331553b30abb64d9b19dc468c69950db347795b6119d076ffbf33fe3fa1
Instruction Fuzzy Hash: 0891D171E00209EFCF15DFA8C988AEEBBF5FF88300F10416AE905A7251D7746A40DBA1

Function 000A2223 Relevance: 9.2, APIs: 6, Instructions: 177windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000A222A
GetClientRect.USER32(?,?), ref: 000A2270

Part of subcall function 00059FE9: __EH_prolog3.LIBCMT ref: 00059FF0
Part of subcall function 00059FE9: GetDC.USER32(00000000), ref: 0005A01C

Part of subcall function 0005A336: SelectObject.GDI32(?,00000000), ref: 0005A35C
Part of subcall function 0005A336: SelectObject.GDI32(?,?), ref: 0005A372

SendMessageW.USER32(?,00000030,?,00000000), ref: 000A22C1
GetTextMetricsW.GDI32(?,?), ref: 000A22CE
GetParent.USER32(?), ref: 000A23B3
SendMessageW.USER32(?,00000030,?,00000000), ref: 000A23DE

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageObjectSelectSend$ClientH_prolog3H_prolog3_MetricsParentRectText
String ID:
API String ID: 1207058154-0
Opcode ID: b93975f9a9cf983f373bb8f729f9aff5bcc77e7072533c02ad0f2086397e8317
Instruction ID: ce880106e54533342a19aab425718e7d632cf705df3cfd883dd41dd86ae4fd54
Opcode Fuzzy Hash: b93975f9a9cf983f373bb8f729f9aff5bcc77e7072533c02ad0f2086397e8317
Instruction Fuzzy Hash: B3518E72A002159FDF25DFA8CC84AEE77B6BF49300F054539ED0AAB256DB31AD41CB60

Function 0007226D Relevance: 9.2, APIs: 6, Instructions: 155windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 000722E6
SendMessageW.USER32(00000000,0000040C,00000000,00000000), ref: 00072325
SendMessageW.USER32(00000000,0000041C,00000000,?), ref: 00072354
SetRectEmpty.USER32(?), ref: 000723AE
SendMessageW.USER32(00000000,0000040B,00000000,?), ref: 00072414
RedrawWindow.USER32(00000000,00000000,00000000,00000505), ref: 0007243A

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$EmptyParentRectRedrawWindow
String ID:
API String ID: 3879113052-0
Opcode ID: c7430a69a5151ccd22af1ed3a582cd2c42df9996ce5965991199538ddc91d657
Instruction ID: bdf743d75fa402d21b1300a2c05a21849f18b98da7439ea2aa911ea68b76135a
Opcode Fuzzy Hash: c7430a69a5151ccd22af1ed3a582cd2c42df9996ce5965991199538ddc91d657
Instruction Fuzzy Hash: 4D514A71E006099FDB64DFA8C884BADBBF5FF48700F20416AE54AE7292EB749940CF54

Function 000581F5 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 000581FC
GlobalLock.KERNEL32(?), ref: 000582E2
CreateDialogIndirectParamW.USER32(?,?,?,00057BD4,00000000), ref: 00058311
DestroyWindow.USER32(00000000), ref: 0005838B
GlobalUnlock.KERNEL32(?), ref: 0005839B
GlobalFree.KERNEL32(?), ref: 000583A4

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Global$CreateDestroyDialogFreeH_prolog3_catchIndirectLockParamUnlockWindow
String ID:
API String ID: 3003189058-0
Opcode ID: 9ca625ed2aa391a34c225bd478234f17d90d093800b4c875570b8fad0c0fff66
Instruction ID: bab440d5080023368259c884ddb42ccc5bcec3d105f2a9126206f70910a6c046
Opcode Fuzzy Hash: 9ca625ed2aa391a34c225bd478234f17d90d093800b4c875570b8fad0c0fff66
Instruction Fuzzy Hash: 40516A31900249DFCF14EFA4C8859FE7BB5AF44712F144429F942A7292DF709A49CB61

Function 000A6166 Relevance: 9.1, APIs: 6, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 000A61C5
SendMessageW.USER32(?,0000120C,00000000,00000001), ref: 000A6207
SendMessageW.USER32(?,0000120C,00000001,00000001), ref: 000A6229
SendMessageW.USER32(?,00000201,00000000,00000000), ref: 000A62A3
SendMessageW.USER32(?,00000202,00000000,00000000), ref: 000A62BB
PtInRect.USER32(?,?,?), ref: 000A62D7

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Rect$Client
String ID:
API String ID: 4194289498-0
Opcode ID: 6a83a47cb88c31feecc14d9acf77ff6bb5823640872c4a887291d0cce941995e
Instruction ID: c4db8c2e985b29b0fba6d810ff6a8208a29500bfaa1b94e4f5bc9b346e891100
Opcode Fuzzy Hash: 6a83a47cb88c31feecc14d9acf77ff6bb5823640872c4a887291d0cce941995e
Instruction Fuzzy Hash: C8514F71500619DFCB11DFA4C988EEE7BB9FF4A700F1901B9F8099B255C771A941CBA0

Function 000D4767 Relevance: 9.1, APIs: 6, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 000D4829
GetCursorPos.USER32(00000000), ref: 000D4849
ScreenToClient.USER32(00000000,00000000), ref: 000D4856
PtInRect.USER32(?,00000000,00000000), ref: 000D4869
SendMessageW.USER32(?,00000000,001E1DC4), ref: 000D489F
SendMessageW.USER32(00000000,00000000,001E1DC4), ref: 000D48B8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$ClientCursorParentRectScreen
String ID:
API String ID: 4164469669-0
Opcode ID: e2b3f6c88eaa88471d4ce95a6cee4abe989d5f6dbcc5457d8186e1fc4df6149a
Instruction ID: f8287866ca53178bbaf6856962038373739481804e0d4c00bebc2a94afa9a886
Opcode Fuzzy Hash: e2b3f6c88eaa88471d4ce95a6cee4abe989d5f6dbcc5457d8186e1fc4df6149a
Instruction Fuzzy Hash: 7E41BF31A00285AFDB549FA5DC88FAE7BF9BF44345F00446AF846D72A1DB709944DB60

Function 03166520 Relevance: 9.1, APIs: 6, Instructions: 107COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0316652F

Part of subcall function 03171DDE: __FF_MSGBANNER.LIBCMT ref: 03171DF7
Part of subcall function 03171DDE: __NMSG_WRITE.LIBCMT ref: 03171DFE
Part of subcall function 03171DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171E23

_free.LIBCMT ref: 03166553
_memset.LIBCMT ref: 031665AB

Part of subcall function 03166EB0: GetObjectW.GDI32(?,00000054,?), ref: 03166ECD

CreateDIBSection.GDI32(00000000,00000008,00000000,00000000,00000000,00000000), ref: 031665C3
_free.LIBCMT ref: 031665D4
_free.LIBCMT ref: 03166613

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _free$AllocateCreateHeapObjectSection_malloc_memset
String ID:
API String ID: 1756752955-0
Opcode ID: 6be2f8196aaa49e37d8302e7929ef9d0bef8df717d7ab91ad7a705cb939331e1
Instruction ID: 18261ad1e0bef7f43c178208db7c5b928735aeb8797ba0211e418e52362b03ed
Opcode Fuzzy Hash: 6be2f8196aaa49e37d8302e7929ef9d0bef8df717d7ab91ad7a705cb939331e1
Instruction Fuzzy Hash: B131B6B26003056BE710DFA9D981756B7E8BF4C350F08453ADA09CB641FBB1E564CBD5

Function 000F272C Relevance: 9.1, APIs: 6, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000F2733
GetTopWindow.USER32(?), ref: 000F279E
GetWindow.USER32(?,00000002), ref: 000F27BC
IsWindow.USER32(?), ref: 000F27DB
GetParent.USER32(?), ref: 000F27E6
DestroyWindow.USER32(?), ref: 000F27F2

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$DestroyException@8H_prolog3ParentThrow
String ID:
API String ID: 3731540811-0
Opcode ID: 472223130eb20d47db564f35b991cbb003b06be333df32ad0f5ebba5296a5831
Instruction ID: 787f3f58af7a825abcb9d6ff1f0ddf5da916d7140f0fd418816b1d906c7f383d
Opcode Fuzzy Hash: 472223130eb20d47db564f35b991cbb003b06be333df32ad0f5ebba5296a5831
Instruction Fuzzy Hash: A841BC709042189BCF21EFA8C9859BDFBF1BF58710F250159E895B76A2DB705D40AB90

Function 0316C6E0 Relevance: 9.1, APIs: 6, Instructions: 99networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 0316C6FD
WSAAddressToStringW.WS2_32(?,-0000001D,00000000,?,?), ref: 0316C721
htons.WS2_32(?), ref: 0316C73E
StrPBrkW.SHLWAPI(?,03184AF8), ref: 0316C763
StrChrW.SHLWAPI(?,00000025), ref: 0316C76E
_memmove.LIBCMT ref: 0316C79D

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: htons$AddressString_memmove
String ID:
API String ID: 2092185379-0
Opcode ID: 11d81c26f06f71811fe72914b17383e77b209a3655f8701f9b6c36eeabd4b78a
Instruction ID: 6c7303466c0409820722ce4ecf3691c1e6167d6541c6e21ce0722703318d7379
Opcode Fuzzy Hash: 11d81c26f06f71811fe72914b17383e77b209a3655f8701f9b6c36eeabd4b78a
Instruction Fuzzy Hash: 5E2106B62012169BD714DF78EC80A6B73ACEF8C714B19801AFC8597380EB70D890C7E0

Function 00076AD4 Relevance: 9.1, APIs: 6, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00076B05
OffsetRect.USER32(?,?,?), ref: 00076B23
SendMessageW.USER32(00000000,0000000B,00000000,00000000), ref: 00076B30
IsWindowVisible.USER32(?), ref: 00076B39
SendMessageW.USER32(00000014,0000000B,00000001,00000000), ref: 00076BAC
RedrawWindow.USER32(00000105,00000000,00000000,00000105), ref: 00076BBC

Part of subcall function 000629B1: SetWindowPos.USER32(?,000000FF,000000FF,?,?,00000000,0005E834,?,0005E834,00000000,?,?,000000FF,000000FF,00000015), ref: 000629D9

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$MessageRectSend$OffsetRedrawVisible
String ID:
API String ID: 2707749077-0
Opcode ID: 493d3bb61803c59df33cb968013296d89954bee791c1f0a83ae8c006e99362e6
Instruction ID: d0b935117acacd7d237eb483b54472a86f02e6f39efce08b075da0559e801f4b
Opcode Fuzzy Hash: 493d3bb61803c59df33cb968013296d89954bee791c1f0a83ae8c006e99362e6
Instruction Fuzzy Hash: 99311EB2A00609BFEB11DFA4CD85EBFBBB9FB49300F100519F556E22A1D771AD409B60

Function 031630E0 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0316310C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 03163118
Process32FirstW.KERNEL32(00000000,00000000), ref: 03163149
Process32NextW.KERNEL32(00000000,0000022C), ref: 0316319F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 031631A6

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: f57cd794e69e0ac01e5b7aade2dd93f0d14ead6033917e2766a5cc3a3fa04c0f
Instruction ID: 95f4f2caf8c40e563e616f7294ce19ab0007a9c1e4d42699c7c9a7104d53b5da
Opcode Fuzzy Hash: f57cd794e69e0ac01e5b7aade2dd93f0d14ead6033917e2766a5cc3a3fa04c0f
Instruction Fuzzy Hash: 75210735604115ABDB24FFB4EC55BEAB3B9EF1C320F0506A9D81A861C0EF319A50C7A0

Function 000B213D Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

PatBlt.GDI32(00000000,00000000,00093862,000000C6,00FF0062,00000000), ref: 000B2164
SetBkColor.GDI32(00F0F0F0), ref: 000B2187
BitBlt.GDI32(00000000,00000000,00093864,000000C8,00000000,00000000,00CC0020), ref: 000B21B5
SetBkColor.GDI32 ref: 000B21C8
BitBlt.GDI32(00000000,00000000,00093864,000000C8,00000000,00000000,00EE0086), ref: 000B21F0
BitBlt.GDI32(07010E96,00000001,00000001,00093865,000000C9,07010E96,00000000,00000000,008800C6), ref: 000B2213

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Color
String ID:
API String ID: 2811717613-0
Opcode ID: 2c517eb3cf50a69594abbde51eab1a7fcb8a3e00f1e7b4d88c104ade30f93076
Instruction ID: 0fc1bdf323c76141f571b98e92b426f4b4b68cf3c81be8d3cc345e434bb7b3bf
Opcode Fuzzy Hash: 2c517eb3cf50a69594abbde51eab1a7fcb8a3e00f1e7b4d88c104ade30f93076
Instruction Fuzzy Hash: 4B211DB6201648FFD7249F94EDC5D7B77AEFB883987004529F642879A0C7B1AC90DB60

Function 0316BEC0 Relevance: 9.1, APIs: 6, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,76CB4AAF), ref: 0316BF16
SetLastError.KERNEL32(00000000), ref: 0316BF24
DeleteCriticalSection.KERNEL32(?), ref: 0316BF4E
DeleteCriticalSection.KERNEL32(?), ref: 0316BF54
CloseHandle.KERNEL32(?), ref: 0316BF67
_free.LIBCMT ref: 0316BF8A

Part of subcall function 0316F2F0: GetCurrentThreadId.KERNEL32 ref: 0316F2F4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalDeleteSection$CloseCurrentErrorHandleLastObjectSingleThreadWait_free
String ID:
API String ID: 2652704522-0
Opcode ID: 73341f51b35347dfadade39ca8443265b144f15d89659d3087b3f01c9611a3c6
Instruction ID: 7c178a20091a93dcfc19918a4d278f3f983945e596961807057bc25ef2a00f94
Opcode Fuzzy Hash: 73341f51b35347dfadade39ca8443265b144f15d89659d3087b3f01c9611a3c6
Instruction Fuzzy Hash: 4B31AEB15093469BCB10EFEAD880A9AFBE8EB1D310F14496DE456E7240DB34A9148B60

Function 000AC613 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000AC61A

Part of subcall function 00062946: IsWindowEnabled.USER32(?), ref: 0006294F

InvalidateRect.USER32(?,00000000,00000001,0000000C,000AC72F), ref: 000AC646
UpdateWindow.USER32(?), ref: 000AC64F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$EnabledH_prolog3InvalidateRectUpdate
String ID:
API String ID: 262192325-0
Opcode ID: 80b1d60d03518d565d5243cc3f104939a9ab264202c53d3cc2ed25623c1d329d
Instruction ID: 4af74dabed22cf9f87cda5ad6f75c5c2319dd3acd5c39d020dd22160d1977134
Opcode Fuzzy Hash: 80b1d60d03518d565d5243cc3f104939a9ab264202c53d3cc2ed25623c1d329d
Instruction Fuzzy Hash: 62216B71900A45AFC721EBB4CD85EAFBBF9FF89311F100619F196922A2DB306901DF61

Function 000EC4A6 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000EC4AD
GetDesktopWindow.USER32 ref: 000EC4BB

Part of subcall function 0005A078: __EH_prolog3.LIBCMT ref: 0005A07F
Part of subcall function 0005A078: GetWindowDC.USER32(00000000,00000004,00067938,00000000,?,?,00178F40), ref: 0005A0AB

SetRectEmpty.USER32(?), ref: 000EC4F2
SetRectEmpty.USER32(?), ref: 000EC504
CopyRect.USER32(?,?), ref: 000EC50F
CopyRect.USER32(?,?), ref: 000EC52B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$CopyEmptyWindow$DesktopH_prolog3H_prolog3_
String ID:
API String ID: 2526268198-0
Opcode ID: 7ba45a5cd2ab7a4eae12e995877839691a26a949961411a861023d6bc6e0d892
Instruction ID: 38792ba7b663fbdf04eac2c5deeccc13e700263ea51a3ce0f244d04f0bb00f82
Opcode Fuzzy Hash: 7ba45a5cd2ab7a4eae12e995877839691a26a949961411a861023d6bc6e0d892
Instruction Fuzzy Hash: 7921B0B2C0165DAACF01DFE4CC849EEBBB9FF08311B14012AEA05BB151D7756A4ACF60

Function 000567B0 Relevance: 9.1, APIs: 6, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(00000000,?), ref: 000567D8
RegDeleteValueW.ADVAPI32(00000000,?), ref: 000567F7
RegCloseKey.ADVAPI32(00000000), ref: 00056824

Part of subcall function 000565A3: RegCloseKey.ADVAPI32(?), ref: 00056648
Part of subcall function 000565A3: RegCloseKey.ADVAPI32(?), ref: 00056652

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0005683F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Close$Delete$PrivateProfileStringValueWrite
String ID:
API String ID: 1330817964-0
Opcode ID: 46e780ccf34192b47b60d29841c1c67d070af9f602eb2891597cd9e04ea4b06d
Instruction ID: 31043e469ab37f871e4c7312c6c28c1e3f2c1a53835247b18a406671c5ecf176
Opcode Fuzzy Hash: 46e780ccf34192b47b60d29841c1c67d070af9f602eb2891597cd9e04ea4b06d
Instruction Fuzzy Hash: FD118F36004159FFCF212FA0CC888BF7BA9FF0835AB418535FA1586420DB738955EBA0

Function 03178321 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 03178349

Part of subcall function 03172F2B: __getptd.LIBCMT ref: 03172F39
Part of subcall function 03172F2B: __getptd.LIBCMT ref: 03172F47

__getptd.LIBCMT ref: 03178353

Part of subcall function 031745E4: __getptd_noexit.LIBCMT ref: 031745E7
Part of subcall function 031745E4: __amsg_exit.LIBCMT ref: 031745F4

__getptd.LIBCMT ref: 03178361
__getptd.LIBCMT ref: 0317836F
__getptd.LIBCMT ref: 0317837A
_CallCatchBlock2.LIBCMT ref: 031783A0

Part of subcall function 03172FD0: __CallSettingFrame@12.LIBCMT ref: 0317301C

Part of subcall function 03178447: __getptd.LIBCMT ref: 03178456
Part of subcall function 03178447: __getptd.LIBCMT ref: 03178464

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 112d8a5a62e35e169d6cfda7e28f48ea5119242509fb4cf327e20527b96782f7
Instruction ID: 4959d3ae215bb4f3598e80bbdee12729772731f82ad5a8cd4eb1e76d6d01c9da
Opcode Fuzzy Hash: 112d8a5a62e35e169d6cfda7e28f48ea5119242509fb4cf327e20527b96782f7
Instruction Fuzzy Hash: 9411B479800349DFDF00EFA5D845BADBBB0FB08314F15846AE814AB250DB789A51DF50

Function 03176E26 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03176E32

Part of subcall function 031745E4: __getptd_noexit.LIBCMT ref: 031745E7
Part of subcall function 031745E4: __amsg_exit.LIBCMT ref: 031745F4

__amsg_exit.LIBCMT ref: 03176E52
__lock.LIBCMT ref: 03176E62
InterlockedDecrement.KERNEL32(?), ref: 03176E7F
_free.LIBCMT ref: 03176E92
InterlockedIncrement.KERNEL32(03341658), ref: 03176EAA

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 9ddf99a109e9ec10ba055750492c872e6971131f2a9ad7d8177e75daa009fcf8
Instruction ID: a33e52bd8ecacd27ec17643679f7c98b8308071abbe5e5eb8456688e0bde4c5c
Opcode Fuzzy Hash: 9ddf99a109e9ec10ba055750492c872e6971131f2a9ad7d8177e75daa009fcf8
Instruction Fuzzy Hash: 36015B36910B22ABDA25EF66D444B5EB7B0AF0CB11F1D0115E814AB284CF24A991CBF5

Function 0007A343 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 000627E2: GetWindowLongW.USER32(?,000000EC), ref: 000627ED

GetClientRect.USER32(?,?), ref: 0007A46E
GetAsyncKeyState.USER32(00000011), ref: 0007A514

Strings

', xrefs: 0007A3BF

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AsyncClientLongRectStateWindow
String ID: '
API String ID: 304971295-1997036262
Opcode ID: 2c025c12271faac563744868fe7ba0d254234df2172bd17e779fc276c177b3da
Instruction ID: 71f12c55e27fdd62de0552ab4d3937a867dbaf2f9a4f95e0a2fc3d49ee27ab30
Opcode Fuzzy Hash: 2c025c12271faac563744868fe7ba0d254234df2172bd17e779fc276c177b3da
Instruction Fuzzy Hash: 61B18470F006068BCB699F64C498BBE77E1BF85301F14816DE54ED7291DB789D80CB9A

Function 03166490 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 031664C2
EnterCriticalSection.KERNEL32(03191D64,?,?,?,0316646B), ref: 031664D3
EnterCriticalSection.KERNEL32(03191D64,?,?,?,0316646B), ref: 031664E8
GdiplusShutdown.GDIPLUS(00000000,?,?,?,0316646B), ref: 031664F4
LeaveCriticalSection.KERNEL32(03191D64,?,?,?,0316646B), ref: 03166505
LeaveCriticalSection.KERNEL32(03191D64,?,?,?,0316646B), ref: 0316650C

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 150fea838f43354f32334feec145269c27d7de22fce9c18de663e188f3997643
Instruction ID: 460d598324029ad67db3f30c1136eea7a0a62805452b46d1b10e73bc257dd25a
Opcode Fuzzy Hash: 150fea838f43354f32334feec145269c27d7de22fce9c18de663e188f3997643
Instruction Fuzzy Hash: 6801C8B1900216AFDB18EFAADC88445BBE4BF4D35536485BFE518D6206CB72D483CFA4

Function 03161EC0 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 03161ED0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 03161ED8
CloseHandle.KERNEL32(?), ref: 03161EE4
Sleep.KERNEL32(000003E8), ref: 03161EEB
CloseHandle.KERNEL32(?), ref: 03161F16
CloseHandle.KERNEL32(?), ref: 03161F1C

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CloseHandle$ObjectSingleWait$Sleep
String ID:
API String ID: 349258274-0
Opcode ID: 4a8050f274acb2e22844ed0c9648435d772b62aa2ed3523e2bc3c0e6525ed53c
Instruction ID: ca3bcb503dbe7329d9f1c36db4726235e9a933e6f1a705f76783011abe62248f
Opcode Fuzzy Hash: 4a8050f274acb2e22844ed0c9648435d772b62aa2ed3523e2bc3c0e6525ed53c
Instruction Fuzzy Hash: A8F019352046059BC228EBAADD84C16F3EAEFC93243268A09E556837A4CE70F841CA60

Function 000A4220 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143memorywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000A422A
_memset.LIBCMT ref: 000A4292
GlobalAlloc.KERNEL32(00000040,0000000C), ref: 000A42AB
SendMessageW.USER32 ref: 000A4394

Strings

g, xrefs: 000A429D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AllocGlobalH_prolog3MessageSend_memset
String ID: g
API String ID: 653267268-30677878
Opcode ID: dc78f86d0c11f9f7c01631e04c7e21bb759e0077eb915275f452bc3ceb1374f3
Instruction ID: cceff224730c20da26b314782674f0d3ebb682890425f1badf1630ed4923d3d7
Opcode Fuzzy Hash: dc78f86d0c11f9f7c01631e04c7e21bb759e0077eb915275f452bc3ceb1374f3
Instruction Fuzzy Hash: EC512771A002199FDB04CFA4CC89BEEBBB4BF49300F144558FA15EB291DBB4AA45CF60

Function 03163720 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0316372B
CoCreateInstance.OLE32(03186F9C,00000000,00000001,03186FDC,?,?,?,?,?,?,?,?,?,?,031627A0,00000000), ref: 03163742
SysFreeString.OLEAUT32(?), ref: 031637DC
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,031627A0,00000000,00000000,?), ref: 0316380D

Strings

FriendlyName, xrefs: 031637CB

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: 8488a416408f0284fc763f7b7fe2da8cb642d1746d82f251406c820991ec0bb4
Instruction ID: 96c6498658a70221d49c619fef8f9c798f33a676d70988a299302e5061b84876
Opcode Fuzzy Hash: 8488a416408f0284fc763f7b7fe2da8cb642d1746d82f251406c820991ec0bb4
Instruction Fuzzy Hash: 43312C7970020AAFDB00EB99DC80EAEB7B9EFCC705F148594E615EB255DB71E901CB60

Function 03166000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03166016

Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 03182857
Part of subcall function 03182842: __CxxThrowException@8.LIBCMT ref: 0318286C
Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 0318287D

std::_Xinvalid_argument.LIBCPMT ref: 0316604D

Part of subcall function 031827F5: std::exception::exception.LIBCMT ref: 0318280A
Part of subcall function 031827F5: __CxxThrowException@8.LIBCMT ref: 0318281F
Part of subcall function 031827F5: std::exception::exception.LIBCMT ref: 03182830

_memmove.LIBCMT ref: 031660AB

Strings

string too long, xrefs: 03166048
invalid string position, xrefs: 03166011

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: e3ed5d508a69cb4a711e7582271580f5b0d5eef1ad48b47de61bb82cf3cf563c
Instruction ID: 26c045690148c3126e179d22f057c2053425018047c48168bf1bca4e46fa3754
Opcode Fuzzy Hash: e3ed5d508a69cb4a711e7582271580f5b0d5eef1ad48b47de61bb82cf3cf563c
Instruction Fuzzy Hash: 6121E532700A508BC721DAECE850A6AF7E9DFA9661F24093FE152CB241C772D860C7E5

Function 00092296 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0009229D
InflateRect.USER32(?,00000005,00000005), ref: 000922D3
Ellipse.GDI32(?,?,?,?,?), ref: 0009237E

Strings

mmm, xrefs: 00092335, 0009233C
Gu,, xrefs: 0009230F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EllipseH_prolog3_InflateRect
String ID: Gu,$mmm
API String ID: 3279685039-3474039531
Opcode ID: e92ee96a73b4986a9d8f837184954688a276114ec46a7bbaf00ada8ce30fa926
Instruction ID: fea61cf3dfc3fed8c98d720f29ee1ee113a697918a72498352cc5161427bc801
Opcode Fuzzy Hash: e92ee96a73b4986a9d8f837184954688a276114ec46a7bbaf00ada8ce30fa926
Instruction Fuzzy Hash: 31316871A01208EFCF15DFA8CC869EE7BB5EB48310F50812AE502A72A2DB349A55DF51

Function 03170860 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 031708B8
std::exception::exception.LIBCMT ref: 031708DA
__CxxThrowException@8.LIBCMT ref: 031708EF
_memmove.LIBCMT ref: 03170914

Strings

bad allocation, xrefs: 031708D3

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Exception@8Throw_free_memmovestd::exception::exception
String ID: bad allocation
API String ID: 3887469428-2104205924
Opcode ID: 3fa670309c841ec6a5f3e810d3b8d09d48053d5081984a1ba1e9e2096892ba4c
Instruction ID: 2be2487df84056843935e3822bab90c803cb3cabf09f86629ba5d8721be685e3
Opcode Fuzzy Hash: 3fa670309c841ec6a5f3e810d3b8d09d48053d5081984a1ba1e9e2096892ba4c
Instruction Fuzzy Hash: D6214176E003056FD720DF69D8809AAB3F9AF8C650B1C883ED95ADB200EB70E544CB91

Function 031650B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 031650C8

Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 03182857
Part of subcall function 03182842: __CxxThrowException@8.LIBCMT ref: 0318286C
Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 0318287D

std::_Xinvalid_argument.LIBCPMT ref: 031650E6
_memmove.LIBCMT ref: 0316512A

Strings

string too long, xrefs: 031650E1
invalid string position, xrefs: 031650C3

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 6c36b38503c588c2df25e7a8357cd86fb09621801c5d50f80f8fdac03c2dada2
Instruction ID: e93f1739035155f4d43e6d2ae7bb3889712500f5cc8913efaed8015073746bcd
Opcode Fuzzy Hash: 6c36b38503c588c2df25e7a8357cd86fb09621801c5d50f80f8fdac03c2dada2
Instruction Fuzzy Hash: 7F11B1367043059FCB14EFACD890859B3AABF4E2147144669E516CF241EB70E965CBD4

Function 00086BD8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(DWMAPI), ref: 00086C02
GetProcAddress.KERNEL32(00000000,DwmSetIconicThumbnail), ref: 00086C12
DeleteObject.GDI32(00000000), ref: 00086C4C

Strings

DWMAPI, xrefs: 00086BF7
DwmSetIconicThumbnail, xrefs: 00086C0C

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AddressDeleteHandleModuleObjectProc
String ID: DWMAPI$DwmSetIconicThumbnail
API String ID: 3128169092-3761315311
Opcode ID: 2764ac7bb6f20d7e2d10afd4f883eb5de11d234cdead74cd71be038e7c606e01
Instruction ID: ea46cc44b94d11b2bbab64a2b6067752a7dc2999880aa6ebfa859e7dbe050342
Opcode Fuzzy Hash: 2764ac7bb6f20d7e2d10afd4f883eb5de11d234cdead74cd71be038e7c606e01
Instruction Fuzzy Hash: 0F01AD71600204BBDB10ABA5CC89ABE7BACFB44311F018026F98697241DFB5DD00CBA0

Function 031786CE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 031786E1

Part of subcall function 0317863C: ___BuildCatchObjectHelper.LIBCMT ref: 03178672

_UnwindNestedFrames.LIBCMT ref: 031786F8
___FrameUnwindToState.LIBCMT ref: 03178706

Strings

csm, xrefs: 031786DD, 031786F2, 03178705, 03178723, 03178733
csm, xrefs: 031786D0

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 70e7f1e7e7417e29130667b7bc4e10bd42c5920515d92642e36db963afaa9a6f
Instruction ID: 2f8953ed772e6817d6114b449449dd228a322a34dce86941bf9518d63456ea3b
Opcode Fuzzy Hash: 70e7f1e7e7417e29130667b7bc4e10bd42c5920515d92642e36db963afaa9a6f
Instruction Fuzzy Hash: 2D01E87500120ABBDF22AF51CD4AEAA7E7AFF1C394F084010BD1819160D772D9A2DBA5

Function 000C89DA Relevance: 7.8, APIs: 5, Instructions: 316COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000C8A41
GetWindowRect.USER32(?,?), ref: 000C8B19
InflateRect.USER32(?,00000000,?), ref: 000C8B3F
GetWindowRect.USER32(?,?), ref: 000C8BF4
GetWindowRect.USER32(?,?), ref: 000C8CFF

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$Inflate
String ID:
API String ID: 1123775244-0
Opcode ID: 3a3789b4ba1a812fd216932915cf0e1eb8391318004cdc9cfe4d3cd81776d0f9
Instruction ID: b801f20117d6c6be59219e187fd08557beb76c7d4625c7470d302e52cb0f3d54
Opcode Fuzzy Hash: 3a3789b4ba1a812fd216932915cf0e1eb8391318004cdc9cfe4d3cd81776d0f9
Instruction Fuzzy Hash: 35C1F671E0020AEFDB54DFA8C985EAEBBF5BF48300F14856EE515A7251DB30AE40CB65

Function 0009256E Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00092578
CreatePolygonRgn.GDI32(?,00000008,00000002), ref: 00092772
FillRect.USER32(00000002,?,?), ref: 000927E4
FillRect.USER32(00000002,?,0C100EB2), ref: 00092814
Polyline.GDI32(00000002,?,00000008), ref: 0009282B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: FillRect$CreateH_prolog3_PolygonPolyline
String ID:
API String ID: 3866795319-0
Opcode ID: c5d18991f8a03981f2f9edfa01e0c04133b2bd37e01be30dee11cff4daa6364a
Instruction ID: 1a7484b8d6e6ca56cd7587993b956072276bfe1c15c9d31d9169500f9ad6b238
Opcode Fuzzy Hash: c5d18991f8a03981f2f9edfa01e0c04133b2bd37e01be30dee11cff4daa6364a
Instruction Fuzzy Hash: 07A14A70E00219DFCF15DFA4C994AEEBBB5FF48300F14816AE91AAB252DB709A45DF50

Function 000E445E Relevance: 7.7, APIs: 5, Instructions: 226windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000E4465
CreateCompatibleDC.GDI32(?), ref: 000E4543
CreateCompatibleBitmap.GDI32(00000001,?,?), ref: 000E4577
SelectObject.GDI32(?,00000000), ref: 000E45D4
DeleteObject.GDI32(?), ref: 000E46DB

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreateObject$BitmapDeleteH_prolog3Select
String ID:
API String ID: 3587968642-0
Opcode ID: cf6245257e95709950a7049cf2d40007d3f95413d7c281ce1d9f97009d6210af
Instruction ID: 7efae3c26829aff6c5f64fe887fcaebf1f5b2639340aa61078e63f99a020fc56
Opcode Fuzzy Hash: cf6245257e95709950a7049cf2d40007d3f95413d7c281ce1d9f97009d6210af
Instruction Fuzzy Hash: 42A13671D0025ADFCF14CFA9C984AEEBBB5BF49304F14822AE815BB251D774AA45CF90

Function 000F827E Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(?), ref: 000F82A4
IsWindow.USER32(?), ref: 000F82CA
GetWindowRect.USER32(?,?), ref: 000F8325
CopyRect.USER32(?,?), ref: 000F8454
LockWindowUpdate.USER32(00000000,?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 000F8479

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$LockRectUpdate$Copy
String ID:
API String ID: 2992910783-0
Opcode ID: be6461968757a4006fd45781aa2b4483615194919a7e4feab5d831cad8fb07fe
Instruction ID: 9f2598c90d3f22d08d2823f5a17419ad911a4b171c7a569c36518396b22fcb6e
Opcode Fuzzy Hash: be6461968757a4006fd45781aa2b4483615194919a7e4feab5d831cad8fb07fe
Instruction Fuzzy Hash: AB71F874A00209AFCB15DFA9C898DEEBBF9EF89700F10446DF946A7251DB745A41CF60

Function 0007C0AC Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0007C0B3
IsWindow.USER32(?), ref: 0007C0D0
GetClientRect.USER32(?,?), ref: 0007C12F

Part of subcall function 0007342D: __EH_prolog3_GS.LIBCMT ref: 00073437
Part of subcall function 0007342D: GetClientRect.USER32(?,?), ref: 0007347E

Part of subcall function 000731B6: __EH_prolog3_GS.LIBCMT ref: 000731C0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3_$ClientRect$Window
String ID:
API String ID: 3149087086-0
Opcode ID: f31c3e22e5d2bb00cd32e7f0bad856f9330bb6b3ab6bf6b89cb9994a3141cbc6
Instruction ID: e433dc2a7a1b3ca59eb9fe25760685bf6d7c4aa0346cec17a285d5be3de9d5e3
Opcode Fuzzy Hash: f31c3e22e5d2bb00cd32e7f0bad856f9330bb6b3ab6bf6b89cb9994a3141cbc6
Instruction Fuzzy Hash: 9481F771E00209CFDF55DFA8C8809EDBBF5BF49300F64816AE809AB256DB34A945CF64

Function 0316CF10 Relevance: 7.7, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0316CFB8
_memmove.LIBCMT ref: 0316CFD4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f9262d88e3c1ebfb77188b87161fae1cf51faff3d2f6db47e1ab6ca63e422cad
Instruction ID: 152233ecce8b1e2759b2d2e08312b2758d69115ba651cfa32456a8d6c9df4ec5
Opcode Fuzzy Hash: f9262d88e3c1ebfb77188b87161fae1cf51faff3d2f6db47e1ab6ca63e422cad
Instruction Fuzzy Hash: FA617E75B01606AFCB18CFA9D980A9AB7F5BF4C300F14866DD85AC7700E770E965CB80

Function 000C2823 Relevance: 7.7, APIs: 5, Instructions: 171windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000C282A
CreatePopupMenu.USER32 ref: 000C285C
AppendMenuW.USER32(00000001,00000800,00000000,00000000), ref: 000C28FF
AppendMenuW.USER32(00000001,00000000,?,00000010), ref: 000C29BC
__EH_prolog3.LIBCMT ref: 000C29ED

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Menu$AppendH_prolog3$CreatePopup
String ID:
API String ID: 2711618949-0
Opcode ID: d03878618eba1f05936edf7405938a47ea119a64de93cdb85cb3c0630834c363
Instruction ID: 4262bf41f39fa10aa50513fc6ab42f4b9209401c9849d4de3da47fd003053dfb
Opcode Fuzzy Hash: d03878618eba1f05936edf7405938a47ea119a64de93cdb85cb3c0630834c363
Instruction Fuzzy Hash: 91617F71900209DFDB10EFA4CC85FEEB7B4AF08311F144618F955A7692DB70AA49CBA5

Function 000AC42D Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000AC434
GetClientRect.USER32(?,?), ref: 000AC4DA
InflateRect.USER32(?,00000003,00000003), ref: 000AC50C

Part of subcall function 000B0AD6: __EH_prolog3_GS.LIBCMT ref: 000B0ADD

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3_Rect$ClientInflate
String ID:
API String ID: 2789979914-0
Opcode ID: baeb0c2d231f4c880020366efcf4a438f7dee8d2b44eab0f3afcb3570488fa6b
Instruction ID: 8111c2844e103c49473f3ace63500e2b38475edbf8672107cbb6420bd1859075
Opcode Fuzzy Hash: baeb0c2d231f4c880020366efcf4a438f7dee8d2b44eab0f3afcb3570488fa6b
Instruction Fuzzy Hash: 64513771A00519AFDF14DFE8CD95DEEB7B5BF09310F154619F811AB292DB70A940CB60

Function 000C880C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000C8886
EqualRect.USER32(?,?), ref: 000C88B1
BeginDeferWindowPos.USER32(?), ref: 000C88BE
EndDeferWindowPos.USER32(?), ref: 000C88E3

Part of subcall function 000BC01A: GetWindowRect.USER32(?,?), ref: 000BC030
Part of subcall function 000BC01A: GetParent.USER32(?), ref: 000BC072
Part of subcall function 000BC01A: GetParent.USER32(?), ref: 000BC082

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

GetWindowRect.USER32(?,?), ref: 000C8998

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Rect$DeferParent$BeginEqualException@8Throw
String ID:
API String ID: 3220162355-0
Opcode ID: 19e7b43e3381b79ff6a61bdbbbc897891599e63308181ecf7eaf38b1de709f48
Instruction ID: 82f35f49c6cd36c63bd94096fef0e853bcb47641a95ca0f167d4479cd5337f8c
Opcode Fuzzy Hash: 19e7b43e3381b79ff6a61bdbbbc897891599e63308181ecf7eaf38b1de709f48
Instruction Fuzzy Hash: FE512A71D00209DFCB50DFA9C884AEEBBF5FF88310B54856EE505B7211DB70AA44CB65

Function 000A0BA2 Relevance: 7.7, APIs: 5, Instructions: 162stringCOMMON

Download Yara Rule

APIs

SHGetPathFromIDListW.SHELL32(?,?), ref: 000A0C4B
SHGetPathFromIDListW.SHELL32(?,?), ref: 000A0C7B

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000408), ref: 000A0D2E
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000408), ref: 000A0D4F
lstrcmpiW.KERNEL32(?,?), ref: 000A0D63

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: FileFromInfoListPath$Exception@8Throwlstrcmpi
String ID:
API String ID: 438698530-0
Opcode ID: ff7d9aa149a010131fe076d56138cb381c03beea9bf751d1e90c9f8320f881bc
Instruction ID: 6c2b02340871d9916467a4e3bd136ffd62b4b8dddfcdf1e51e64ae1f51950e81
Opcode Fuzzy Hash: ff7d9aa149a010131fe076d56138cb381c03beea9bf751d1e90c9f8320f881bc
Instruction Fuzzy Hash: 0A515E7291122D9BCF649FD4CD40BEEB7B9BF89304F10819AE549A2151DB71AE90CF90

Function 00104323 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 00104343
IsRectEmpty.USER32(?), ref: 00104372
IsRectEmpty.USER32(?), ref: 001043D9
IsRectEmpty.USER32(?), ref: 00104433
IsRectEmpty.USER32(?), ref: 00104479

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 0467142786adb4545b234b428b717f99020bd7ce4fa2ddbc473904e40ff81c96
Instruction ID: 3dcd7fe75aabd6faaa9e9523c859bb43449be093430021f7aad22f10d2df5a14
Opcode Fuzzy Hash: 0467142786adb4545b234b428b717f99020bd7ce4fa2ddbc473904e40ff81c96
Instruction Fuzzy Hash: 41515EB1A0061A9BCF50DFA9C8C5BAEB7F5BF04700F150669EA45EB281D7B0ED408B94

Function 000F8B19 Relevance: 7.7, APIs: 5, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000407,00000000,?), ref: 000F8BA8
PostMessageW.USER32(?,0000001F,00000000,00000000), ref: 000F8BE2
GetParent.USER32(?), ref: 000F8C75
GetParent.USER32(?), ref: 000F8CA5
GetCapture.USER32 ref: 000F8CC0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageParent$CapturePostSend
String ID:
API String ID: 3593767962-0
Opcode ID: 82ccb7b85f26b199806e1cce519049b86793455e61da806a47e053dbe4b54c31
Instruction ID: fe9626bf3eb4b4a7bcacd51474dc3a78de548b4a181431f0cfff76e2d0d3dfe3
Opcode Fuzzy Hash: 82ccb7b85f26b199806e1cce519049b86793455e61da806a47e053dbe4b54c31
Instruction Fuzzy Hash: A751C2B0601208ABEB796B24CC88BF976D5BB04350F18C076E685D7DA2CF748C80E7A1

Function 03167C20 Relevance: 7.6, APIs: 5, Instructions: 135processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,76CB4AAF), ref: 03167C72
_memset.LIBCMT ref: 03167C97
_memset.LIBCMT ref: 03167D18
Process32FirstW.KERNEL32(00000000,?), ref: 03167D32
Process32NextW.KERNEL32(00000000,0000022C), ref: 03167D9A

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Process32_memset$CreateFirstNextSnapshotToolhelp32_malloc
String ID:
API String ID: 2416807333-0
Opcode ID: 1494d033cf1902a57f7a84868555f127fcaeab80244d6730024061c0cdede587
Instruction ID: 6e4f7175054fd6620fa601ebf6f216713bb6eec226fa34b2e642c94345fc4020
Opcode Fuzzy Hash: 1494d033cf1902a57f7a84868555f127fcaeab80244d6730024061c0cdede587
Instruction Fuzzy Hash: 7F51E8759002469FDB24DFA4CC49FEEB7B4FF48714F148698E5159B2C0EB70AA44CB94

Function 00078BDB Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00078C0C

Part of subcall function 00059DC5: ClientToScreen.USER32(?,00078C1D), ref: 00059DD6
Part of subcall function 00059DC5: ClientToScreen.USER32(?,00078C25), ref: 00059DE3

PtInRect.USER32(?,?,?), ref: 00078C26
PtInRect.USER32(?,?,?), ref: 00078C99

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ClientRect$Screen
String ID:
API String ID: 3187875807-0
Opcode ID: f22ae8b9930f78a47d6e302dc2c531bbbdba9cd008650cdd6dfdcddf7aab929d
Instruction ID: 1590853a304ed73596e172f4f8d3acd67cb5d175ca2a6d0507bffc1d7301b309
Opcode Fuzzy Hash: f22ae8b9930f78a47d6e302dc2c531bbbdba9cd008650cdd6dfdcddf7aab929d
Instruction Fuzzy Hash: 98411C71E4150AEFDF21DFA4C949AAEBBF5EB04300F108565E40AFB244EB75A941CB64

Function 0009C894 Relevance: 7.6, APIs: 5, Instructions: 113windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 0009C8D3
ShowWindow.USER32(00000000,00000004), ref: 0009C905
IsWindow.USER32(?), ref: 0009C94A
IsWindowVisible.USER32(?), ref: 0009C955
ShowWindow.USER32(?,00000000), ref: 0009C990

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Show$Visible
String ID:
API String ID: 2757229004-0
Opcode ID: d9cefb78479354e922e76a1f82a37ab965511f94579ca34f0b87529b568446d3
Instruction ID: 93d39f7270fe166d376d9d53c6400217feb1eb38012d27beae51ea7dad4d9c94
Opcode Fuzzy Hash: d9cefb78479354e922e76a1f82a37ab965511f94579ca34f0b87529b568446d3
Instruction Fuzzy Hash: D8319672A00201ABFF249F65DC89FEB77A8EF45751F144129E98697282DF30ED41DBA0

Function 000AE4E3 Relevance: 7.6, APIs: 5, Instructions: 111windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000AE4EA
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 000AE504
GetWindowRect.USER32(?,?), ref: 000AE5B0
ReleaseCapture.USER32 ref: 000AE65B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CaptureH_prolog3_MessageRectReleaseSendWindow
String ID:
API String ID: 1034054131-0
Opcode ID: 8831440a026910e1a2c7f34413ecc9d9213a0ce474785ee13f96d652e3294643
Instruction ID: 95bcec8f74b20058b7911437a8cdb2cb1232bc4356d958451f58d998075a0109
Opcode Fuzzy Hash: 8831440a026910e1a2c7f34413ecc9d9213a0ce474785ee13f96d652e3294643
Instruction Fuzzy Hash: 3D410470908A449FDB21DFA4C984EEABBF5FF99304F14091EE49E92261DB757940CF21

Function 000EC56C Relevance: 7.6, APIs: 5, Instructions: 109windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000EC573
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 000EC5BA
GetWindow.USER32(?,00000005), ref: 000EC5E1
GetWindow.USER32(?,00000002), ref: 000EC60C
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 000EC63B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSendWindow$H_prolog3
String ID:
API String ID: 1382076901-0
Opcode ID: f07eb0a92e6d62f51633bf03cead73d71898cea419918547bec3956388cec5e0
Instruction ID: 252c939d1ad5b0acc0c86c5857e0db7ab5b0a31a6070de7afb9e250f50728d05
Opcode Fuzzy Hash: f07eb0a92e6d62f51633bf03cead73d71898cea419918547bec3956388cec5e0
Instruction Fuzzy Hash: A4312732604254AFEB25AB65CC46FEE77B4AF08720F250055F984BB292DF61EC4287E5

Function 0009CB9C Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0009CBA3
SetRectEmpty.USER32(?), ref: 0009CD00
SetRectEmpty.USER32(?), ref: 0009CD0D
SetRectEmpty.USER32(?), ref: 0009CD1A
SetRectEmpty.USER32(?), ref: 0009CD21

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect$H_prolog3
String ID:
API String ID: 3752103406-0
Opcode ID: 56ebfc2bd4f290e178fb26314d0ec84d83011fc48c75ae730ef77e847c9bebad
Instruction ID: ba77ef2e447bd48974de1139b4fc9d8e8b60cffeda05d7eaeec141350bbd0e47
Opcode Fuzzy Hash: 56ebfc2bd4f290e178fb26314d0ec84d83011fc48c75ae730ef77e847c9bebad
Instruction Fuzzy Hash: 3851D9B0941B44DAD320DF2AC9557DAFBE8AFA5700F40880FD5AB97251DBB06144CF92

Function 000F85EF Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 000F4A4F: SetRectEmpty.USER32(?), ref: 000F4A6A

IsRectEmpty.USER32(?), ref: 000F8614

Part of subcall function 00059D84: ScreenToClient.USER32(?,?), ref: 00059D95
Part of subcall function 00059D84: ScreenToClient.USER32(?,?), ref: 00059DA2

GetWindowRect.USER32(?,?), ref: 000F8655
UnionRect.USER32(?,?,?), ref: 000F867E
EqualRect.USER32(?,?), ref: 000F868C
OffsetRect.USER32(?,?,?), ref: 000F86A8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$ClientEmptyScreen$EqualOffsetUnionWindow
String ID:
API String ID: 2676815302-0
Opcode ID: d08b87728d6cf2796aa72f184f42239e2c1683767b8d09c76452fd3d8caea966
Instruction ID: f6fa26969513f2559e3434b8646cd5e1aad1836acd704070d8012ff14dde4ca4
Opcode Fuzzy Hash: d08b87728d6cf2796aa72f184f42239e2c1683767b8d09c76452fd3d8caea966
Instruction Fuzzy Hash: 19419771A0021DAFCB10DFE9D9848FEBBF9FF88304B10456AE515F3211DB74AA459B64

Function 000CE1B1 Relevance: 7.6, APIs: 5, Instructions: 102windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001014,?,00000000), ref: 000CE287
SendMessageW.USER32(?,00000114,?,00000000), ref: 000CE297
SetScrollPos.USER32(?,00000002,00000000,00000001), ref: 000CE2B5
GetParent.USER32(?), ref: 000CE2C5
SendMessageW.USER32(?,?,00000000,00000000), ref: 000CE2DD

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$ParentScroll
String ID:
API String ID: 375824706-0
Opcode ID: d865580359a6231710e6e4689ae501a04063e62e1b494bc9d57f81c525f85f20
Instruction ID: 7f1bf55903532f662b53229336c2533a35540e063ce46a55d92ff644a1973df1
Opcode Fuzzy Hash: d865580359a6231710e6e4689ae501a04063e62e1b494bc9d57f81c525f85f20
Instruction Fuzzy Hash: 4B31CF71200395EFDB249F64CCC9FAE3BA5BB48711F10452DF99A8B1A2C7709990CB54

Function 0007206B Relevance: 7.6, APIs: 5, Instructions: 99COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(00000000,?,?), ref: 00072087
WindowFromPoint.USER32(?,?), ref: 000720B2
ScreenToClient.USER32(?,00000000), ref: 000720E3
GetParent.USER32(?), ref: 00072151
UpdateWindow.USER32(?), ref: 000721A9

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$CallClientFromHookNextParentPointScreenUpdate
String ID:
API String ID: 160110263-0
Opcode ID: a45bf274c84a012fc94ccec3215a91c073a14b43114be65a7d3835853542392d
Instruction ID: 3cb96031ae31db23feb78fd9ddf34f8c622e70447f8b04f638b005aeca031c69
Opcode Fuzzy Hash: a45bf274c84a012fc94ccec3215a91c073a14b43114be65a7d3835853542392d
Instruction Fuzzy Hash: 0E31B136A00142EFDB159FA4DC88EAD3BF5FB48350F10816DFA099B662DB759880CB54

Function 0008C2F3 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 0008C32C
InflateRect.USER32(?,000000FF,000000FF), ref: 0008C35B
InflateRect.USER32(?,?,?), ref: 0008C3BD
InflateRect.USER32(?,00000001,00000001), ref: 0008C3D9

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: InflateRect
String ID:
API String ID: 2073123975-0
Opcode ID: 4e74ce604f155063bfb6f6e27a1f776d84a78cb575ef2a31bdf1347064c109c3
Instruction ID: 62723124f504e4b341bad1b37f4e82792620d4f53ccf966092d72180b9c6384d
Opcode Fuzzy Hash: 4e74ce604f155063bfb6f6e27a1f776d84a78cb575ef2a31bdf1347064c109c3
Instruction Fuzzy Hash: C03141B250115AABCF00DFA4DC44DEB37AEEB48330B144626F625D31E1DB70EA91DB50

Function 000984D4 Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000984DB
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 00098554
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00098561
SendMessageW.USER32(?,0000007F,00000001,00000000), ref: 0009856C
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00098579

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$H_prolog3
String ID:
API String ID: 1885053084-0
Opcode ID: b4fb24c03cc9b4cc4f129b44b77f4ac09a13f9a4295798b2c5a2050dcabbf821
Instruction ID: a27fbef976ec64288c8011baff3c9ca7a1a0f81c3ec77f35bda33c0fd3381775
Opcode Fuzzy Hash: b4fb24c03cc9b4cc4f129b44b77f4ac09a13f9a4295798b2c5a2050dcabbf821
Instruction Fuzzy Hash: A1316B71340A11AFDF689B20CC96BBA3AA1BF45780F054179F90A9B2D2CF709944DB91

Function 000B0062 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000B0087
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 000B011A
GetParent.USER32(?), ref: 000B0126
GetWindowLongW.USER32(?,000000F4), ref: 000B0140
SendMessageW.USER32(?,00000111,?), ref: 000B0150

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageParentSend$LongWindow
String ID:
API String ID: 2933145521-0
Opcode ID: 4c612bd2d23b9cee6afe9f80c9216b6923f12f48f798f43daab9357c005bca31
Instruction ID: 63a9e278c9ec4e6496f370709821584d956e9dbe74b6809ca8c588732e07cf2c
Opcode Fuzzy Hash: 4c612bd2d23b9cee6afe9f80c9216b6923f12f48f798f43daab9357c005bca31
Instruction Fuzzy Hash: 51210732600615BFDF64AB78DC45BFFB7E6EB44350F144929F98597291DB709C40C6A0

Function 0008A15A Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0008A161
CreatePopupMenu.USER32 ref: 0008A18C
AppendMenuW.USER32(?,00000000,00000096,00000010), ref: 0008A1E3
CheckMenuItem.USER32(?,00000096,00000008), ref: 0008A1F0
IsWindow.USER32(?), ref: 0008A21B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Menu$AppendCheckCreateH_prolog3ItemPopupWindow
String ID:
API String ID: 3258348697-0
Opcode ID: 8c45c82c00866f91a1e541466e48c5dc9bd13f57fbef483a31bf19005b9aaaed
Instruction ID: 030f9f417d6796b27622be620b30976f44116e109df83a35b07aad3c75bc00e5
Opcode Fuzzy Hash: 8c45c82c00866f91a1e541466e48c5dc9bd13f57fbef483a31bf19005b9aaaed
Instruction Fuzzy Hash: 4A31D470A00205AFDF21AFB4CC459FF7B65BF5A311F20061AF852A65E2DBB14940CB91

Function 0316C850 Relevance: 7.6, APIs: 5, Instructions: 87stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0316C867
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,?,00000000,00000000), ref: 0316C89D
GetLastError.KERNEL32(?,00000000,00000000), ref: 0316C8AC
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0316C8CA
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0316C8F8

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: 19e91a3eae2754d981bb0f909f030a06b424dad0265cb7b5071a6039b9c1bbe1
Instruction ID: ab88466fe31d1fc5faf87cc7236aa3951de74ba0a2c044def5966353ad4a5001
Opcode Fuzzy Hash: 19e91a3eae2754d981bb0f909f030a06b424dad0265cb7b5071a6039b9c1bbe1
Instruction Fuzzy Hash: D3218E36240225BBE724DB96DC85F673B6CEB99B60F108104FA44AF280DA70F815C6F8

Function 0005E4C7 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0005E4EA
GetWindowRect.USER32(00000000,?), ref: 0005E517
SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,00000015), ref: 0005E53C
GetWindow.USER32(?,00000005), ref: 0005E545
ScrollWindow.USER32(?,?,?,?,?), ref: 0005E560

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$RectScrollVisible
String ID:
API String ID: 2639402888-0
Opcode ID: 6ac4b763f934891bc8ef8cbfc7f3ef8bca18a8544737389130becd7866f27d38
Instruction ID: 00885d0b6045ad9842da46379fe69d1701c0aaeb44115a32332c25c0a2dee661
Opcode Fuzzy Hash: 6ac4b763f934891bc8ef8cbfc7f3ef8bca18a8544737389130becd7866f27d38
Instruction Fuzzy Hash: 40214D71900609EBCF21DF99CC89DAFBBF9FF88305F10440AF985A2211E7709A44CBA0

Function 000F02B6 Relevance: 7.6, APIs: 5, Instructions: 78windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000F02BD
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 000F02E4
SendMessageW.USER32(?,0000007F,00000001,00000000), ref: 000F02F8
GetClassLongW.USER32(?,000000DE), ref: 000F0370
GetClassLongW.USER32(?,000000F2), ref: 000F037E

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ClassLongMessageSend$H_prolog3
String ID:
API String ID: 350087385-0
Opcode ID: 3edba967ecc14f13823c8db1975a9eae7c4589f999e987eb4e2e6c23ccf9ca9e
Instruction ID: d406ce62a0c2f073e8721c237c322e31b70676f13bb8ad17f0e610f01dcdfe04
Opcode Fuzzy Hash: 3edba967ecc14f13823c8db1975a9eae7c4589f999e987eb4e2e6c23ccf9ca9e
Instruction Fuzzy Hash: 26219831A002196BDB21EB64CC81FFE73A9AF55750F124254FA51BB6E3DA709E40D760

Function 000B29F5 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

SelectObject.GDI32(?,00000000), ref: 000B2A1B

Part of subcall function 000633A4: DeleteObject.GDI32(00000000), ref: 000633BD

SelectObject.GDI32(?,00000000), ref: 000B2A31
DeleteObject.GDI32(00000000), ref: 000B2A9C
DeleteDC.GDI32(00000000), ref: 000B2AAB
LeaveCriticalSection.KERNEL32(001E1A6C), ref: 000B2AC4

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$CriticalLeaveSection
String ID:
API String ID: 3849354926-0
Opcode ID: 3cbba0b831ffbceba629bb3385f0fef0b1463a0a1f66933a51f2e1aa41e9dd3b
Instruction ID: e3106dcb633f08d50456f9fb06e7cada4ed17fae36a44df066403d462b24f949
Opcode Fuzzy Hash: 3cbba0b831ffbceba629bb3385f0fef0b1463a0a1f66933a51f2e1aa41e9dd3b
Instruction Fuzzy Hash: EF21A972900244EFCF21EFA9DC849AA7BF5FF84311B048266ED159F26AC7718981CF91

Function 03172842 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03172850

Part of subcall function 03171DDE: __FF_MSGBANNER.LIBCMT ref: 03171DF7
Part of subcall function 03171DDE: __NMSG_WRITE.LIBCMT ref: 03171DFE
Part of subcall function 03171DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06), ref: 03171E23

_free.LIBCMT ref: 03172863

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: acb9a9b3ea7932de094d8a8ab9386f15e38531882311331c711b74fcbd47ccdb
Instruction ID: b78d37398422dfc56819346e630cf60bb5da52245740aa77ded0a7a4a0674626
Opcode Fuzzy Hash: acb9a9b3ea7932de094d8a8ab9386f15e38531882311331c711b74fcbd47ccdb
Instruction Fuzzy Hash: 5611E736404315ABCB25FB76AC0465E3BF9EF5C260B1D093AE8089E290EF3584C38754

Function 000C4999 Relevance: 7.6, APIs: 5, Instructions: 68windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000C49CD
SHAppBarMessage.SHELL32(00000007,?), ref: 000C49EB
SHAppBarMessage.SHELL32(00000007,?), ref: 000C4A05
SHAppBarMessage.SHELL32(00000007,?), ref: 000C4A1B
SHAppBarMessage.SHELL32(00000007,?), ref: 000C4A34

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Message$_memset
String ID:
API String ID: 2485647581-0
Opcode ID: 62c495d26d8855884f992d4dfda4ce0215bbb08cf8ed81fefb3643c481156656
Instruction ID: 2035697aa08a947a4c001627120ca7ffadd7d5ae89392e9019a2088a32fc1539
Opcode Fuzzy Hash: 62c495d26d8855884f992d4dfda4ce0215bbb08cf8ed81fefb3643c481156656
Instruction Fuzzy Hash: 8C218E71A4120AAEEB44DFA5CCC5FEEBFB8FB04754F04102AE515E2180DB75E944CBA0

Function 0014ABAB Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0014ABB9

Part of subcall function 00147C7C: __FF_MSGBANNER.LIBCMT ref: 00147C95
Part of subcall function 00147C7C: __NMSG_WRITE.LIBCMT ref: 00147C9C
Part of subcall function 00147C7C: RtlAllocateHeap.NTDLL(00000000,00000001,?,00000000,00000000,?,00054350,8007000E,00000000,?,000588A7,0000000C,00000004,00053CDC,8007000E), ref: 00147CC1

_free.LIBCMT ref: 0014ABCC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 048be34e19e25b45447736daec41502397d8101d4589a42af1fbecf1fa95580d
Instruction ID: fee33345b3f74f21771c850e7602cb049580903ab90f6a66fe3ce7283bffc461
Opcode Fuzzy Hash: 048be34e19e25b45447736daec41502397d8101d4589a42af1fbecf1fa95580d
Instruction Fuzzy Hash: B9110633884216ABCB257F74AD45A6E3796EF503A0B224925F9599B270DF30CC8187D2

Function 00080226 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GlobalGetAtomNameW.KERNEL32(?,?,00000103), ref: 000802A0
GlobalAddAtomW.KERNEL32(?), ref: 000802AF
GlobalGetAtomNameW.KERNEL32(?,?,00000103), ref: 000802C5
GlobalAddAtomW.KERNEL32(?), ref: 000802CE
SendMessageW.USER32(?,000003E4,?,?), ref: 000802F8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AtomGlobal$Name$MessageSend
String ID:
API String ID: 1515195355-0
Opcode ID: 425c41638c02a3a7586b725176a0d95dc0506b6f3b4f5b9abfacdf8a2b862a24
Instruction ID: e973a69cf0553394b99e1747c8b747495ec27be52d6da3d2efa27b225ce5c2c2
Opcode Fuzzy Hash: 425c41638c02a3a7586b725176a0d95dc0506b6f3b4f5b9abfacdf8a2b862a24
Instruction Fuzzy Hash: 5B218471901218ABDB60EF68CC44AEAB3FCFF48700F00855AE59DD7151D7B4AE84CBA0

Function 0008E797 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 0008E7CE
GetParent.USER32(?), ref: 0008E7EB
GetClientRect.USER32(?,?), ref: 0008E7FA
GetParent.USER32(?), ref: 0008E803
MapWindowPoints.USER32(?,?,?,00000002), ref: 0008E818

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ParentRect$ClientFillPointsWindow
String ID:
API String ID: 3058756167-0
Opcode ID: 03035e9039e373fd5d9d57c763f78f8bbba726b6cdb18fa514d7bcceddcd3b53
Instruction ID: 2d48316aa7b9cf0d18a21da93ab7e499535c0334fd8578324445cc38ebe6a32d
Opcode Fuzzy Hash: 03035e9039e373fd5d9d57c763f78f8bbba726b6cdb18fa514d7bcceddcd3b53
Instruction Fuzzy Hash: BF212C71900209EFCB14EFA5CC49CAFBBB5FF49350B114569E846A7221EB71AA05CFA0

Function 03161270 Relevance: 7.6, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 03161291
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 031612AA
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 031612C3
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 031612E3
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 031612FA
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,0316A390), ref: 03161311

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1ac7f6a9d9ceb0f68a0e8cc5e08f78c202edd77c6899dad7e624f35c121f9296
Instruction ID: 72e0434e3ce1937e74f083900a7f0ca0d08bad1b803548478aff208ad0544cf3
Opcode Fuzzy Hash: 1ac7f6a9d9ceb0f68a0e8cc5e08f78c202edd77c6899dad7e624f35c121f9296
Instruction Fuzzy Hash: E311ADB1A00B056FD730DF9A9CC4A17F7E9BB4C654765492DE18AE3A50C770E8484E54

Function 0012AA8B Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0012AA92
SetRectEmpty.USER32(?), ref: 0012AB47
CreateCompatibleDC.GDI32(00000000), ref: 0012AB4A
SetRectEmpty.USER32(?), ref: 0012AB69
CreatePen.GDI32(00000000,00000001,?), ref: 0012AB74

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CreateEmptyRect$CompatibleException@8H_prolog3Throw
String ID:
API String ID: 3214640438-0
Opcode ID: 8cea34445c34096acab177c4d2e0742564b12d6a9a0356e75f11709d55b2c022
Instruction ID: 8f58a171e86596f57ec0055be76bd608b06b7a2f39ae588f3e7c9036e81ffb04
Opcode Fuzzy Hash: 8cea34445c34096acab177c4d2e0742564b12d6a9a0356e75f11709d55b2c022
Instruction Fuzzy Hash: C721A9B0901B00DBD721DF69C981B9AFAE8BFA5340F00891FE5AE97221DBB06545CF61

Function 000A247D Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 000A24B1
CreateFontIndirectW.GDI32(?), ref: 000A24C6
IsWindow.USER32(?), ref: 000A24E4
InvalidateRect.USER32(?,00000000,00000001), ref: 000A2502
UpdateWindow.USER32(?), ref: 000A250B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$CreateFontIndirectInvalidateObjectRectUpdate
String ID:
API String ID: 1602852816-0
Opcode ID: 39e461fa61403fde4eb3f6395e72bbdefd12e22abee85b3f3946d6b0b23a7508
Instruction ID: ccb76825eb07f9041fc2c765ad89fb48f3ca007c5b53e22d737291184ab0fd37
Opcode Fuzzy Hash: 39e461fa61403fde4eb3f6395e72bbdefd12e22abee85b3f3946d6b0b23a7508
Instruction Fuzzy Hash: EC11B231600204ABDB20AB78DC49AEB77A8FF45301F044529F94692561EB71E945CB90

Function 00094B13 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

SetCapture.USER32(?), ref: 00094B2B
GetCursorPos.USER32(?), ref: 00094B6A
LoadCursorW.USER32(00000000,00007F86), ref: 00094B94
SetCursor.USER32(00000000), ref: 00094B9B
GetCursorPos.USER32(?), ref: 00094BA8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Cursor$CaptureLoad
String ID:
API String ID: 1460996051-0
Opcode ID: b51dba6fe75d3ce47b3ee9dce84cd8d14342e64b5c36d4215f1afc113c22311c
Instruction ID: cc977c60d39ef3b6b53cd06effb2a969044abf53ddd8514e9a97ac781222da8a
Opcode Fuzzy Hash: b51dba6fe75d3ce47b3ee9dce84cd8d14342e64b5c36d4215f1afc113c22311c
Instruction Fuzzy Hash: 37119E316003059FDB64ABB9C809FEAB7E9AF49311F00052DF5CA83252CBB1B841CB91

Function 000ACAE7 Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 000ACAF3
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 000ACB1F
SendMessageW.USER32(?,00000150,?,00000000), ref: 000ACB32
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 000ACB4C
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 000ACB5F

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Exception@8ThrowWindow
String ID:
API String ID: 220582486-0
Opcode ID: 9053c4493290508856924f43c22d5a313f7802c5d4f84d56a4ab955f815967a2
Instruction ID: ce058c8a3b8c3ea634754fd97921440032d7cf055626af7e273cf195492f5440
Opcode Fuzzy Hash: 9053c4493290508856924f43c22d5a313f7802c5d4f84d56a4ab955f815967a2
Instruction Fuzzy Hash: A6019231B10205BFFB155BB4CC46F5ABAB9FB49744F100121F600E65B1E7B1EC109BA0

Function 000D813A Relevance: 7.6, APIs: 5, Instructions: 53threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000D8141
EnterCriticalSection.KERNEL32(001E1E5C,00000000,0007246E,00000001), ref: 000D819D
__beginthread.LIBCMT ref: 000D81B7
SetThreadPriority.KERNEL32(00000000,000000FF), ref: 000D81D0
LeaveCriticalSection.KERNEL32(001E1E5C), ref: 000D81E7

Part of subcall function 000B2594: __EH_prolog3.LIBCMT ref: 000B259B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CriticalH_prolog3Section$EnterLeavePriorityThread__beginthread
String ID:
API String ID: 4118814795-0
Opcode ID: 3e8d22200a775ad20d7c4b987b42266a3469e924778b51da6e9a5fe012c375d4
Instruction ID: 2fd00d2623753eadb4fffeb39d03e1151c7d3b51fc7f9c7a10fba138a4994dbc
Opcode Fuzzy Hash: 3e8d22200a775ad20d7c4b987b42266a3469e924778b51da6e9a5fe012c375d4
Instruction Fuzzy Hash: 9C115174800790ABC762AB749C8946E3BA8FB05B71B208717FC7596BE1DB7049C5C7A1

Function 0316B040 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0316B23C,76CB4AAF,?,?,?,?,03182D66,000000FF), ref: 0316B053
EnterCriticalSection.KERNEL32(?,?,?,?,0316B23C,76CB4AAF,?,?,?,?,03182D66,000000FF), ref: 0316B05D
LeaveCriticalSection.KERNEL32(?,?,?,?,0316B23C,76CB4AAF,?,?,?,?,03182D66,000000FF), ref: 0316B070
LeaveCriticalSection.KERNEL32(?,?,?,?,0316B23C,76CB4AAF,?,?,?,?,03182D66,000000FF), ref: 0316B073

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 270489d6146c142daed4c5332b35f21a1ab75bb46bb4ad6ec9d9c309d7dc37ce
Instruction ID: 9e446c5ce90b2594d354d2f669441b3cb59b415d5092bcf4c9ab3b2473c7a06a
Opcode Fuzzy Hash: 270489d6146c142daed4c5332b35f21a1ab75bb46bb4ad6ec9d9c309d7dc37ce
Instruction Fuzzy Hash: 290184B61047108FD720EB67FC84B6BB7F8EB8C715F044529E145C3504DB74F88586A4

Function 031775A7 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 031775B3

Part of subcall function 031745E4: __getptd_noexit.LIBCMT ref: 031745E7
Part of subcall function 031745E4: __amsg_exit.LIBCMT ref: 031745F4

__getptd.LIBCMT ref: 031775CA
__amsg_exit.LIBCMT ref: 031775D8
__lock.LIBCMT ref: 031775E8
__updatetlocinfoEx_nolock.LIBCMT ref: 031775FC

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: a8fb5931d7d6a926cf00a6fd5474f664540871b8b20155d8367b752bb4b0211e
Instruction ID: afab6da38649c913778c296f60d1631a4f7f30040116c3aefcb4a4a97cf82feb
Opcode Fuzzy Hash: a8fb5931d7d6a926cf00a6fd5474f664540871b8b20155d8367b752bb4b0211e
Instruction Fuzzy Hash: 72F0243A9043109BDB34FBB99801B6C77B0AF0C7A0F1D8249E010AF1C0CF644981CEA5

Function 031643B0 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 031643D2
GetCommandLineW.KERNEL32 ref: 031643D8
GetStartupInfoW.KERNEL32(?), ref: 031643E7
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 0316440F
ExitProcess.KERNEL32 ref: 03164417

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 2393e4daefab2450cd3ed435018d53f8fffaeb4bd1196847e9ff8ebed4b67f8b
Instruction ID: 6f9a5d1418e5732d9409527e7448b3366ae94a3fa8ba092d82f45e47519100b7
Opcode Fuzzy Hash: 2393e4daefab2450cd3ed435018d53f8fffaeb4bd1196847e9ff8ebed4b67f8b
Instruction Fuzzy Hash: 3CF090B154431ABBE724BBA1DC4DFEA77B8EB08B00F104294B615A60C4DE707A848B78

Function 031678EE Relevance: 7.5, APIs: 5, Instructions: 26processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,000001FE), ref: 031678F9
GetCommandLineW.KERNEL32(?,?,000001FE), ref: 031678FF
GetStartupInfoW.KERNEL32(?,?,?,000001FE), ref: 0316790C
CreateProcessW.KERNEL32(?,00000000,?,?,?,00000020,?,?,?,?,?,?,000001FE), ref: 0316792C
ExitProcess.KERNEL32 ref: 03167934

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: d498459ff2df9fa667e70138df7bc52f7eae9fd534d3c9a183d584ee2a1e3287
Instruction ID: 91ee8950913ff05f5c7e79d57adead3193ae9d201291584e51af3c5776156bca
Opcode Fuzzy Hash: d498459ff2df9fa667e70138df7bc52f7eae9fd534d3c9a183d584ee2a1e3287
Instruction Fuzzy Hash: 58E0C072004282BFD324ABA2DC4CDAB7BBCEBDDB11F044A0CB15581094EE746545CB75

Function 0317177E Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03174B99: _doexit.LIBCMT ref: 03174BA5

___set_flsgetvalue.LIBCMT ref: 03171790

Part of subcall function 03174429: TlsGetValue.KERNEL32(00000000,03174582,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000,00000000), ref: 03174432
Part of subcall function 03174429: DecodePointer.KERNEL32(?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000,00000000,?,0317468F,0000000D), ref: 03174444
Part of subcall function 03174429: TlsSetValue.KERNEL32(00000000,?,03174F50,00000000,00000001,00000000,?,0317B976,00000018,031894A8,0000000C,0317BA06,00000000,00000000,?,0317468F), ref: 03174453

___fls_getvalue@4.LIBCMT ref: 0317179B

Part of subcall function 03174409: TlsGetValue.KERNEL32(?,?,031717A0,00000000), ref: 03174417

___fls_setvalue@8.LIBCMT ref: 031717AE

Part of subcall function 0317445D: DecodePointer.KERNEL32(?,?,?,031717B3,00000000,?,00000000), ref: 0317446E

GetLastError.KERNEL32(00000000,?,00000000), ref: 031717B7
ExitThread.KERNEL32 ref: 031717BE
GetCurrentThreadId.KERNEL32 ref: 031717C4
__freefls@4.LIBCMT ref: 031717E4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 0259ca785af3ce989651d311b00300decf914fc7eb8041d3d98895370a808338
Instruction ID: 2818fd9e1a535c0b386a04330fce3df453fd3e3c5b8c7d30f684b4af5239ee30
Opcode Fuzzy Hash: 0259ca785af3ce989651d311b00300decf914fc7eb8041d3d98895370a808338
Instruction Fuzzy Hash: DCE0867DC0430677CF00BBF3DC088DF3A7C9E0E245B1C4450F9129B004EF24951166A5

Function 000FC793 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109keyboardCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000FC79A
__EH_prolog3.LIBCMT ref: 000FC82C
GetKeyState.USER32(00000010), ref: 000FC83B

Strings

], xrefs: 000FC84B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$State
String ID: ]
API String ID: 561920835-3352871620
Opcode ID: b6593c9819e0f6cbb729f5bd71ec9a5a5162699ed35756987e449dbfa32b1d84
Instruction ID: 7b568648ed2551f964269d18649cc2f73b7c70d6d597ded5c3ac8441e333d82f
Opcode Fuzzy Hash: b6593c9819e0f6cbb729f5bd71ec9a5a5162699ed35756987e449dbfa32b1d84
Instruction Fuzzy Hash: AC41A47090020DCFDB50EFA8C9869FDBBF0BF08350F20452DE655A76A1CB715A46EB50

Function 00062059 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMT ref: 000620A4
__snwprintf_s.LIBCMT ref: 000620D6

Part of subcall function 00148FB0: __getptd_noexit.LIBCMT ref: 00148FB0

Strings

Afx:%p:%x, xrefs: 0006209A
Afx:%p:%x:%p:%p:%p, xrefs: 000620CC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: __snwprintf_s$__getptd_noexit
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 101746997-2801496823
Opcode ID: 2c85c615ababf52d3f2b1db7075b1d07de3138981a079cddccbbb58f6a9bb689
Instruction ID: c8f68e853e96eaee7591ed04faba050563b0d5a9cc50cdaeb5fda8df06ac73b5
Opcode Fuzzy Hash: 2c85c615ababf52d3f2b1db7075b1d07de3138981a079cddccbbb58f6a9bb689
Instruction Fuzzy Hash: 35316F70900609AFCB11EFA5CC419DEBBF5EF59350F104066FD04A7222DB709E54CBA1

Function 0316762E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 03167F30: GetDesktopWindow.USER32 ref: 03167F67
Part of subcall function 03167F30: GetDC.USER32(00000000), ref: 03167F74
Part of subcall function 03167F30: CreateCompatibleDC.GDI32(00000000), ref: 03167F7A
Part of subcall function 03167F30: GetDC.USER32(00000000), ref: 03167F85
Part of subcall function 03167F30: GetDeviceCaps.GDI32(00000000,00000008), ref: 03167F92
Part of subcall function 03167F30: GetDeviceCaps.GDI32(00000000,00000076), ref: 03167F9A
Part of subcall function 03167F30: ReleaseDC.USER32(00000000,00000000), ref: 03167FAB
Part of subcall function 03167F30: GetSystemMetrics.USER32(0000004C), ref: 03168050
Part of subcall function 03167F30: GetSystemMetrics.USER32(0000004D), ref: 03168065
Part of subcall function 03167F30: CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 0316807E
Part of subcall function 03167F30: SelectObject.GDI32(?,00000000), ref: 0316808C
Part of subcall function 03167F30: SetStretchBltMode.GDI32(?,00000003), ref: 03168098
Part of subcall function 03167F30: GetSystemMetrics.USER32(0000004F), ref: 031680A5
Part of subcall function 03167F30: GetSystemMetrics.USER32(0000004E), ref: 031680B8

_memmove.LIBCMT ref: 031676D9

Part of subcall function 031716AA: _malloc.LIBCMT ref: 031716C4

_memset.LIBCMT ref: 03167672
swprintf.LIBCMT ref: 03167695

Strings

%s %s, xrefs: 03167684

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: MetricsSystem$CapsCompatibleCreateDevice$BitmapDesktopModeObjectReleaseSelectStretchWindow_malloc_memmove_memsetswprintf
String ID: %s %s
API String ID: 1388310237-581060391
Opcode ID: 7261e3b3debb2f44077ca5530dce91db52c69ff322d913a3845ea6c15ef59f83
Instruction ID: 986df03c9ad874972d74af79a2425a80be5c45b0ab0bb0ff39f17f5d09c09fa9
Opcode Fuzzy Hash: 7261e3b3debb2f44077ca5530dce91db52c69ff322d913a3845ea6c15ef59f83
Instruction Fuzzy Hash: 2621A075604341AFD210EF64DC81E6BB7E9AFCD604F08492DF55A9B282E770A914CAA2

Function 000C48AE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000C48B5

Part of subcall function 000DABAD: __EH_prolog3.LIBCMT ref: 000DABB4

Part of subcall function 0006289B: GetDlgCtrlID.USER32(?), ref: 000628A4

Strings

%sBasePane-%d%x, xrefs: 000C491D
%sBasePane-%d, xrefs: 000C4906
IsVisible, xrefs: 000C495C

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$Ctrl
String ID: %sBasePane-%d$%sBasePane-%d%x$IsVisible
API String ID: 3879667756-4027084908
Opcode ID: 942bebd9ee7c12e2443a090f0d17e34d1eaf1f5990dc7a6a7ee333f83b58ae75
Instruction ID: 12ef4a6a496abe7f4f0e304bd9d1962500687fb3d966163e419e5519a663e3f3
Opcode Fuzzy Hash: 942bebd9ee7c12e2443a090f0d17e34d1eaf1f5990dc7a6a7ee333f83b58ae75
Instruction Fuzzy Hash: 6F21BD71A00219AFCF10EFA4C895EFE7BB5EF04360F144558F916A7392CB708A40CBA1

Function 00066941 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00066966
GetSysColor.USER32(00000014), ref: 000669B0
CreateDIBitmap.GDI32(?,00000028,00000004,?,00000028,00000000), ref: 00066A03

Strings

(, xrefs: 00066994

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: BitmapColorCreate_memset
String ID: (
API String ID: 3930187609-3887548279
Opcode ID: 26d950aaead7aceb9ed1dfb2bbefcbab79ca5a70f3048c4e2b8f3fbbf5f41101
Instruction ID: d48e58e5471c072f3ba01ac7d0f1879c6c319be63f5a8e6154dc9bb4058bab3c
Opcode Fuzzy Hash: 26d950aaead7aceb9ed1dfb2bbefcbab79ca5a70f3048c4e2b8f3fbbf5f41101
Instruction Fuzzy Hash: 6F21F231A11258DBEB04DBB8CC56BEDBBF8AB95700F00446EE646E7281DB355A48CB60

Function 03162CA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 03162CBB
swprintf.LIBCMT ref: 03162D10
lstrcatW.KERNEL32(-00000C5C,>f:yhV:,000009A8,?,031628B2,00000000), ref: 03162D2F

Strings

>f:yhV:, xrefs: 03162D29

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: swprintf$lstrcat
String ID: >f:yhV:
API String ID: 3236582425-705829887
Opcode ID: a8734eb00943d7ff7ec68acc5a11d5e28a3559e79582a35751a5ed3ea75d133d
Instruction ID: 92ef29733fe3a5e50f93a4ed64b89cf2702ff59ce0df419fbf272083813228f3
Opcode Fuzzy Hash: a8734eb00943d7ff7ec68acc5a11d5e28a3559e79582a35751a5ed3ea75d133d
Instruction Fuzzy Hash: B711E376600201BFE221DB88DC81CBBF3BCEB8D720B14882DFA8183240D7B16851CBB1

Function 0007E200 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0007E207
GetCursorPos.USER32(?), ref: 0007E2CD

Strings

MenuShowDelay, xrefs: 0007E278
Control Panel\Desktop, xrefs: 0007E256

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CursorH_prolog3
String ID: Control Panel\Desktop$MenuShowDelay
API String ID: 634316419-702829638
Opcode ID: 850cddee34137670eb6a80ce2c641739b1b91705e3018e84eb4b6726c0aef272
Instruction ID: 795064d868f68f7864a16b0d18cbd6820f0d08865e4c8d6b25052ea59392d81a
Opcode Fuzzy Hash: 850cddee34137670eb6a80ce2c641739b1b91705e3018e84eb4b6726c0aef272
Instruction Fuzzy Hash: 5721CF70A002459FDB14EFB4CC46BAE77B4AF19321F10866CF529DB2E2DBB49941CB94

Function 000A25EF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000A25F6
SetRectEmpty.USER32(?), ref: 000A262C

Part of subcall function 0005432D: _malloc.LIBCMT ref: 0005434B

SendMessageW.USER32(?,00001036,00000000,00000020), ref: 000A2696

Strings

SysListView32, xrefs: 000A2670

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EmptyH_prolog3_MessageRectSend_malloc
String ID: SysListView32
API String ID: 385562461-78025650
Opcode ID: 7d1bb7d9cdf1be3c65cb71d35f1087feba7094ab05b70a993a31bac017a9d894
Instruction ID: 425e27572e4c68b259a8fce9dd74b6867b3553ba52878a0f9449a860e52554d0
Opcode Fuzzy Hash: 7d1bb7d9cdf1be3c65cb71d35f1087feba7094ab05b70a993a31bac017a9d894
Instruction Fuzzy Hash: 3E1181B1A45305AFDB209FE48DC19EEB6B4BB55310F50023EF266B72D1CBB05940CB10

Function 0008E6E2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 0008E707
InflateRect.USER32(?,000000FF,000000FF), ref: 0008E73E
DrawEdge.USER32(?,?,00000000,0000000F), ref: 0008E75E

Strings

iii, xrefs: 0008E724

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$DrawEdgeFillInflate
String ID: iii
API String ID: 785442924-940974255
Opcode ID: 059c9248d0a2769d7b2a3d1c3990beccea06298a6635b124c77aa858a70049bd
Instruction ID: e993140cefc954768974f348d6195e6f0e50d6187b9f27ea83bf959a3cebaccd
Opcode Fuzzy Hash: 059c9248d0a2769d7b2a3d1c3990beccea06298a6635b124c77aa858a70049bd
Instruction Fuzzy Hash: D41118B1500109AFCF00DFA8DD84DEF7BB9FB49324B104226F916E71A1DB709A45CBA0

Function 00060770 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0006872C: EnterCriticalSection.KERNEL32(001E0170,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068766
Part of subcall function 0006872C: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068778
Part of subcall function 0006872C: LeaveCriticalSection.KERNEL32(001E0170,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068785
Part of subcall function 0006872C: EnterCriticalSection.KERNEL32(?,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068795

Part of subcall function 0006377C: __EH_prolog3_catch.LIBCMT ref: 00063783

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

GetProcAddress.KERNEL32(00000000,HtmlHelpW), ref: 000607B9
FreeLibrary.KERNEL32(?), ref: 000607C9

Strings

hhctrl.ocx, xrefs: 0006079D
HtmlHelpW, xrefs: 000607B3

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpW$hhctrl.ocx
API String ID: 3274081130-3773518134
Opcode ID: c88b3abd4b46824b51adbb6f0a165635be0fb8235071d786e85434851998faa9
Instruction ID: 1b4be24177bb5c4b75a73bd2495a6735ffdb64736b1937fb6311a980e3b39df6
Opcode Fuzzy Hash: c88b3abd4b46824b51adbb6f0a165635be0fb8235071d786e85434851998faa9
Instruction Fuzzy Hash: CE01D631984706EBCB212FA1DC16BAB3AD7EF447A2F008425F54A96492DB70E4509BA1

Function 00056521 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00056533
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00056543

Strings

Advapi32.dll, xrefs: 0005652E
RegCreateKeyTransactedW, xrefs: 0005653D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1646373207-2994018265
Opcode ID: aa71fa7b585b8ac3cadcc1dc77d8b655c229ab55b8b5eecbf7afcea45dd98f24
Instruction ID: fdbaa417d1e61ffb8ea3f85c1f8422337728f33857b1ac5ecf904476a9dfe310
Opcode Fuzzy Hash: aa71fa7b585b8ac3cadcc1dc77d8b655c229ab55b8b5eecbf7afcea45dd98f24
Instruction Fuzzy Hash: BCF03C32640609EBCF215FE09C04BEA3FAAEB48792F054025FA4492460DB72D9B0EB90

Function 000564C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 000564DA
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 000564EA

Strings

Advapi32.dll, xrefs: 000564D5
RegOpenKeyTransactedW, xrefs: 000564E4

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1646373207-3913318428
Opcode ID: 819be16a495a4eeb652546f55a24d19f7d1e18d18a7c9398c74de546d40390d5
Instruction ID: 6f29aa2d895e8fedd39e3c9bd7b9c2bb0ca62fa54bac1b5de0fc6a2fe100526e
Opcode Fuzzy Hash: 819be16a495a4eeb652546f55a24d19f7d1e18d18a7c9398c74de546d40390d5
Instruction Fuzzy Hash: BBF03032280605ABCB215FA4AC04BA73B99EB45756F444429F98592460DB72C9A0DBA0

Function 031710C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(76CB4AAF,?,?,0318317E,000000FF,?,0317107F), ref: 031710FD
InterlockedIncrement.KERNEL32( {N), ref: 03171112
InterlockedIncrement.KERNEL32( {N), ref: 0317111D

Strings

{N, xrefs: 03171102, 0317110D, 03171118

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: IncrementInterlocked$Timetime
String ID: {N
API String ID: 2019151745-2594394968
Opcode ID: 951c6824e83a0aab54aa133bfb7d25c6a75065944f0c628f509a96477db7350a
Instruction ID: 3e2623a74118a6e3312ea4d58207f352fa7a750c750d3ada47e58fd670fdea40
Opcode Fuzzy Hash: 951c6824e83a0aab54aa133bfb7d25c6a75065944f0c628f509a96477db7350a
Instruction Fuzzy Hash: E5F09035A4438AFFE704EBAAED02B59BBE8E70CA10F09017BD824C3645D77654848BB0

Function 000CA573 Relevance: 6.4, APIs: 4, Instructions: 435COMMON

Download Yara Rule

APIs

Part of subcall function 00059DC5: ClientToScreen.USER32(?,00078C1D), ref: 00059DD6
Part of subcall function 00059DC5: ClientToScreen.USER32(?,00078C25), ref: 00059DE3

Part of subcall function 000C7F2A: SetRectEmpty.USER32(?), ref: 000C7F37
Part of subcall function 000C7F2A: GetWindowRect.USER32(?,?), ref: 000C7F48

IsRectEmpty.USER32(?), ref: 000CA5D4
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 000CA665
GetWindowRect.USER32(?,?), ref: 000CA904
EqualRect.USER32(?,?), ref: 000CA91D

Part of subcall function 000C8323: GetWindowRect.USER32(?,?), ref: 000C835A
Part of subcall function 000C8323: OffsetRect.USER32(?,00000000,?), ref: 000C8384

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$ClientEmptyScreen$EqualOffsetRedraw
String ID:
API String ID: 1200911113-0
Opcode ID: cc36ae26e5c1568bd24957c211993f2875c6f54b2db8246f0edde5b5c2660bc4
Instruction ID: f7181181a87cb5ba3f6f0238aaeb2835ba2a20ffcdfd984bb4b970bdffa43bf4
Opcode Fuzzy Hash: cc36ae26e5c1568bd24957c211993f2875c6f54b2db8246f0edde5b5c2660bc4
Instruction Fuzzy Hash: 7BF12531A0020D9FCF24DFA8C989FAEBBF5EF45304F15812EE805AB255DB349945CB52

Function 03169710 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 03169748
IsBadReadPtr.KERNEL32(?,00000014), ref: 03169818
SetLastError.KERNEL32(0000007F), ref: 03169843

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Read$ErrorLast
String ID:
API String ID: 2715074504-0
Opcode ID: 405490e9358129732aec4788f369c6df9c1b23951c10f3cd86331750e56425e1
Instruction ID: b6ced20b2e2a229d1f43c4b594e791578360a3390a6f6eb80411d68e22df75b1
Opcode Fuzzy Hash: 405490e9358129732aec4788f369c6df9c1b23951c10f3cd86331750e56425e1
Instruction Fuzzy Hash: D7418D75A0020ADFDB14CF9AD880A6AF7F9FF88714F188599D80997340EB75F951CB90

Function 0316E690 Relevance: 6.3, APIs: 5, Instructions: 80stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0316E6A8
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0316E6D0
GetLastError.KERNEL32 ref: 0316E6DF
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 0316E6F9
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,?,00000000), ref: 0316E723

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: 01d822ec2f6b47bfcfccf8a45fbf6e357644aa8728d009cbe4c99ba16ae4acce
Instruction ID: 49955aacd8806bfb660f3cf7d02bb7fca694bcd4e5932b4c8bae5a2615a47b8e
Opcode Fuzzy Hash: 01d822ec2f6b47bfcfccf8a45fbf6e357644aa8728d009cbe4c99ba16ae4acce
Instruction Fuzzy Hash: 3F11813A600225BBD720AB95DC89F677B6CEF89B60F048641FD489F244DA30A91487F9

Function 03170410 Relevance: 6.3, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?,?,?,?,?,?,?,?,0317084E), ref: 0317041E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,0317084E), ref: 0317042E
SetLastError.KERNEL32(0000139F,?,?,?,?,?,?,?,?,?,0317084E), ref: 0317043F
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,0317084E), ref: 03170446

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 6a7af9a04343cd7a1ee790038c9e567691f2f26a79d27d78b2092c2d97610674
Instruction ID: 8562181ad27c2cccbe47e73ec2883322afc16578a3a73fbf0694ac1ddc555a39
Opcode Fuzzy Hash: 6a7af9a04343cd7a1ee790038c9e567691f2f26a79d27d78b2092c2d97610674
Instruction Fuzzy Hash: 0CF089735002209BC710B7BFB80859A77FCAB5DB32F044759F262D15C4DFB4A8818664

Function 0009A53F Relevance: 6.3, APIs: 4, Instructions: 258keyboardCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0009A56B
GetKeyState.USER32(00000011), ref: 0009A573
IsRectEmpty.USER32(?), ref: 0009A5D0
GetWindowRect.USER32(?,?), ref: 0009A74D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$StateWindow
String ID:
API String ID: 2684165152-0
Opcode ID: 63ceda6b4206eca1e529fab3b72f292a93ac0c05083463bba1699eea837199e4
Instruction ID: fc5e75c31ce4f5857632564d90157a1f8f71b1800151990096182e5249e80901
Opcode Fuzzy Hash: 63ceda6b4206eca1e529fab3b72f292a93ac0c05083463bba1699eea837199e4
Instruction Fuzzy Hash: 75917C31B042059FDF15DFA4CC85AEEBBB6FF49310F248169F905AB291CB359841EBA1

Function 000F038C Relevance: 6.3, APIs: 4, Instructions: 252keyboardCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 000F03DC
GetKeyState.USER32(00000011), ref: 000F03E4

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

GetWindowRect.USER32(?,?), ref: 000F0594
GetWindowRect.USER32(?,?), ref: 000F05E4

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$EmptyException@8StateThrow
String ID:
API String ID: 2915703036-0
Opcode ID: aa0e84a065b8e314e901c5bab5857a1a7040c00052a4f8fa17df8f658a20308e
Instruction ID: bf1f8a0277352faf12c2702290f63646478d80850a00f80599ea89b5965dad50
Opcode Fuzzy Hash: aa0e84a065b8e314e901c5bab5857a1a7040c00052a4f8fa17df8f658a20308e
Instruction Fuzzy Hash: D4A12671A002099FCB50DFA5C8949FEBBF9FF89700B24006AE646EB652DB71AC41DF50

Function 00096245 Relevance: 6.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00096288
CopyRect.USER32(?,?), ref: 00096293
GetClientRect.USER32(?,?), ref: 000962AC
SystemParametersInfoW.USER32(00000026,00000000,?,00000000), ref: 00096442

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$ClientCopyInfoParametersSystemWindow
String ID:
API String ID: 1264264222-0
Opcode ID: 4eb3908d499343956d461a5daa4043ab36abdde62b02b2476d9078b44420fe0a
Instruction ID: dd916908338ef9bb5b6065236fbd5de9024b8d74fc4e7e477c9cf520dba50479
Opcode Fuzzy Hash: 4eb3908d499343956d461a5daa4043ab36abdde62b02b2476d9078b44420fe0a
Instruction Fuzzy Hash: B4810871D00219EFCF14DFE8C9989AEBBB5FF48700F108169E816A7245DB71AA45DFA0

Function 000BE396 Relevance: 6.2, APIs: 4, Instructions: 187windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 000BE441
CreateCompatibleBitmap.GDI32(?,?,?), ref: 000BE45B
GetObjectW.GDI32(?,00000018,?), ref: 000BE564

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

InvalidateRect.USER32(?,00000000,00000001,?,00000000,?,?,?), ref: 000BE5F7

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreate$BitmapException@8InvalidateObjectRectThrow
String ID:
API String ID: 4050247650-0
Opcode ID: 20bd19854a21f0944f39395efef2dddd70e47aad3fcd2ae66933b6e2678d2e41
Instruction ID: 95dc3fc01f5563a862dffe2da376e63c078a8bf20fe87542eb50ad516b86dd78
Opcode Fuzzy Hash: 20bd19854a21f0944f39395efef2dddd70e47aad3fcd2ae66933b6e2678d2e41
Instruction Fuzzy Hash: 3271A275900598EBCB24DB60CC55EEEB7F9EF48305F104599F90AA3282DBB05E84CF61

Function 0007CBE4 Relevance: 6.2, APIs: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0007CC0E
InflateRect.USER32(?,00000002,00000002), ref: 0007CDA6
InvalidateRect.USER32(?,?,00000001), ref: 0007CDB5
UpdateWindow.USER32(?), ref: 0007CDBE

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$InflateInvalidateParentUpdateWindow
String ID:
API String ID: 4005937429-0
Opcode ID: 6d9f11f2b5ee033c5b50a3fec6f8ac965650c53afc997921710773d48e43a53b
Instruction ID: 96f2ba3666c009a0f843730e7af17112e50d0c1de458804f09cfb7ecfb84c0cf
Opcode Fuzzy Hash: 6d9f11f2b5ee033c5b50a3fec6f8ac965650c53afc997921710773d48e43a53b
Instruction Fuzzy Hash: 4551B171E006049FEB26DFA9D844DAEBBF5FF84310B24802EE80DA7251DB759D41CB98

Function 000DC0C7 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 000DC19B
IsRectEmpty.USER32(?), ref: 000DC1B4
GetClientRect.USER32(?,?), ref: 000DC1CC
SetRectEmpty.USER32(?), ref: 000DC1E2

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$ClientException@8Throw
String ID:
API String ID: 1670096423-0
Opcode ID: 5960c64e5dcfeb96e85fb5d579025af5cb6bf09a4ea9ff91a813007d397657a4
Instruction ID: cd493b43721af3cea0f652c66cde94ef0a1439807af93e788c5ee7713dffed21
Opcode Fuzzy Hash: 5960c64e5dcfeb96e85fb5d579025af5cb6bf09a4ea9ff91a813007d397657a4
Instruction Fuzzy Hash: 1B614875A0020A9FDB10DFE8C984EEEBBF5BF49314F14416AE515A7392DB30A940CF60

Function 000C80DF Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 000C8154
GetWindowRect.USER32(?,?), ref: 000C81B1
IsRectEmpty.USER32(?), ref: 000C81C0
OffsetRect.USER32(?,00000000,?), ref: 000C8238

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$OffsetWindow
String ID:
API String ID: 3444667153-0
Opcode ID: 14e3de71e5c69a1cf8e53e52779f8c092c81ecb5421a9d3a35ca0102c3de5e0b
Instruction ID: 51001b7ffb85085cdedf042b5ed08755e0da175856be232952c1cbd45dc2fe90
Opcode Fuzzy Hash: 14e3de71e5c69a1cf8e53e52779f8c092c81ecb5421a9d3a35ca0102c3de5e0b
Instruction Fuzzy Hash: 9A51C771900659DFCF20DFA9C984AEEB7F8BB08700F15856EE915B7250CB70AD41CBA8

Function 000841B0 Relevance: 6.2, APIs: 4, Instructions: 155timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000841D3
GetFileTime.KERNEL32(?,?,?,?), ref: 00084211
GetFileSizeEx.KERNEL32(?,?), ref: 00084229

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: File$SizeTime_memset
String ID:
API String ID: 151880914-0
Opcode ID: 63414a45893879ecb122a03fcd3443bc5b2baf4bf77996d39bdd4e534b98ef31
Instruction ID: 75fbf689194bfe31e52551369e2115d5b5f5c93b061cdbd5af7f45a4ee1156af
Opcode Fuzzy Hash: 63414a45893879ecb122a03fcd3443bc5b2baf4bf77996d39bdd4e534b98ef31
Instruction Fuzzy Hash: 53513C71904705AFCB24EFA8D881CAAB7F8FF583107508A2EF5A6D7691E730E944CB50

Function 001266C6 Relevance: 6.2, APIs: 4, Instructions: 155windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001266CD
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 00126834
SendMessageW.USER32(?,00000150,?,00000000), ref: 00126880
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 001268B2

Part of subcall function 000593A6: __EH_prolog3_GS.LIBCMT ref: 000593B0

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$H_prolog3H_prolog3_
String ID:
API String ID: 1270747201-0
Opcode ID: 8e922a419ed60a4ab5a428732b1582bd1cece6dee708c8c07eba01cea8c08857
Instruction ID: 7ada594f43036b233f8f12c1a49d860fadb417798a1dc327e2ff70b0f59a4db2
Opcode Fuzzy Hash: 8e922a419ed60a4ab5a428732b1582bd1cece6dee708c8c07eba01cea8c08857
Instruction Fuzzy Hash: C7511A71600B049BDB25EF74C891FEEB7A6AF48300F00492DF59BA72A3DB30A945CB51

Function 000BE80F Relevance: 6.2, APIs: 4, Instructions: 151windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 000BE8AB
CreateCompatibleBitmap.GDI32(?,?,?), ref: 000BE8C5

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Part of subcall function 0005A2DA: SelectObject.GDI32(?,?), ref: 0005A2E5

FillRect.USER32(?,00000000), ref: 000BE923
GetObjectW.GDI32(?,00000018,?), ref: 000BE958

Part of subcall function 0012C280: __EH_prolog3.LIBCMT ref: 0012C287
Part of subcall function 0012C280: GetObjectW.GDI32(00000005,00000018,?), ref: 0012C375

Part of subcall function 000583B9: __EH_prolog3_catch.LIBCMT ref: 000583C0
Part of subcall function 000583B9: FindResourceW.KERNEL32(?,?,00000005,00000024,000BE5BC,?,?,?), ref: 000583F6
Part of subcall function 000583B9: LoadResource.KERNEL32(?,00000000,?,?), ref: 000583FE
Part of subcall function 000583B9: LockResource.KERNEL32(?,00000024,000BE5BC,?,?,?), ref: 0005840F

Part of subcall function 000BE317: __EH_prolog3.LIBCMT ref: 000BE31E
Part of subcall function 000BE317: ~_Task_impl.LIBCPMT ref: 000BE362
Part of subcall function 000BE317: ~_Task_impl.LIBCPMT ref: 000BE371
Part of subcall function 000BE317: ~_Task_impl.LIBCPMT ref: 000BE380

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ObjectResourceTask_impl$CompatibleCreateH_prolog3$BitmapException@8FillFindH_prolog3_catchLoadLockRectSelectThrow
String ID:
API String ID: 2430407417-0
Opcode ID: 56f95d9882963e0e6f0e63697e44b848ff8d55f350484cfce6c7a2d7ed40cd64
Instruction ID: fa7f61213455413abe289157d628d6d9615432fdf384ab1cd9f1f06c7d8b1ce3
Opcode Fuzzy Hash: 56f95d9882963e0e6f0e63697e44b848ff8d55f350484cfce6c7a2d7ed40cd64
Instruction Fuzzy Hash: AF517F75900198EBDB11EB64CD55BEEB7B8EF19301F104199F809A3292DBB15E88CF61

Function 00090594 Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0009059B
InflateRect.USER32(?,000000FF,00000000), ref: 000905C2
InflateRect.USER32(?,000000FF,000000FE), ref: 000905E0
FillRect.USER32(?,?,000000FF), ref: 000905FD

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$Inflate$FillH_prolog3_
String ID:
API String ID: 3515757206-0
Opcode ID: cb15df46bf8366ac9b9525796590bc1891cab4da887b5248248198efb6448b83
Instruction ID: 0800d9446e3e5eed38585ddea6d4a3966806e43af777f2c75cd8b05f4272aba3
Opcode Fuzzy Hash: cb15df46bf8366ac9b9525796590bc1891cab4da887b5248248198efb6448b83
Instruction Fuzzy Hash: DB513971A0050EEFCF11EFA4CD81CEE77BAEF48315B14062AF811A2192DB319D59DB60

Function 0006215C Relevance: 6.1, APIs: 4, Instructions: 132windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00062163
SendDlgItemMessageA.USER32(?,?,?,00000000,?), ref: 000622AF

Part of subcall function 0005432D: _malloc.LIBCMT ref: 0005434B

SendDlgItemMessageW.USER32(?,?,0000040B,00000000,?), ref: 0006223B

Part of subcall function 00069E6C: __EH_prolog3.LIBCMT ref: 00069E73

SendDlgItemMessageW.USER32(?,?,0000037C,?,?), ref: 0006226D

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ItemMessageSend$H_prolog3$_malloc
String ID:
API String ID: 2480034192-0
Opcode ID: 90cdee630d610757100dcd98a300dd9c66ef2645f2d87fab48d8f9c6d62529fd
Instruction ID: 678cfc6e90ad9bc6823ba3ee9fb95998fd039e3a2dfdb56c0f5d0650a8ce049c
Opcode Fuzzy Hash: 90cdee630d610757100dcd98a300dd9c66ef2645f2d87fab48d8f9c6d62529fd
Instruction Fuzzy Hash: FC41E270900906ABDF649BA4CC50BFE76F6FF54321F504219FEA1AA1D1D7744E42C790

Function 03170580 Relevance: 6.1, APIs: 4, Instructions: 122networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,76CB4AAF,?,?,?,?,?,03182FB8,000000FF), ref: 031705CE
WSASetLastError.WS2_32(0000000D), ref: 031705E6
LeaveCriticalSection.KERNEL32(?), ref: 031705ED

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 8b452c82d63715cc53fb4228ee2b4ddaf9c987ad520dcd83398cd41b05cbdd5c
Instruction ID: dc7fc02d3a03312d31fee9716cd5dc9c02f99467f91cb1d19e979a41447d7727
Opcode Fuzzy Hash: 8b452c82d63715cc53fb4228ee2b4ddaf9c987ad520dcd83398cd41b05cbdd5c
Instruction Fuzzy Hash: 9B41D2B6604304ABD724CF96D840FABB7B8EB8C720F08462DF916C7680DB71E840CB60

Function 00056A91 Relevance: 6.1, APIs: 4, Instructions: 121registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?,00000000,EFF91FD5,?,?,?,?,0015EDBC,000000FF), ref: 00056B47
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,?,?,0015EDBC,000000FF), ref: 00056B83
RegCloseKey.ADVAPI32(?,?,?,?,?,0015EDBC,000000FF), ref: 00056B9E
GetPrivateProfileStringW.KERNEL32(?,?,?,?,00001000,?), ref: 00056C07

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: QueryValue$ClosePrivateProfileString
String ID:
API String ID: 1042844925-0
Opcode ID: e591c4d0d8b849ffcca9c87b14515bb8f6f62df5bb33c5819b3bb0e8dce0cfc9
Instruction ID: 2f48057849749d02f040a96305ba96cf2c84384ebe8df6faa5dac03651e507f3
Opcode Fuzzy Hash: e591c4d0d8b849ffcca9c87b14515bb8f6f62df5bb33c5819b3bb0e8dce0cfc9
Instruction Fuzzy Hash: D0413C71D00328DBDB359F14CC489DEBBB9EB48311F50459AF909A3292DB319E98DFA0

Function 0007636C Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0007642C
SetRectEmpty.USER32(?), ref: 00076439
SetRectEmpty.USER32(?), ref: 000764E7
SetRectEmpty.USER32 ref: 00076544

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 95d051e84e45c5377dd47d977fd1d1efd63b43bcfea3a68194145fb2ddc2969e
Instruction ID: 8e1b6174fc90bb5a93febd9a65af53742b7af084c2926e94582d2db11450e417
Opcode Fuzzy Hash: 95d051e84e45c5377dd47d977fd1d1efd63b43bcfea3a68194145fb2ddc2969e
Instruction Fuzzy Hash: A4518CB1805B858EC360CF7AC9846E6FAE9FF94314F104A2FD0EED2661D7B065819F51

Function 00088185 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00088251
ClientToScreen.USER32(?,?), ref: 00088261
IsWindow.USER32(?), ref: 00088283
ClientToScreen.USER32(?,?), ref: 000882B8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ClientScreenWindow
String ID:
API String ID: 1643562046-0
Opcode ID: d1202d8dbbfc6794d26502c5f23681064771ee3c5b5ccb9bee53570edbf53e81
Instruction ID: 2db6a59d957472ed4fdd79118cd5e062f84920eb05d3fcb7e29b103122e53d89
Opcode Fuzzy Hash: d1202d8dbbfc6794d26502c5f23681064771ee3c5b5ccb9bee53570edbf53e81
Instruction Fuzzy Hash: E1419E75500A00AADF64AF54CC84EBE7BE9FF08341F64846AE9C5D2561EF35ED80CB50

Function 0317C8C9 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0317C8FD
__isleadbyte_l.LIBCMT ref: 0317C930
MultiByteToWideChar.KERNEL32(00000080,00000009,03174309,?,00000000,00000000,?,?,?,?,03174309,00000000), ref: 0317C961
MultiByteToWideChar.KERNEL32(00000080,00000009,03174309,00000001,00000000,00000000,?,?,?,?,03174309,00000000), ref: 0317C9CF

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 020862bfde455786c38153ddbd5371843da5400f06a2d838c22952b7f35da02a
Instruction ID: 3dd199501a6d19258ae67c621565cf09d77f864c0263eabc8ca3b5b58bf3bbd4
Opcode Fuzzy Hash: 020862bfde455786c38153ddbd5371843da5400f06a2d838c22952b7f35da02a
Instruction Fuzzy Hash: 4731A331A04346EFDB60DFA8C880ABE7BB5BF09311F1D45A9E595AB191D730D980DB90

Function 0015A635 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0015A669
__isleadbyte_l.LIBCMT ref: 0015A69C
MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000,?,?,?,8007000E,00000000,00000000), ref: 0015A6CD
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,00000000,00000000,?,?,?,8007000E,00000000,00000000), ref: 0015A73B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 65cb63d23e2055904f5126b0add0893c786f9b4679e70dee5292f8f767066051
Instruction ID: dd857f3c8b25a75dc8920fe696f6c33ab504dc3a183d3cfc055af8de453864b7
Opcode Fuzzy Hash: 65cb63d23e2055904f5126b0add0893c786f9b4679e70dee5292f8f767066051
Instruction Fuzzy Hash: 6531C231A44246EFCF20DF64C8809BA3BB5BF05312B998668E8B18F191E730DD44DB52

Function 000CC250 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000015), ref: 000CC2AC
SetRectEmpty.USER32(?), ref: 000CC303
SetRectEmpty.USER32(?), ref: 000CC30C
SetRectEmpty.USER32(?), ref: 000CC31B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect$MetricsSystem
String ID:
API String ID: 4159773870-0
Opcode ID: 0624eb0d69655e5fa2f177359ca0dc375058922321cf6aa6db6a08a0ea9bda2e
Instruction ID: 99e8b6198ba04a9dd63b7eefbeeb76efc2b011b00aefaeb0d50873cc0a7d0261
Opcode Fuzzy Hash: 0624eb0d69655e5fa2f177359ca0dc375058922321cf6aa6db6a08a0ea9bda2e
Instruction Fuzzy Hash: E0310771A00259DFDF00DFA8D989AEE77B5FF45304F1801BAED09AF146D670AA45CBA0

Function 000BC6FE Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000BC72D
GetParent.USER32(?), ref: 000BC736

Part of subcall function 00059D84: ScreenToClient.USER32(?,?), ref: 00059D95
Part of subcall function 00059D84: ScreenToClient.USER32(?,?), ref: 00059DA2

OffsetRect.USER32(?,00000000,?), ref: 000BC777
OffsetRect.USER32(?,?,00000000), ref: 000BC789

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$ClientOffsetScreen$ParentWindow
String ID:
API String ID: 182828750-0
Opcode ID: 6290e111253e250ac7fe1ab6898a40596d16ef5f63fb910eead0887a675e590e
Instruction ID: 684aa20d8aa64a652374e515eb60b8e15410d8f326ef0c58a77b02c4b6eefe76
Opcode Fuzzy Hash: 6290e111253e250ac7fe1ab6898a40596d16ef5f63fb910eead0887a675e590e
Instruction Fuzzy Hash: 37211DB1A04109AFEB14EFA9DD88DFFBBF9FB88300B104519F446E2251DB749A40CA61

Function 0316F060 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,76CB4AAF,?,?,?,?,00000000,03182FB8,000000FF,?,0316F7FB,?,?,?), ref: 0316F092
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00000000,03182FB8,000000FF,?,0316F7FB,?,?,?), ref: 0316F0AB
LeaveCriticalSection.KERNEL32(?), ref: 0316F11C
SetEvent.KERNEL32(?), ref: 0316F137

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: e0a86221d3677ef5fe15ac2c4a3325f0e679d17b7fb187105fecc75a6edbebd4
Instruction ID: 3cb2d749b0b99276270f68b50ea12b4cc67ba1bebf20873d4e01690b2e908bcf
Opcode Fuzzy Hash: e0a86221d3677ef5fe15ac2c4a3325f0e679d17b7fb187105fecc75a6edbebd4
Instruction Fuzzy Hash: 05314FB2604605DFC314DF69D980AAAFBF5FB4D711F50866EE55AC7340DB31A842CB90

Function 000A6303 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 000A6324
ScreenToClient.USER32(?,00000000), ref: 000A6331
SetCursor.USER32 ref: 000A635E
PtInRect.USER32(?,00000000,00000000), ref: 000A63C8

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Cursor$ClientRectScreen
String ID:
API String ID: 2390797981-0
Opcode ID: 4d252ec04d039c10deb625bdc1ead3c89132c7b02f57a0a57cbcb7973b80c7da
Instruction ID: bd4c84278971ff09b998d1b00377f597ce5c7a5fd3f535fb68a7ea45ac46edab
Opcode Fuzzy Hash: 4d252ec04d039c10deb625bdc1ead3c89132c7b02f57a0a57cbcb7973b80c7da
Instruction Fuzzy Hash: 11218B33500609EFCF609FA4C948AAEBBFAFB41311F144429E046D2020DBB1EB82DB50

Function 03161190 Relevance: 6.1, APIs: 4, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 031611C9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 03161206
_memmove.LIBCMT ref: 03161222
VirtualFree.KERNEL32(?,00000000,00008000), ref: 03161235

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4_memmove
String ID:
API String ID: 1828152804-0
Opcode ID: a8c212a8b1d6381ba75eec3fe0534bf7683eaec814d9a122768bd08e9a418076
Instruction ID: 1d790abe888662169338cbc71a42da1d71e09c5f800c8650d524a76007edb8cd
Opcode Fuzzy Hash: a8c212a8b1d6381ba75eec3fe0534bf7683eaec814d9a122768bd08e9a418076
Instruction Fuzzy Hash: 81219575E00705AFDB14DFADD845B6EBBF8FF48705F0085ADE959A2640EB30A8508754

Function 000945D9 Relevance: 6.1, APIs: 4, Instructions: 73keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 000945F0
GetCursorPos.USER32(?), ref: 00094636
SetRectEmpty.USER32(?), ref: 0009464C
IsRectEmpty.USER32(?), ref: 00094676

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect$CursorState
String ID:
API String ID: 2369637639-0
Opcode ID: 77cbff8425b6b9f585762ec4010ce48a5f9ebd7ee70912f1a30f70395c79d7f9
Instruction ID: a4275c1ff08276a410a10daa0ecc6e8ff1bc05ba9d64b50fa95018797e73fbe3
Opcode Fuzzy Hash: 77cbff8425b6b9f585762ec4010ce48a5f9ebd7ee70912f1a30f70395c79d7f9
Instruction Fuzzy Hash: 9D21FCB1A00219AFCF51DFA5DD45DFEBBBCEB49740B11042AE501E3210EB749A459BA1

Function 000AE8AB Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000AE8B2
GetSystemPaletteEntries.GDI32(?,00000000,00000100,00000004), ref: 000AE91A
CreatePalette.GDI32(00000000), ref: 000AE965

Part of subcall function 000AE48E: GetObjectW.GDI32(?,00000002,?), ref: 000AE49D

Part of subcall function 0005432D: _malloc.LIBCMT ref: 0005434B

GetPaletteEntries.GDI32(00000000,00000000,00000000,00000004), ref: 000AE94C

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Palette$Entries$CreateH_prolog3ObjectSystem_malloc
String ID:
API String ID: 437169817-0
Opcode ID: e469ea8394b13c2dc5dd87439342d49d6017ac6664ab7dfcd099786562146074
Instruction ID: 9385dad539b93e17e9f0e8929d06767ba6ef940c1afe0579228aeacd7a97b0c3
Opcode Fuzzy Hash: e469ea8394b13c2dc5dd87439342d49d6017ac6664ab7dfcd099786562146074
Instruction Fuzzy Hash: 5521B072600200ABDB54AFA4DC45FDF77B4EF4A311F148029FA4ADB1A2DF749944CB61

Function 031610E0 Relevance: 6.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0316110F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0316113F
_memmove.LIBCMT ref: 0316115B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 03161172

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4_memmove
String ID:
API String ID: 1828152804-0
Opcode ID: b8918fbbe2b63bf9ce2a6bc92135768018d50dc377c3faf271bca8ff0959c54f
Instruction ID: 4c499276da13fcb8fa6a3daff9f8fe3493035c548331b7499f8581420af71401
Opcode Fuzzy Hash: b8918fbbe2b63bf9ce2a6bc92135768018d50dc377c3faf271bca8ff0959c54f
Instruction Fuzzy Hash: 4A118470E00705AFDB14DFAAD845B6EBBF8FF08705F048569E959E2240EB70A8508754

Function 00058894 Relevance: 6.1, APIs: 4, Instructions: 62windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0005889B

Part of subcall function 0005432D: _malloc.LIBCMT ref: 0005434B

__CxxThrowException@8.LIBCMT ref: 000588E0
FormatMessageW.KERNEL32(00001100,00000000,?,00000800,8007000E,00000000,00000000,?,8007000E,0019E2C4,00000004,00053CDC,8007000E), ref: 0005890A
LocalFree.KERNEL32(8007000E,00053CDC,8007000E), ref: 00058938

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc
String ID:
API String ID: 1776251131-0
Opcode ID: 3a3bb4f1101a7cdac29a872bad754e8d5ba9caa5b9f6efded5d4806b6f588859
Instruction ID: 3ed31b0530bd09231a3361518376d0dc5e434218dadbb281919a39e83df6776f
Opcode Fuzzy Hash: 3a3bb4f1101a7cdac29a872bad754e8d5ba9caa5b9f6efded5d4806b6f588859
Instruction Fuzzy Hash: 6411BF71A00348AFDB10AFA4CC01ABF37A9FF54721F24C519FD65AB2A1DB708A548B91

Function 03169D50 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03169D73
_free.LIBCMT ref: 03169DB5
GetProcessHeap.KERNEL32(00000000,00000000,03169B75), ref: 03169DDC
HeapFree.KERNEL32(00000000), ref: 03169DE3

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Heap_free$FreeProcess
String ID:
API String ID: 1072109031-0
Opcode ID: 4dc4de2a1029f38517445826577c4b5df9ab466c8aeab7e5047977b1caa61fc6
Instruction ID: ae774101128019dbf6360df636cd8deaea5a49f9648bcba31c3cfc1c8b6b2a4b
Opcode Fuzzy Hash: 4dc4de2a1029f38517445826577c4b5df9ab466c8aeab7e5047977b1caa61fc6
Instruction Fuzzy Hash: CF116075600700ABD730DB95CC45F57B3E9BF88710F18892CE59A47A84D734F852CB51

Function 000E6375 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000146,00000000,00000000), ref: 000E6399
SendMessageW.USER32(?,00000150,?,00000000), ref: 000E63AF
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 000E63C4
SendMessageW.USER32(?,0000014E,?,00000000), ref: 000E6406

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e41461b0ecdec66144aefa7cd0552d8771ad19e266adc7952fd7f51bcf311d5
Instruction ID: b52a030f32d3570c6b14ee539700422230a574fe7e228e231d443930d64f11c8
Opcode Fuzzy Hash: 3e41461b0ecdec66144aefa7cd0552d8771ad19e266adc7952fd7f51bcf311d5
Instruction Fuzzy Hash: 53117C71600684BFEB219B75DD41FABB7E9EB54381F20443AF606F62A1D671AE00DB24

Function 0316E1B0 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0316E1CE
TranslateMessage.USER32(?), ref: 0316E1F1
DispatchMessageW.USER32(?), ref: 0316E1F7
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0316E205

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: a7c770533d7f0142e296087afc8b66178fe0155fcdd4cddfd8a63e69ee4e730b
Instruction ID: 92b3deac10b00780c6811a304d410a1d3225a8cc9b485dcc872c737dc0c2b2dd
Opcode Fuzzy Hash: a7c770533d7f0142e296087afc8b66178fe0155fcdd4cddfd8a63e69ee4e730b
Instruction Fuzzy Hash: DD01D436B5020967EB20E6E9BC81FEAB7ADD78C720F140257FA04D7080DAA5E45186F4

Function 00056725 Relevance: 6.1, APIs: 4, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 00056762
RegCloseKey.ADVAPI32(00000000), ref: 0005676B
swprintf.LIBCMT ref: 00056788
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00056799

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: 2dc642ee7b66bd78ec42223220aea557e07fd2c1bdcaac045a21612d3711d122
Instruction ID: 4a97652ff7143e016abcd762416ddb9c578bcca982d745f9625a024126ad9cd2
Opcode Fuzzy Hash: 2dc642ee7b66bd78ec42223220aea557e07fd2c1bdcaac045a21612d3711d122
Instruction Fuzzy Hash: A601C032600309BBDB20AF648C86FAF77ECEF48719F500419FA01A7280DBB5ED1487A0

Function 0316B150 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0316AF50: _free.LIBCMT ref: 0316AF8C

HeapDestroy.KERNEL32(00000000,76CB4AAF,?,?,?,?,03182D33,000000FF), ref: 0316B190
HeapCreate.KERNEL32(00000001,?,?,76CB4AAF,?,?,?,?,03182D33,000000FF), ref: 0316B1A2
_free.LIBCMT ref: 0316B1B2
HeapDestroy.KERNEL32(?,?,?,?,?,03182D33,000000FF), ref: 0316B1E0

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Heap$Destroy_free$Create
String ID:
API String ID: 3093871995-0
Opcode ID: 27f8e43c359d6ec20aa5116ff12f3c72f3f8ab56b2c411e0bbddbc6b4168573d
Instruction ID: 5604174eadb67e43d1c83deb15470f362427a0618a0265b7f5ff111afc07f99d
Opcode Fuzzy Hash: 27f8e43c359d6ec20aa5116ff12f3c72f3f8ab56b2c411e0bbddbc6b4168573d
Instruction Fuzzy Hash: 0E1116B6904704AFD724DF55E848B57B7F8EB08714F044A1DE89693740DB74A944CBA0

Function 000800E2 Relevance: 6.1, APIs: 4, Instructions: 52fileCOMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00080100
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00080119
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0008014C
DragFinish.SHELL32(?), ref: 00080174

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Drag$FileQuery$ActiveFinishWindow
String ID:
API String ID: 892977027-0
Opcode ID: 5ecf38850a811aca52435ec15549af01468604ef1eb642c14783d48457714038
Instruction ID: a467ccc144900ca640f5870d7e7346fef3a4613dacb17324175fe3fe591eac97
Opcode Fuzzy Hash: 5ecf38850a811aca52435ec15549af01468604ef1eb642c14783d48457714038
Instruction Fuzzy Hash: 3D112E71940218ABCB10EF64DC8DBEEB7B9FF54311F100595E559A7192CBB4AA84CFA0

Function 000A2AD5 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 000A2B12
GetSystemMetrics.USER32(0000002D), ref: 000A2B26
GetSystemMetrics.USER32(00000002), ref: 000A2B2E
SendMessageW.USER32(?,0000101E,00000000,00000000), ref: 000A2B46

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: MetricsSystem$ClientMessageRectSend
String ID:
API String ID: 2251314529-0
Opcode ID: 189bf4d8cc899a8f993e61b8a0e78e5dcbe22e5cc93699f532cc3088387d6902
Instruction ID: 49aa564c60da491f90218d091a92b9d2def90d39d75d05366ed669d2d5ccd0a7
Opcode Fuzzy Hash: 189bf4d8cc899a8f993e61b8a0e78e5dcbe22e5cc93699f532cc3088387d6902
Instruction Fuzzy Hash: 44016572A00214AFCB10EFB9CD85AAEBBF5EB48300F110176E945F7691D7B09D44CB60

Function 000D8410 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

WindowFromPoint.USER32(?,?), ref: 000D8429
GetParent.USER32(00000000), ref: 000D8437
ScreenToClient.USER32(00000000,?), ref: 000D8458
IsWindowEnabled.USER32(00000000), ref: 000D8471

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$ClientEnabledFromParentPointScreen
String ID:
API String ID: 1871804413-0
Opcode ID: 53efe9de321892c48a25c2d65589c18b70ba8cff4e4218671a3b7fae2ab8181f
Instruction ID: 0e9cbf6739f3847085d576c601ba0eb7d486f60d06b5f510ce7b9b4d27f7364b
Opcode Fuzzy Hash: 53efe9de321892c48a25c2d65589c18b70ba8cff4e4218671a3b7fae2ab8181f
Instruction Fuzzy Hash: CA017C36600611AB87129B98DC04DAEBBBAEF89740B14806AF901D7310EF70DE01DBE4

Function 000BC4DB Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 000BC4F1

Part of subcall function 000BC01A: GetWindowRect.USER32(?,?), ref: 000BC030
Part of subcall function 000BC01A: GetParent.USER32(?), ref: 000BC072
Part of subcall function 000BC01A: GetParent.USER32(?), ref: 000BC082

ScreenToClient.USER32(?,?), ref: 000BC519
SetCapture.USER32(?), ref: 000BC539
GetWindowRect.USER32(?,?), ref: 000BC574

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: ParentRectWindow$CaptureClientCursorScreen
String ID:
API String ID: 3234571238-0
Opcode ID: cbfb9db60d5d880e979934bf55fedb8d025587ac119becb3a504768d45262bf8
Instruction ID: f3ad42ddd279691bca28ac6b5ef23e213dd18e8a880e99bba6da69b600abe3ef
Opcode Fuzzy Hash: cbfb9db60d5d880e979934bf55fedb8d025587ac119becb3a504768d45262bf8
Instruction Fuzzy Hash: A3113671600608EFDB25DF64CC08BEABBF9FF48305F044469E48A93261DBB5AA84CB50

Function 000EA37E Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00000000), ref: 000EA39B

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CountItemMenu
String ID:
API String ID: 1409047151-0
Opcode ID: 6a592fb7511f19b245660490997435cb9edaba3b14bd231e289636a7c603dc51
Instruction ID: 2391df580eb663d066bf33f87506673ecca55d26a5dab5eb6fcebe885d46a860
Opcode Fuzzy Hash: 6a592fb7511f19b245660490997435cb9edaba3b14bd231e289636a7c603dc51
Instruction Fuzzy Hash: F3016275710298FFDB115B76DC8497E7AA9EB8A750F204425F405F2110E6B0EF81AB61

Function 000943D4 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0009440F
DestroyWindow.USER32(?), ref: 0009442B
IsWindow.USER32(?), ref: 0009444A
DestroyWindow.USER32(?), ref: 0009445A

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Destroy
String ID:
API String ID: 3707531092-0
Opcode ID: 39103ff8d36677076c3247970996b66566b480decb5f3868a14abd8cbcd587f9
Instruction ID: a6f5456ce9a3345a32bffd2184f06bd1bcdee6a3d8430fa1f68f37a39c18a90e
Opcode Fuzzy Hash: 39103ff8d36677076c3247970996b66566b480decb5f3868a14abd8cbcd587f9
Instruction Fuzzy Hash: CF019E32201604AFEF219B74DC84FE6BBFAFF80762F154229F55882151DB75AC51EEA0

Function 03179878 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0317989E

Part of subcall function 031796CA: __fltout2.LIBCMT ref: 031796F5

__cftog_l.LIBCMT ref: 031798C4
__cftoe_l.LIBCMT ref: 031798F6

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 434fb47ce8988213172da6f270e1b15cfb447430989ce201ab717093f6891dc3
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: B711693640018EBBCF169E94CC51CEE3F36BB1D254B4D8855FA1868130C736C9B5AB81

Function 000EA9EA Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 000EAA0E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 000EAA23
IsWindow.USER32(?), ref: 000EAA31
SetWindowLongW.USER32(?,000000F0,?), ref: 000EAA41

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 1752fbc2c43071212315da5c2dfd6699c66d6ba6d8a397cc6a868c683f30809b
Instruction ID: d0e0c851af570fe44e71e1351700bfaba13e40adacce32221699f007fbb9ca5a
Opcode Fuzzy Hash: 1752fbc2c43071212315da5c2dfd6699c66d6ba6d8a397cc6a868c683f30809b
Instruction Fuzzy Hash: 7001D671204200BFCB009B798C44EAA76ECEF49331B250754F062E22D2DB74E8408A94

Function 0006EA50 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,00000002,00000002), ref: 0006EA8C
InvalidateRect.USER32(?,?,00000001), ref: 0006EA9D
UpdateWindow.USER32(?), ref: 0006EAA6
SetRectEmpty.USER32(?), ref: 0006EAB3

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyInflateInvalidateUpdateWindow
String ID:
API String ID: 3040190709-0
Opcode ID: a0efb2c4c64e5b49fdc83d373e322f5486cbee86479122947cca8735479d4357
Instruction ID: 9950d4ddfb0a5b46ecc7baf23c7da19518485a6e5733e285bb148e606ca907b5
Opcode Fuzzy Hash: a0efb2c4c64e5b49fdc83d373e322f5486cbee86479122947cca8735479d4357
Instruction Fuzzy Hash: 320196B15002059BCB00DF98DC89ADA7BB8FF45724F110275ED45EE0A5CB705545CFA0

Function 0006265C Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,000000F0), ref: 00062682
LoadResource.KERNEL32(?,00000000), ref: 0006268E
LockResource.KERNEL32(00000000), ref: 0006269B
FreeResource.KERNEL32(00000000,00000000), ref: 000626B7

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: df9f9a7ab77a709ed86c9d9d86b970ca2340ea3495bf83e0d8cf787ce1e8b51f
Instruction ID: cced8715d89debae031e421e1d541dbeb4765b0bd22c28fc6d6e35f9961c7c02
Opcode Fuzzy Hash: df9f9a7ab77a709ed86c9d9d86b970ca2340ea3495bf83e0d8cf787ce1e8b51f
Instruction Fuzzy Hash: 0EF0C2362006016F97105FEADC849ABB6EEEFD57517044038FE05E7211DFB0DD1587A4

Function 03166E40 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(03191D84,00000000), ref: 03166E63
CreateCompatibleDC.GDI32(00000000), ref: 03166E75
SelectObject.GDI32(00000000,?), ref: 03166E83
SetDIBColorTable.GDI32(00000000,00000000,00000000,?,00000000,?,03166902,?,?,?,00000000), ref: 03166E9C

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ColorCompatibleCreateExchangeInterlockedObjectSelectTable
String ID:
API String ID: 2661342499-0
Opcode ID: 369c55f66b6e962b5902e9b3bac4a5c7e8e9899593dc6782df39d71ebf9635df
Instruction ID: 41d755bc1756a6466e4758913146951e599b73d008deb6d67801eb86f58464c6
Opcode Fuzzy Hash: 369c55f66b6e962b5902e9b3bac4a5c7e8e9899593dc6782df39d71ebf9635df
Instruction Fuzzy Hash: 940186B6900214ABDB14EFA5DD84FE7B7ADEB4C320F11416AED08D7205DB71EC90C6A5

Function 000629EF Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00062A04
GetParent.USER32(?), ref: 00062A13
GetParent.USER32(?), ref: 00062A29
SetFocus.USER32(?,00000000), ref: 00062A3F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Parent$Focus
String ID:
API String ID: 384096180-0
Opcode ID: 978a93dac5cd8c15fb6cc292163565162f1fbc1dd1d14896f0260f4fb105c5d5
Instruction ID: 1e55fc4172e1b32df1f8312c6b0a7f80129e82e752b222b7a9976795435576d3
Opcode Fuzzy Hash: 978a93dac5cd8c15fb6cc292163565162f1fbc1dd1d14896f0260f4fb105c5d5
Instruction Fuzzy Hash: 9CF049325007809BCB34BBB1DC18A9B7AFBBFC4312F050969E8C183662DF74D804CA60

Function 000585B8 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000005), ref: 000585D4
LoadResource.KERNEL32(?,00000000), ref: 000585DC
LockResource.KERNEL32(00000000), ref: 000585E9
FreeResource.KERNEL32(00000000,00000000,?,?), ref: 00058601

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 262b781448d13cd0da929ff2722de0ecc26b033bf989088c8f0ff952aa0ff712
Instruction ID: 33645fcbcf4934548b7c51caedbda3a1bb7cfd6e8dfd7b14d5fae85017757b59
Opcode Fuzzy Hash: 262b781448d13cd0da929ff2722de0ecc26b033bf989088c8f0ff952aa0ff712
Instruction Fuzzy Hash: B9F05436501514BFC7016BE99C4CCAFBBADEF957617018019FE05A3211DEB49D0587E4

Function 00058524 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000001), ref: 00058544
GetActiveWindow.USER32 ref: 0005854F
SetActiveWindow.USER32(?,?,00000024,000BE5BC,?,?,?), ref: 0005855D
FreeResource.KERNEL32(?,?,00000024,000BE5BC,?,?,?), ref: 00058579

Part of subcall function 00062961: EnableWindow.USER32(?,?), ref: 00062972

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: dcf62a3909c58a331b796b9c5ebb0df0e5627e35a4138fd89da894fc21c0d36a
Instruction ID: 4b645d7ba864d35712493d35c314a0240fae7374df87ec1412f83f3adbf2d62c
Opcode Fuzzy Hash: dcf62a3909c58a331b796b9c5ebb0df0e5627e35a4138fd89da894fc21c0d36a
Instruction Fuzzy Hash: C4F03C34A00A04CFCF12EB64CD855BEB7F2BF58702B504458E94272261DB715D81CF61

Function 001368F7 Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0006291F: ShowWindow.USER32(00000000,?,?,00056473,00000000,00000000,00000363,00000001,00000000,00000001,00000001,?,00000000,00000363,00000001,00000000), ref: 00062930

UpdateWindow.USER32(?), ref: 00136924
UpdateWindow.USER32(?), ref: 00136930
SetRectEmpty.USER32(?), ref: 0013693C
SetRectEmpty.USER32(?), ref: 00136945

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Window$EmptyRectUpdate$Show
String ID:
API String ID: 1262231214-0
Opcode ID: b96789addff9234d531a914849ba034fd7f3710c33ddbe6293a2511255c14219
Instruction ID: 4f699e7aa610a4608d35b95ceac2090d81c54268648e7f9f8053eedaa5146a00
Opcode Fuzzy Hash: b96789addff9234d531a914849ba034fd7f3710c33ddbe6293a2511255c14219
Instruction Fuzzy Hash: 26F08C32200B18AFE722AB25DC00B57B7E9BFC0714F0A4129E1D5A7470CB70E801CBA0

Function 000BE317 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000BE31E

Part of subcall function 00074CEB: __EH_prolog3.LIBCMT ref: 00074CF2

Part of subcall function 001023D3: __EH_prolog3.LIBCMT ref: 001023DA

Part of subcall function 0012AB90: __EH_prolog3.LIBCMT ref: 0012AB97
Part of subcall function 0012AB90: DestroyIcon.USER32(?,00000004,000BE358,00000004,000BE5D7,?,?,?), ref: 0012ABBA
Part of subcall function 0012AB90: DestroyIcon.USER32(?,?,?), ref: 0012ABC2
Part of subcall function 0012AB90: DestroyIcon.USER32(?,?,?), ref: 0012ABCA
Part of subcall function 0012AB90: DestroyIcon.USER32(?,?,?), ref: 0012ABD2
Part of subcall function 0012AB90: DestroyIcon.USER32(?,?,?), ref: 0012ABDA
Part of subcall function 0012AB90: DestroyIcon.USER32(?,?,?), ref: 0012ABE2
Part of subcall function 0012AB90: ~_Task_impl.LIBCPMT ref: 0012AC1C

~_Task_impl.LIBCPMT ref: 000BE362

Part of subcall function 000E0177: __EH_prolog3.LIBCMT ref: 000E017E

~_Task_impl.LIBCPMT ref: 000BE371
~_Task_impl.LIBCPMT ref: 000BE380

Part of subcall function 000533E0: std::bad_exception::~bad_exception.LIBCMTD ref: 00053428

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: DestroyIcon$H_prolog3$Task_impl$std::bad_exception::~bad_exception
String ID:
API String ID: 757558138-0
Opcode ID: fb555a5358e04dc8539d072e5bd04fcb1ae97de2fd16b2e78e69245e6b2e563e
Instruction ID: 4800c79fc600cc4b98669d85e9872f5f6421d7314c545a21425c511a8537f215
Opcode Fuzzy Hash: fb555a5358e04dc8539d072e5bd04fcb1ae97de2fd16b2e78e69245e6b2e563e
Instruction Fuzzy Hash: B9F08C74405784CED715FBB4C1553DDBAA0AF2A300F84418CE4AA232C3CFB41B08CA62

Function 0316A680 Relevance: 6.0, APIs: 4, Instructions: 27threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,03169DF0,00000000,00000000,00000000), ref: 0316A697
CreateThread.KERNEL32(00000000,00000000,0316A2E0,00000000,00000000,00000000), ref: 0316A6AA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0316A6AF
Sleep.KERNEL32(0000012C), ref: 0316A6BA

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: CreateThread$ObjectSingleSleepWait
String ID:
API String ID: 1183137808-0
Opcode ID: 175b6eeeca1366c968e83469144e9cf0179221a4e252e059695013d147c3b54f
Instruction ID: 64cb710bf0bc2d5dc6d09053a342b8e68fbbe4318e3f385fda32f412b889c025
Opcode Fuzzy Hash: 175b6eeeca1366c968e83469144e9cf0179221a4e252e059695013d147c3b54f
Instruction Fuzzy Hash: ACE0EC317C832177F53426A66C0BF8E2A55974EF71F310101B3207E0C58ED0349186AC

Function 031617F0 Relevance: 6.0, APIs: 4, Instructions: 21synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 03161800
Sleep.KERNEL32(000003E8), ref: 03161807
InterlockedExchange.KERNEL32(?,00000000), ref: 03161813
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0316181F

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ObjectSingleWait$ExchangeInterlockedSleep
String ID:
API String ID: 3621840306-0
Opcode ID: 521ca31cc91a63117d84f4b00c7e11cd23d66bb5367b61b3c3795b9cf60cb235
Instruction ID: c48e4075412d18c790bab3608cadb44cf193164752b793c8af0a1b6880a5616f
Opcode Fuzzy Hash: 521ca31cc91a63117d84f4b00c7e11cd23d66bb5367b61b3c3795b9cf60cb235
Instruction Fuzzy Hash: B0E0E67A10821167C664B7ABFD44D4777A9EBCD731B114719B621936C48D70B4418B74

Function 0316DFD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

recv sn=%lu, xrefs: 0316E093

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID:
String ID: recv sn=%lu
API String ID: 0-1144994348
Opcode ID: 617d939cf41d74ec338a939a28482b59d6253cb5ffc772abb2e7607753499e8e
Instruction ID: 7cd8e18ec15cda718a4cfccbd56f32eb7ad808a992efe5c908022880fff7e0b5
Opcode Fuzzy Hash: 617d939cf41d74ec338a939a28482b59d6253cb5ffc772abb2e7607753499e8e
Instruction Fuzzy Hash: 20516879600B019FD710CF59C680B9AF7F5FF48310F2886A9D8598B650E771E964CBA0

Function 03169080 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 031690F6
_memmove.LIBCMT ref: 0316914C

Part of subcall function 03168EB0: std::_Xinvalid_argument.LIBCPMT ref: 03168EC7

Strings

string too long, xrefs: 031690F1

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: c735cc10851fdc1f7afeedad49abb9dc8f34d980215e322f1afb2f5b6480ca14
Instruction ID: f55b7fffdc39209822d70e7eb763f643aca6dd3f94a1600bdcf07d79c00b46dd
Opcode Fuzzy Hash: c735cc10851fdc1f7afeedad49abb9dc8f34d980215e322f1afb2f5b6480ca14
Instruction Fuzzy Hash: 6731A1767006119B8714DE9DE8D486AF3AAEFD9271314053AE609CB600D731AC75C7B5

Function 000908E2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 000908E9
InflateRect.USER32(?,000000FD,000000FD), ref: 0009093F

Strings

%d%%, xrefs: 000909A2

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3_InflateRect
String ID: %d%%
API String ID: 3173815319-1518462796
Opcode ID: 840767332f3ee3c5c1a6c06ad1638a9a1787d0be6b573b2cecb479f6e7c6b2d8
Instruction ID: 2476f09a73bf7a6798a795ab005043c302a24181a9e2085a607608d7d190ee0e
Opcode Fuzzy Hash: 840767332f3ee3c5c1a6c06ad1638a9a1787d0be6b573b2cecb479f6e7c6b2d8
Instruction Fuzzy Hash: E1314872601229AFDF54DFA4CC85DEEB7B9FF49700B114559F801AB256D630EE00DBA0

Function 03164F80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03164FF9
_memmove.LIBCMT ref: 0316502C

Part of subcall function 031650B0: std::_Xinvalid_argument.LIBCPMT ref: 031650C8
Part of subcall function 031650B0: std::_Xinvalid_argument.LIBCPMT ref: 031650E6
Part of subcall function 031650B0: _memmove.LIBCMT ref: 0316512A

Strings

string too long, xrefs: 03164FF4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 6e5407543480b3806832efa327eb88d4b8ab78df1f8212e3e5cdc0590d448096
Instruction ID: 98d2a003e505a4f4fb8fd9c3ba04ad7441b7f0edf952e7aa7b3ceb948dc87aae
Opcode Fuzzy Hash: 6e5407543480b3806832efa327eb88d4b8ab78df1f8212e3e5cdc0590d448096
Instruction Fuzzy Hash: CB219E76304606AF8714DEADE8D0C79F3ABFFC9225318412AF601CB650DB71E8B587A5

Function 00092176 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0009217D

Part of subcall function 00059D3E: MoveToEx.GDI32(?,?,?,?), ref: 00059D68
Part of subcall function 00059D3E: MoveToEx.GDI32(?,?,?,?), ref: 00059D79

Part of subcall function 000597C1: MoveToEx.GDI32(?,?,?,00000000), ref: 000597DE
Part of subcall function 000597C1: LineTo.GDI32(?,?,?), ref: 000597ED

Part of subcall function 0005A336: SelectObject.GDI32(?,00000000), ref: 0005A35C
Part of subcall function 0005A336: SelectObject.GDI32(?,?), ref: 0005A372

Strings

iii, xrefs: 000921AC
iii, xrefs: 0009219F

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: Move$ObjectSelect$H_prolog3Line
String ID: iii$iii
API String ID: 3726201289-3499908146
Opcode ID: a2f9c75cde5a2d5bd1eeb27ea3410ec0bae43085ff17701e68f13051cd194792
Instruction ID: 57154c2ae4f672a04bdcc86a418f772fc8a1a0f158de8c4f5b76f2671b3edb2b
Opcode Fuzzy Hash: a2f9c75cde5a2d5bd1eeb27ea3410ec0bae43085ff17701e68f13051cd194792
Instruction Fuzzy Hash: BD314C71A0010AEFCF01EF94C9519EF7BB6AF18701F10852AFD01A7292CB309E26DB61

Function 03168DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03168E3C
_memmove.LIBCMT ref: 03168E82

Part of subcall function 03166000: std::_Xinvalid_argument.LIBCPMT ref: 03166016

Strings

string too long, xrefs: 03168E37

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 325be0924b16dca297f273037c092011c9a191e777cddd63126fb96851b05b3e
Instruction ID: d4dd191c7e43b0e4240efafbaacd8f728d29a7ec4f2bbf50dd9c671a193c9eda
Opcode Fuzzy Hash: 325be0924b16dca297f273037c092011c9a191e777cddd63126fb96851b05b3e
Instruction Fuzzy Hash: 34217F707017508BD735DEECC890A2EE7E6DB9D601B280D59E092CB681D761DCB087A6

Function 03162BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03162BC5
GetMonitorInfoW.USER32 ref: 03162BDB

Strings

h, xrefs: 03162BD3

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: InfoMonitor_memset
String ID: h
API String ID: 741975714-2439710439
Opcode ID: 84ef630458a28b456e086cee5bc1b57f63b118a9c7ff98bef7d506a2c69a8ec4
Instruction ID: 3fda3c357e2c8103ffb0c2f215ba5e5532701d0bb30ba45091e2ceb8ecd2a138
Opcode Fuzzy Hash: 84ef630458a28b456e086cee5bc1b57f63b118a9c7ff98bef7d506a2c69a8ec4
Instruction Fuzzy Hash: 903103B5A047048FC308DF29D44095AB7E6EF88310F148A6EE8558B361EB31E846CF92

Function 00062048 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 0006879E: LeaveCriticalSection.KERNEL32(?,?,000637B1,00000010,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96,00000004,00051031), ref: 000687B9

__CxxThrowException@8.LIBCMT ref: 00062053

Part of subcall function 0014AAA6: RaiseException.KERNEL32(?,?,?,?), ref: 0014AAE8

__snwprintf_s.LIBCMT ref: 000620A4
__snwprintf_s.LIBCMT ref: 000620D6

Part of subcall function 00148FB0: __getptd_noexit.LIBCMT ref: 00148FB0

Strings

Afx:%p:%x, xrefs: 0006209A

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: __snwprintf_s$CriticalExceptionException@8LeaveRaiseSectionThrow__getptd_noexit
String ID: Afx:%p:%x
API String ID: 730118740-3201128726
Opcode ID: da806ba0bedfaa8492c5b3796d36a67f3cbb8bb2bc43bb6443b6457dd09d9077
Instruction ID: 303c9abd93e9fd0e69a7da48c33c9a28fe07cb19882cc11f52ac4786fe639329
Opcode Fuzzy Hash: da806ba0bedfaa8492c5b3796d36a67f3cbb8bb2bc43bb6443b6457dd09d9077
Instruction Fuzzy Hash: 11217C70D00308AFDB11EFA9C841ADEBBF9EF59350F108066F914B7222DBB09944CBA1

Function 0007267D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00072684
SetRectEmpty.USER32(?), ref: 00072714

Strings

Afx:ToolBar, xrefs: 0007271A

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: EmptyH_prolog3_Rect
String ID: Afx:ToolBar
API String ID: 2941628838-177727192
Opcode ID: cbceae87444c16a6fb89af2740d411a5cb2282fe052c9b837eaa9734866c407d
Instruction ID: 000e36531e54de8638abab23a31042872eac57754a81d0cf72ec5a0de44e1ebd
Opcode Fuzzy Hash: cbceae87444c16a6fb89af2740d411a5cb2282fe052c9b837eaa9734866c407d
Instruction Fuzzy Hash: B9217CB1A112199FCB04DFB4C986AEE7BF5FF48350F14412AF515E7281DB349A448BA0

Function 03165DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03165DE4

Part of subcall function 031827F5: std::exception::exception.LIBCMT ref: 0318280A
Part of subcall function 031827F5: __CxxThrowException@8.LIBCMT ref: 0318281F
Part of subcall function 031827F5: std::exception::exception.LIBCMT ref: 03182830

_memmove.LIBCMT ref: 03165E2C

Strings

string too long, xrefs: 03165DDF

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: cafd20a8a7455a707b84b14789fd514ec4a7f9b69f252ce59b8ea74f2b768997
Instruction ID: 55113f3ab2ebc2c6d403b7cb4f4c064f160fb8ce8cdfa9c0affb593707acf9bf
Opcode Fuzzy Hash: cafd20a8a7455a707b84b14789fd514ec4a7f9b69f252ce59b8ea74f2b768997
Instruction Fuzzy Hash: 4511D6365047105FEB24DEBCE8C096FF799AB1A514F280E2EE093C7581D721A46486A9

Function 03168EB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03168EC7

Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 03182857
Part of subcall function 03182842: __CxxThrowException@8.LIBCMT ref: 0318286C
Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 0318287D

Part of subcall function 03165060: std::_Xinvalid_argument.LIBCPMT ref: 0316506D

_memmove.LIBCMT ref: 03168F27

Strings

invalid string position, xrefs: 03168EC2

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 0c2c5b58051d2166af90dce040ae4894478e0ebc0e5b90daee29e287762f7fb8
Instruction ID: ad1965b7d5456d1446c18aae6a1396d18ab1d96b9350aeeb58a045a21ee2f8ae
Opcode Fuzzy Hash: 0c2c5b58051d2166af90dce040ae4894478e0ebc0e5b90daee29e287762f7fb8
Instruction Fuzzy Hash: 4611D3367002118BCB14EEACE88046AF36ABF9D229354496AF4558F240D771E865C7E1

Function 000741D3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000741DA

Part of subcall function 000DABAD: __EH_prolog3.LIBCMT ref: 000DABB4

Part of subcall function 0006289B: GetDlgCtrlID.USER32(?), ref: 000628A4

Strings

%sMFCToolBar-%d, xrefs: 0007422B
%sMFCToolBar-%d%x, xrefs: 00074242

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$Ctrl
String ID: %sMFCToolBar-%d$%sMFCToolBar-%d%x
API String ID: 3879667756-3776508225
Opcode ID: 502ff65d3a0f06998968ae77bf58e79b9021c9d66fbbdad379b3c2007745afa6
Instruction ID: fcb8b877c9772f2914989d982b72a60cae70bd9fd04af61103cba51c27cb8503
Opcode Fuzzy Hash: 502ff65d3a0f06998968ae77bf58e79b9021c9d66fbbdad379b3c2007745afa6
Instruction Fuzzy Hash: 6421AC71E00249ABCF10EFA4CC4A9EFBB79AF55320F004519F915AB293DB709A55CBA1

Function 0316C200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

StrChrW.SHLWAPI(?,0000003A), ref: 0316C225
_swscanf.LIBCMT ref: 0316C25F

Strings

%d.%d.%d.%d%c, xrefs: 0316C259

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _swscanf
String ID: %d.%d.%d.%d%c
API String ID: 2748852333-2398565245
Opcode ID: f0c9c2665f9d81e9f13c61cc23a28fa289145eb3d86069963b8c25db1c1ad2fa
Instruction ID: 478c63d1f71790aa37439936e8f24570adcd9b02b176319271d59572838a6d9e
Opcode Fuzzy Hash: f0c9c2665f9d81e9f13c61cc23a28fa289145eb3d86069963b8c25db1c1ad2fa
Instruction Fuzzy Hash: F8118271B04209ABDB24EBE9D851AFEB3B9DB4D700F14016ED8479B180EB605A5487D1

Function 03165370 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 031653B8
_memmove.LIBCMT ref: 03165409

Strings

@, xrefs: 031653E4

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: _memmove
String ID: @
API String ID: 4104443479-2766056989
Opcode ID: 390077d89bae56a7a455647d903ee5833ef9d782f396aa6a9507ee48ecd92083
Instruction ID: 0a669486299aa6f2f56fa3c132f2e6abc8c8917b72d961899d828d97fba92b2b
Opcode Fuzzy Hash: 390077d89bae56a7a455647d903ee5833ef9d782f396aa6a9507ee48ecd92083
Instruction Fuzzy Hash: 6011D6B6A043049BC724CF98E890AAF73BBEB99604F14452DE5078B201FB74EA55C791

Function 03165D40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03165D52

Part of subcall function 031827F5: std::exception::exception.LIBCMT ref: 0318280A
Part of subcall function 031827F5: __CxxThrowException@8.LIBCMT ref: 0318281F
Part of subcall function 031827F5: std::exception::exception.LIBCMT ref: 03182830

std::_Xinvalid_argument.LIBCPMT ref: 03165D65

Strings

string too long, xrefs: 03165D4D, 03165D60

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 35fd396fec1a08513fad582944ba155bc56d7c3912c40282f87166f3dd0384a6
Instruction ID: b02f0fa086049d5bfcfbab56b2b79fda5a312f7c6d0489432fa60dff47f09631
Opcode Fuzzy Hash: 35fd396fec1a08513fad582944ba155bc56d7c3912c40282f87166f3dd0384a6
Instruction Fuzzy Hash: 0211C2303047908BC371CB6CEC44B1AB7E7ABDA610F280B5DE0918B6C6DB71D8418765

Function 03165FC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 03165FED
std::_Xinvalid_argument.LIBCPMT ref: 03166016

Strings

invalid string position, xrefs: 03166011

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 3614006799-1799206989
Opcode ID: 8b30918243e0f79fcd166db45c0a8e3e265f08a814c8fe089c44ceb491e428e3
Instruction ID: a44633ebc89ea0beb9e3a6eb234d3c356a7b43760b2a5f60fe8aef67cd392af0
Opcode Fuzzy Hash: 8b30918243e0f79fcd166db45c0a8e3e265f08a814c8fe089c44ceb491e428e3
Instruction Fuzzy Hash: D3F0FF326003105BC728EEACD85075AF3EAAF89221F540E3EE0529B6C1CBB2E95487D5

Function 000A446F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000A4476

Part of subcall function 0006A349: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 0006A369

Part of subcall function 000A1ADD: __EH_prolog3.LIBCMT ref: 000A1AE4

Part of subcall function 000A1B1A: __EH_prolog3.LIBCMT ref: 000A1B21

Strings

TRUE, xrefs: 000A44E7
MFCShellTreeCtrl_EnableShellContextMenu, xrefs: 000A44C1

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCShellTreeCtrl_EnableShellContextMenu$TRUE
API String ID: 2949695960-3623726486
Opcode ID: 034c7eeb220ddf1fdff7276a877443c9c0bbfed09cbb5e34ff56c733d09bf521
Instruction ID: cd3ff99b04b75e937125ce0fc1fab0ae4189629f5939fefb2ff7689d6280cb95
Opcode Fuzzy Hash: 034c7eeb220ddf1fdff7276a877443c9c0bbfed09cbb5e34ff56c733d09bf521
Instruction Fuzzy Hash: 6F115B7195111A9ACB04EBF4CD56BFEB3B4AF21301F504618B421B21D3DF749A08CB62

Function 03169190 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0316919F

Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 03182857
Part of subcall function 03182842: __CxxThrowException@8.LIBCMT ref: 0318286C
Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 0318287D

_memmove.LIBCMT ref: 031691DA

Strings

invalid string position, xrefs: 0316919A

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 7269cd6783a2466b4fa2436cd328194eaf101ea8dc330ec9b359247985b3c9c9
Instruction ID: 717b8f465f7b4815c47e5691eae049d97fa5174400f7d05aa0fea2103c653e56
Opcode Fuzzy Hash: 7269cd6783a2466b4fa2436cd328194eaf101ea8dc330ec9b359247985b3c9c9
Instruction Fuzzy Hash: A4017C717006118BC725CFBCED9482AB3F7AFCC6543344A6DD096CBA19EB31E8668794

Function 0316EDD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 0316EE0B
WSAGetLastError.WS2_32(?,0316FF33,?,00000000,000000FF,00000000), ref: 0316EE16

Strings

<C-CNNID: %Iu> send 0 bytes (detect package), xrefs: 0316EE2C

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: ErrorLastsend
String ID: <C-CNNID: %Iu> send 0 bytes (detect package)
API String ID: 1802528911-4236689219
Opcode ID: a61b031331ee4837aa6cb91e3fe2eaddfec6e4e4d9a02ffe31ac2920f7357edc
Instruction ID: 45117f3ae618040779874b3b5f45a7ddb64e9f9f5633213b30a35b776d39c337
Opcode Fuzzy Hash: a61b031331ee4837aa6cb91e3fe2eaddfec6e4e4d9a02ffe31ac2920f7357edc
Instruction Fuzzy Hash: C6012176A017104FD330DFAAE984A57F7F8EBC8725B114A2EE55AC3640D770A4549BA0

Function 03166130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0316613F

Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 03182857
Part of subcall function 03182842: __CxxThrowException@8.LIBCMT ref: 0318286C
Part of subcall function 03182842: std::exception::exception.LIBCMT ref: 0318287D

_memmove.LIBCMT ref: 03166175

Strings

invalid string position, xrefs: 0316613A

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 8df94bcfdd1e269e61f414330a995bd396a08c28de95fe32f602d0f539222cc3
Instruction ID: d5f0d075f92b212aefbed7a6d17d55a296f9cc737ff57ab2c1111d1bc5082fdc
Opcode Fuzzy Hash: 8df94bcfdd1e269e61f414330a995bd396a08c28de95fe32f602d0f539222cc3
Instruction Fuzzy Hash: 660162757047114BD325CEACEDA061AF3E69BC9904B294E2CD0D1CB74AD7B1EC5287A4

Function 000667F5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32(?,?), ref: 0006681A
CopyRect.USER32(?,?), ref: 0006682C

Strings

(, xrefs: 00066813

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CopyInfoMonitorRect
String ID: (
API String ID: 2119610155-3887548279
Opcode ID: de5a53cdcf57f0686bb2cf18cd743e512a0a7e7ba1dbe29ec7a685bf6ba8df59
Instruction ID: 42b6c530c7a3575e85f02330d91df6efdf006afc93a65ec4ff590e5847b6cbfe
Opcode Fuzzy Hash: de5a53cdcf57f0686bb2cf18cd743e512a0a7e7ba1dbe29ec7a685bf6ba8df59
Instruction Fuzzy Hash: F011E571A0060AEFCB50DFA9D98599EB7F9FF08300B508959E49AE3610DB30F944CF60

Function 03169210 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0316921D

Part of subcall function 031827F5: std::exception::exception.LIBCMT ref: 0318280A
Part of subcall function 031827F5: __CxxThrowException@8.LIBCMT ref: 0318281F
Part of subcall function 031827F5: std::exception::exception.LIBCMT ref: 03182830

_memmove.LIBCMT ref: 03169259

Strings

vector<T> too long, xrefs: 03169218

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 36b16c7fb436d6b41daa58fc56e7563229cdd00953daacd0efdcc6f1e762bd87
Instruction ID: c2c9c7fbb21dfdcdb57ec7925b7fa9b9070229cf16d2f10af987947929e54155
Opcode Fuzzy Hash: 36b16c7fb436d6b41daa58fc56e7563229cdd00953daacd0efdcc6f1e762bd87
Instruction Fuzzy Hash: D801A77D9403016BC718FF7DE88486933E4E74DE5070C0A2AD426C7248EF32EA95CAA0

Function 03178447 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03172F7E: __getptd.LIBCMT ref: 03172F84
Part of subcall function 03172F7E: __getptd.LIBCMT ref: 03172F94

__getptd.LIBCMT ref: 03178456

Part of subcall function 031745E4: __getptd_noexit.LIBCMT ref: 031745E7
Part of subcall function 031745E4: __amsg_exit.LIBCMT ref: 031745F4

__getptd.LIBCMT ref: 03178464

Strings

csm, xrefs: 03178472

Memory Dump Source

Source File: 00000000.00000002.1954175558.0000000003160000.00000040.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: true

Associated: 00000000.00000002.1954175558.0000000003195000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3160000_1.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: a12cdc99bdc2cfc7679b56194bb6e6d6ecaa50802c19d73ca7bbfc669c815bde
Instruction ID: ce3bea117fe9fa161612aafeae2e0c9ae802c98563be5bc376a25f002a9fc739
Opcode Fuzzy Hash: a12cdc99bdc2cfc7679b56194bb6e6d6ecaa50802c19d73ca7bbfc669c815bde
Instruction Fuzzy Hash: 66014B388003058BCF34EF65D4897ADBBB9AF08221F6C446ED8469A650CBB59982CB51

Function 0006872C Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(001E0170,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068766
InitializeCriticalSection.KERNEL32(?,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068778
LeaveCriticalSection.KERNEL32(001E0170,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068785
EnterCriticalSection.KERNEL32(?,?,?,?,?,00063797,00000010,00000008,0005B9D6,0005B96D,00055FA4,00055A05,?,0005612F,00000004,00054F96), ref: 00068795

Part of subcall function 00059096: __CxxThrowException@8.LIBCMT ref: 000590AC

Memory Dump Source

Source File: 00000000.00000002.1953262632.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.1953248069.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953345753.000000000016C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953378211.00000000001AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953396333.00000000001B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953416700.00000000001DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953431169.00000000001E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_1.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$Exception@8InitializeLeaveThrow
String ID:
API String ID: 3253506028-0
Opcode ID: ea88690fa994e2c9bb8b31c901072d030399abc3ea4d08311f27aeae83c59f15
Instruction ID: 46ae2efeb0777cbd4d658cf77198614c4159dc201c4ca29f6523255421f53cf1
Opcode Fuzzy Hash: ea88690fa994e2c9bb8b31c901072d030399abc3ea4d08311f27aeae83c59f15
Instruction Fuzzy Hash: 9CF02B735452049FCB112B99DC49B2DB79BFBA1311F18953AF09047592CBB0D9C1CBE1

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1.exe_2262233b1c4a664c14445ff2c18db8ed6a66_c1a861f5_ce72d914-4322-4cd4-93a0-02a51ba4f189\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CE9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E04.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E33.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
1.exe

Function 00067E35 Relevance: 103.8, APIs: 48, Strings: 11, Instructions: 557
libraryloaderstringCOMMON

Function 03162320 Relevance: 89.7, APIs: 38, Strings: 13, Instructions: 447
stringnetworklibraryCOMMON

Function 03169DF0 Relevance: 47.6, APIs: 20, Strings: 7, Instructions: 330
sleepsynchronizationtimeCOMMON

Function 000678DC Relevance: 64.8, APIs: 43, Instructions: 304
COMMONLIBRARYCODE

Function 000B6E09 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 421
windowCOMMONLIBRARYCODE

Function 0316A2E0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223
sleepsynchronizationtimeCOMMON

Function 0316FC80 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 324
threadtimenetworkCOMMON

Function 03163E70 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 165
registrystringCOMMON

Function 03162D40 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164
windowCOMMON

Function 02AC2310 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 120
memoryCOMMON

Function 03162FC0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 99
sleepstringsynchronizationCOMMON

Function 03161410 Relevance: 21.2, APIs: 14, Instructions: 157
networkstringtimeCOMMON

Function 02AC1410 Relevance: 21.2, APIs: 14, Instructions: 157
networkstringtimeCOMMON

Function 03164290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Function 00051660 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128
threadsleepCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre