Edit tour

Windows Analysis Report
1.exe

Overview

General Information

Sample name:	1.exe
Analysis ID:	1582637
MD5:	a2eccd0ac68e32f1763ff60e5b151304
SHA1:	ee8cb670f183d9c38a8c2b40085d160f11fd547b
SHA256:	f29ac22ca60872b1edd94e2411007f37b5cf814a3b3a85df6b162c94c92a3dd5
Tags:	DonutLoaderexeValleyRATuser-lontze7
Infos:

Detection

GhostRat

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected GhostRat

AI detected suspicious sample

Contain functionality to detect virtual machines

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Found evasive API chain (may stop execution after checking mutex)

Found stalling execution ending in API Sleep call

Sigma detected: Potentially Suspicious Malware Callback Communication

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a global mouse hook

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

1.exe (PID: 7380 cmdline: "C:\Users\user\Desktop\1.exe" MD5: A2ECCD0AC68E32F1763FF60E5B151304)

WerFault.exe (PID: 7608 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7380 -s 1424 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1.exe	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x18a1b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1685554270.00000000002CE000.00000008.00000001.01000000.00000003.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2d3b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x283b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: 1.exe PID: 7380	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.1.exe.170000.0.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x18a1b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0.0.1.exe.170000.0.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x18a1b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 124.156.117.13, DestinationIsIpv6: false, DestinationPort: 7777, EventID: 3, Image: C:\Users\user\Desktop\1.exe, Initiated: true, ProcessId: 7380, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1.exe	Virustotal: Detection: 45%			Perma Link
Source: 1.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0018939A __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,

0_2_0018939A

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 124.156.117.13:7777

Source: Joe Sandbox View

ASN Name: TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN

Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13
Source: unknown	TCP traffic detected without corresponding DNS query: 124.156.117.13

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AF15C0 recv,select,recv,

0_2_02AF15C0

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_001D6712 __EH_prolog3_catch_GS,CreateCompatibleDC,CreateCompatibleBitmap,FillRect,OpenClipboard,EmptyClipboard,CloseClipboard,SetClipboardData,CloseClipboard,

0_2_001D6712

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AFAA00 CreateMutexW,GetLastError,_memset,lstrlenW,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,_memmove,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,lstrlenW,_memset,wsprintfW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

0_2_02AFAA00

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AF7F30 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,_memmove,DeleteObject,DeleteObject,ReleaseDC,_memmove,DeleteObject,DeleteObject,ReleaseDC,

0_2_02AF7F30

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0021C056 GetParent,KillTimer,KillTimer,SetRectEmpty,GetAsyncKeyState,ScreenToClient,KillTimer,

0_2_0021C056

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AFA6D0 CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,

0_2_02AFA6D0

Source: C:\Users\user\Desktop\1.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00208144 ScreenToClient,_memset,_free,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,	0_2_00208144
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001A05D8 SendMessageW,UpdateWindow,GetKeyState,GetKeyState,GetKeyState,GetParent,PostMessageW,	0_2_001A05D8
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001F87A3 __EH_prolog3_GS,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetParent,SendMessageW,_memset,ScreenToClient,_memset,GetCursorPos,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetWindowPos,SendMessageW,_memset,_free,SendMessageW,GetParent,	0_2_001F87A3
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001CC98F GetParent,GetKeyState,GetKeyState,GetKeyState,SendMessageW,SendMessageW,SendMessageW,	0_2_001CC98F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001AAB3A IsWindow,SendMessageW,GetCapture,GetKeyState,GetKeyState,GetKeyState,ImmGetContext,ImmGetOpenStatus,ImmReleaseContext,GetFocus,IsWindow,IsWindow,IsWindow,ClientToScreen,IsWindow,ClientToScreen,	0_2_001AAB3A
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E4C24 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	0_2_001E4C24
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001A8CC8 IsWindow,SendMessageW,GetCapture,GetKeyState,GetKeyState,GetKeyState,ImmGetContext,ImmGetOpenStatus,ImmReleaseContext,GetFocus,IsWindow,IsWindow,IsWindow,ClientToScreen,IsWindow,ClientToScreen,	0_2_001A8CC8
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0017F717 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,	0_2_0017F717
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0021373B GetWindowRect,GetKeyState,GetKeyState,GetKeyState,KillTimer,GetFocus,SetTimer,	0_2_0021373B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001F7C12 GetKeyState,GetKeyState,GetKeyState,GetTickCount,SetCapture,PeekMessageW,GetCapture,PeekMessageW,PeekMessageW,PtInRect,GetTickCount,ReleaseCapture,	0_2_001F7C12
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001FDC2D GetKeyState,GetKeyState,GetKeyState,	0_2_001FDC2D
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001CBDCF MessageBeep,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,	0_2_001CBDCF

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.exe, type: SAMPLE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0.2.1.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0.0.1.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000000.1685554270.00000000002CE000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AF4110 lstrlenW,CoInitialize,CoCreateInstance,NtProtectVirtualMemory,swprintf,

0_2_02AF4110

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF79A3 ExitWindowsEx,	0_2_02AF79A3
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF7972 ExitWindowsEx,	0_2_02AF7972
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF7941 ExitWindowsEx,	0_2_02AF7941

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0026C0F3	0_2_0026C0F3
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001EE3B0	0_2_001EE3B0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001B0A4A	0_2_001B0A4A
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00196D33	0_2_00196D33
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00202E0B	0_2_00202E0B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E0EBB	0_2_001E0EBB
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001BF174	0_2_001BF174
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00269416	0_2_00269416
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001EF621	0_2_001EF621
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0027798C	0_2_0027798C
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001DFE1F	0_2_001DFE1F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0018DE82	0_2_0018DE82
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001EFF70	0_2_001EFF70
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF3D60	0_2_02AF3D60
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B103A1	0_2_02B103A1
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B10A7D	0_2_02B10A7D
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B0AF11	0_2_02B0AF11
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF5530	0_2_02AF5530
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B09A63	0_2_02B09A63
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B0F8FF	0_2_02B0F8FF
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AFD850	0_2_02AFD850
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B0FE50	0_2_02B0FE50
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B11DB1	0_2_02B11DB1
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_028A6AB0	0_2_028A6AB0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_028A29A0	0_2_028A29A0

Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00268B9C appears 167 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00268B66 appears 34 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 02B04D50 appears 31 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00268B33 appears 522 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00268D20 appears 42 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00178F8E appears 32 times

Source: C:\Users\user\Desktop\1.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7380 -s 1424

Source: 1.exe, 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTODO: <360>8 vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenameTODO: <360>8 vs 1.exe

Source: 1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.exe, type: SAMPLE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0.2.1.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0.0.1.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000000.1685554270.00000000002CE000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal92.troj.evad.winEXE@2/5@0/2

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF4640 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	0_2_02AF4640
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF4520 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	0_2_02AF4520
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF4A70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_02AF4A70

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AF3D60 MultiByteToWideChar,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

0_2_02AF3D60

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_00171410 CreateToolhelp32Snapshot,Process32FirstW,__wcsicoll,Process32NextW,CloseHandle,

0_2_00171410

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_00186D30 CoInitialize,CoCreateInstance,

0_2_00186D30

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0017810C FindResourceW,LoadResource,LockResource,FreeResource,

0_2_0017810C

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7380
Source: C:\Users\user\Desktop\1.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12.25

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\c5307659-47b8-4df9-b342-dddb4e207028

Jump to behavior

Source: 1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1.exe	Virustotal: Detection: 45%
Source: 1.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\1.exe

File read: C:\Users\user\Desktop\1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"
Source: C:\Users\user\Desktop\1.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7380 -s 1424

Source: C:\Users\user\Desktop\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dxcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7B70EE0-4340-11CF-B063-0020AFC2CD35}\InprocServer32

Jump to behavior

Source: 1.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 1.exe

Static file information: File size 1874432 > 1048576

Source: 1.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x11ac00

Source: 1.exe

Static PE information: More than 200 imports for USER32.dll

Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0026FAAC DecodePointer,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,GetLastError,EncodePointer,InterlockedExchange,FreeLibrary,

0_2_0026FAAC

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00268C0B push ecx; ret	0_2_00268C1E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00268D65 push ecx; ret	0_2_00268D78
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B144F0 push ebp; retf	0_2_02B144F4
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B144CE push ebp; retf	0_2_02B144F4
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B04D95 push ecx; ret	0_2_02B04DA8

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001A6268 SetForegroundWindow,IsIconic,	0_2_001A6268
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001A630C IsIconic,	0_2_001A630C
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E659B IsWindow,IsWindowVisible,GetWindowRect,PtInRect,GetAsyncKeyState,ScreenToClient,IsWindow,IsWindow,IsWindow,GetWindowRect,PtInRect,SendMessageW,PtInRect,SendMessageW,ScreenToClient,PtInRect,GetParent,SendMessageW,GetFocus,WindowFromPoint,SendMessageW,GetSystemMenu,IsMenu,EnableMenuItem,EnableMenuItem,EnableMenuItem,IsZoomed,IsIconic,EnableMenuItem,TrackPopupMenu,SendMessageW,	0_2_001E659B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001A0DD9 IsWindowVisible,IsIconic,	0_2_001A0DD9
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E7160 IsIconic,PostMessageW,	0_2_001E7160
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E51EF IsWindow,GetFocus,IsChild,SendMessageW,IsChild,SendMessageW,IsIconic,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,IsWindowVisible,	0_2_001E51EF
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00191906 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	0_2_00191906
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E5C7E GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_001E5C7E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E5C7E GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_001E5C7E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E5C7E GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_001E5C7E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001E5F7E IsWindowVisible,ScreenToClient,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetSystemMetrics,PtInRect,GetSystemMetrics,PtInRect,GetSystemMetrics,PtInRect,	0_2_001E5F7E
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_001BBFF7 GetClientRect,IsRectEmpty,IsIconic,BeginDeferWindowPos,GetClientRect,IsRectEmpty,IsRectEmpty,EqualRect,GetWindowRect,GetParent,EndDeferWindowPos,	0_2_001BBFF7

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AF7893 OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_02AF7893

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_00187E35 __EH_prolog3_GS,GetDeviceCaps,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,_memset,GetTextCharsetInfo,lstrcpyW,lstrcpyW,EnumFontFamiliesW,EnumFontFamiliesW,lstrcpyW,EnumFontFamiliesW,lstrcpyW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,GetSystemMetrics,lstrcpyW,CreateFontIndirectW,GetStockObject,GetStockObject,GetObjectW,GetObjectW,lstrcpyW,CreateFontIndirectW,CreateFontIndirectW,GetStockObject,GetObjectW,CreateFontIndirectW,CreateFontIndirectW,__EH_prolog3_GS,GetVersionExW,KiUserCallbackDispatcher,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00187E35

Source: C:\Users\user\Desktop\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\1.exe

Code function: C:\Program Files\VMware\VMware Tools\ VMware

0_2_02AF4420

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\1.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-104222

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\1.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-103912

Source: C:\Users\user\Desktop\1.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-103682

Source: C:\Users\user\Desktop\1.exe

API coverage: 5.3 %

Source: C:\Users\user\Desktop\1.exe TID: 7512

Thread sleep time: -50000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\1.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0018939A __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,

0_2_0018939A

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0026CA47 VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

0_2_0026CA47

Source: C:\Users\user\Desktop\1.exe

Thread delayed: delay time: 50000

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 1.exe, 00000000.00000002.2326012813.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\VMware\VMware Tools\
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 1.exe, 00000000.00000002.2326012813.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: ~/%s%d/None/%sHDD:%dWW %d Gb Free %d Gb Mem: %d Gb %sFree%d Gb %s-%d8herrorDriverDescSYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000%s >fX[:%d MGetNativeSystemInfontdll.dllRtlGetNtVersionNumbers%d.%d.%dSOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameC:\Program Files\VMware\VMware Tools\VMwareSeDebugPrivilegeNtSetInformationProcessNtDll.dllWindows\SysWOW64\svchost.exe%s%sWindows\System32\svchost.exeOpenProcessKernel32.dllExitProcessWinExecWaitForSingleObjectwininet.dllInternetOpenWMSIE 6.0InternetOpenUrlWInternetReadFileInternetCloseHandleinvalid string positionstring too long
Source: 1.exe, 00000000.00000002.2324936494.000000000081D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@;{vF
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\1.exe	API call chain: ExitProcess graph end node			graph_0-102715
Source: C:\Users\user\Desktop\1.exe	API call chain: ExitProcess graph end node			graph_0-104387

Source: C:\Users\user\Desktop\1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0026F4CB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0026F4CB

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0026CA47 VirtualProtect ?,-00000001,00000104,?

0_2_0026CA47

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0026FAAC DecodePointer,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,GetLastError,EncodePointer,InterlockedExchange,FreeLibrary,

0_2_0026FAAC

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02B137A9 GetProcessHeap,

0_2_02B137A9

Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_0026F4CB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0026F4CB
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_00267629 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00267629
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B0403B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02B0403B
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02AF9DF0 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,Sleep,EnumWindows,EnumWindows,Sleep,EnumWindows,CreateEventA,Sleep,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,	0_2_02AF9DF0
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_02B0112F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02B0112F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_028A3840 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	0_2_028A3840
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_028AA37F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_028AA37F
Source: C:\Users\user\Desktop\1.exe	Code function: 0_2_028AC8AB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_028AC8AB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AF46E0 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,

0_2_02AF46E0

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\1.exe

0_2_02AF46E0

Source: C:\Users\user\Desktop\1.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe		0_2_02AF46E0
Source: C:\Users\user\Desktop\1.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe		0_2_02AF46E0

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AF2320 _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetSystemInfo,wsprintfW,wsprintfW,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,GetLocalTime,wsprintfW,GetLocaleInfoW,_memset,EnumDisplayMonitors,GetSystemDirectoryW,GetCurrentHwProfileW,

0_2_02AF2320

Source: C:\Users\user\Desktop\1.exe	Code function: GetLocaleInfoW,__snwprintf_s,LoadLibraryW,	0_2_001749C6
Source: C:\Users\user\Desktop\1.exe	Code function: __EH_prolog3_GS,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetNumberFormatW,GetLocaleInfoW,lstrlenW,	0_2_001C18C0
Source: C:\Users\user\Desktop\1.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetSystemInfo,wsprintfW,wsprintfW,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,GetLocalTime,wsprintfW,GetLocaleInfoW,_memset,EnumDisplayMonitors,GetSystemDirectoryW,GetCurrentHwProfileW,	0_2_02AF2320

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_0026E528 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0026E528

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_002747F0 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_002747F0

Source: C:\Users\user\Desktop\1.exe

0_2_00187E35

Source: 1.exe	Binary or memory string: acs.exe
Source: 1.exe	Binary or memory string: vsserv.exe
Source: 1.exe	Binary or memory string: kxetray.exe
Source: 1.exe	Binary or memory string: avcenter.exe
Source: 1.exe	Binary or memory string: cfp.exe
Source: 1.exe	Binary or memory string: KSafeTray.exe
Source: 1.exe	Binary or memory string: avp.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: 1.exe	Binary or memory string: 360Safe.exe
Source: 1.exe	Binary or memory string: rtvscan.exe
Source: 1.exe	Binary or memory string: 360tray.exe
Source: 1.exe	Binary or memory string: TMBMSRV.exe
Source: 1.exe	Binary or memory string: ashDisp.exe
Source: 1.exe	Binary or memory string: 360Tray.exe
Source: 1.exe	Binary or memory string: avgwdsvc.exe
Source: 1.exe	Binary or memory string: AYAgent.aye
Source: 1.exe	Binary or memory string: RavMonD.exe
Source: 1.exe	Binary or memory string: QUHLPSVC.EXE
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe
Source: 1.exe	Binary or memory string: Mcshield.exe
Source: 1.exe	Binary or memory string: K7TSecurity.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: 1.exe PID: 7380, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: 1.exe PID: 7380, type: MEMORYSTR

Source: C:\Users\user\Desktop\1.exe

Code function: 0_2_02AFEBA0 bind,htons,bind,

0_2_02AFEBA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	41 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	211 Process Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	41 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	131 Virtualization/Sandbox Evasion	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Indicator Removal	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1.exe	45%	Virustotal		Browse
1.exe	63%	ReversingLabs	Win32.Exploit.DonutMarte

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
124.156.117.13	unknown	Singapore		132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true

Private

IP
192.168.1.2

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582637
Start date and time:	2024-12-31 08:25:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@2/5@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 101 Number of non-executed functions: 330
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 20.190.159.0, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	botx.sh4.elf	Get hash	malicious	Mirai	Browse	129.226.178.103
	DOTA2#U89c6#U8ddd#U63d2#U4ef6.exe	Get hash	malicious	Unknown	Browse	203.205.136.80
	xd.mips.elf	Get hash	malicious	Mirai	Browse	162.63.47.5
	armv5l.elf	Get hash	malicious	Mirai	Browse	101.32.4.151
	Audio02837498.html	Get hash	malicious	HTMLPhisher	Browse	170.106.97.198
	splarm5.elf	Get hash	malicious	Unknown	Browse	101.33.176.214
	splmips.elf	Get hash	malicious	Unknown	Browse	162.63.67.56
	jklx86.elf	Get hash	malicious	Unknown	Browse	101.32.48.91
	nabarm5.elf	Get hash	malicious	Unknown	Browse	101.48.142.50

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1.exe_2262233b1c4a664c14445ff2c18db8ed6a66_c1a861f5_ca6121c6-1511-4226-8e9b-14ee799fea8e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0635643467685238
Encrypted:	false
SSDEEP:	192:b+jnhd6bc0HR6iCj8H+ZrQkFrAKzuiFWZ24IO8Y:UnhgbXHR6iCj8KzuiFWY4IO8Y
MD5:	DF09B12D9B76ADFBFF27179EDA49559C
SHA1:	F5AD83C0353F250EAB642CE9C44FE15789B146AE
SHA-256:	3A36FBE0A7C7BDC517BBDA6108DA142FC10D86D696C53FA634AB1E78F83DE3F8
SHA-512:	B6129E1A5D945CD62FD9DEBAC09EBF80CDDE25C4F022DCD2586882FAE0D3971D0ADA2763486728EF1FF026D43FC3666B297D3E80A85BE3A44E43B50CF7DDCCCC
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.1.0.3.6.2.3.2.6.6.6.4.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.1.0.3.6.2.3.7.4.4.6.4.5.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.a.6.1.2.1.c.6.-.1.5.1.1.-.4.2.2.6.-.8.e.9.b.-.1.4.e.e.7.9.9.f.e.a.8.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.5.3.4.f.5.b.d.-.8.1.2.0.-.4.2.a.7.-.a.c.3.1.-.c.b.2.e.2.4.8.a.6.3.2.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.O.D.O.:. .<.3.6.0.>.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.d.4.-.0.0.0.1.-.0.0.1.4.-.1.9.0.0.-.6.a.5.a.5.5.5.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.6.5.5.2.7.c.4.c.b.4.3.8.d.c.6.2.5.a.4.4.8.1.e.3.a.9.6.8.3.0.6.0.0.0.0.0.4.0.8.!.0.0.0.0.e.e.8.c.b.6.7.0.f.1.8.3.d.9.c.3.8.a.8.c.2.b.4.0.0.8.5.d.1.6.0.f.1.1.f.d.5.4.7.b.!.1...e.x.e.....T.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER922C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Dec 31 07:27:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	150270
Entropy (8bit):	1.8366810947333396
Encrypted:	false
SSDEEP:	1536:iRWMVNeGOBhcX2dgKcEQUFILb4TEsYz2j:i5NePBSXogKE
MD5:	0C5589C00EFE72332CA6C13427F08262
SHA1:	44995D3F105ED735F8E708BA1FE71F15B96544F1
SHA-256:	EB6C3F1F14ABCF195E4E0BD86D58CB4CCFFCBD45A405AD9852E7F024A02F2939
SHA-512:	25151A8D3F7B54B9AE6E9085E19F45C9908F870B7DAD075C48D05041CF9128063B9BA2D00CFCC954F2ED118E47FCF04F0805080E142ABF699239B6A35A7ED719
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........sg....................................$....$...........[..........`.......8...........T............5..V............%...........&..............................................................................eJ.......'......GenuineIntel............T.............sg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9356.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8388
Entropy (8bit):	3.696438391082311
Encrypted:	false
SSDEEP:	192:R6l7wVeJcC6/6Y9cSU9YCmgmf2twprG89b5Q9sfNzWm:R6lXJB6/6YGSU9YCmgmf2ta5Q2fpf
MD5:	20BE5B50F0519F1751FBFD477A91A632
SHA1:	DF1F238DF7DB66D06AA3721A4B1209CB2F68F48B
SHA-256:	C7F9F849D2E50A74D88713A575C4B942842C625C92AF1736C3FA477225B699BA
SHA-512:	7445E770A4496E9916EDFFC5EE132DF40EE8D90A8794BE94CD00B5D96BC67D3176300A41A3E3AADB998E41732DD5087E789879B1F519740860208104167D82B9
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9386.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4745
Entropy (8bit):	4.465701223822374
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnGJg77aI9pOWpW8VY8Ym8M4JuoF++q8vGn0G8qT1WEd:uIjfcI7Xv7V8JAKA0G8eEEd
MD5:	68662BA8D546325B642E3F92E93717F5
SHA1:	42F567DB9A3F6492AE52E7A9482F474843A934A4
SHA-256:	824FEBFBD5FFD8AB970561718A6E03339155B399F8F2DE1E2F600FB1FF59F046
SHA-512:	A73009B2275163E76F77958C38B161803A292C5DC9D452E0A66537E558EEA0EC671397E4F31619FE956ED9F3F5769A54CD7B5D7EE0EA8B36A66C292FB2C18CA2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="655109" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465507130746226
Encrypted:	false
SSDEEP:	6144:ZIXfpi67eLPU9skLmb0b46WSPKaJG8nAgejZMMhA2gX4WABl0uNkdwBCswSb2:qXD946WlLZMM6YFH6+2
MD5:	C0D58D6BD7792B312F11B1083DD691FF
SHA1:	1D142F1A97EAEEED6A74C244EC58C8698FD36C8C
SHA-256:	36431120EB147104DFDDBC900312EAFDE9C9FF42AA764667D0833146C9919E2E
SHA-512:	76CC2AE48F9D0F22897FB316D9956CCCEE53904F8FBB3960FA55F3041679A94C2032188C0B6562F5C3D1DA3698A274FA87B3F9F243ABD0158185566C3D38CB4F
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>l(cU[...............................................................................................................................................................................................................................................................................................................................................?W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.649482194453071
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1.exe
File size:	1'874'432 bytes
MD5:	a2eccd0ac68e32f1763ff60e5b151304
SHA1:	ee8cb670f183d9c38a8c2b40085d160f11fd547b
SHA256:	f29ac22ca60872b1edd94e2411007f37b5cf814a3b3a85df6b162c94c92a3dd5
SHA512:	86de5d8f3d9fef2a436bc36c9178f6f030ba006a71a86bb30ce9df0e4eefb4b9fa71fa596c64bde7d231417c75d33410dde2c2855e45809b9b727b54a03e8985
SSDEEP:	49152:RrwObw+yBXDMjmS/vVLdVlxl/z5MP/m2Y8H9W0AORUbwLwA6/TFmSfy:2ObwnBsmEVLdfxl/z5MPO8H9W7ORUbXd
TLSH:	0A85AE3A3A919077C1333234558DF3BAF2AEA5314D38565766911F3C3E358A2992C3AF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................................(.......).................U.....-.....................Rich....................PE..L....vkg...

File Icon


Icon Hash:	9e1f191f6777733a

Static PE Info

General

Entrypoint:	0x4f761f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676B7696 [Wed Dec 25 03:05:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	1d827ad5ca3aef28dfe0cea19c081a23

Entrypoint Preview

Instruction
call 00007F030CFBF5A9h
jmp 00007F030CFB852Eh
cmp ecx, dword ptr [005625E0h]
jne 00007F030CFB86A4h
rep ret
jmp 00007F030CFBF630h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword ptr [0051C290h]
push edi
push dword ptr [005957A8h]
call esi
push dword ptr [005957A4h]
mov ebx, eax
mov dword ptr [ebp-04h], ebx
call esi
mov esi, eax
cmp esi, ebx
jc 00007F030CFB8727h
mov edi, esi
sub edi, ebx
lea eax, dword ptr [edi+04h]
cmp eax, 04h
jc 00007F030CFB8717h
push ebx
call 00007F030CFBBF14h
mov ebx, eax
lea eax, dword ptr [edi+04h]
pop ecx
cmp ebx, eax
jnc 00007F030CFB86EAh
mov eax, 00000800h
cmp ebx, eax
jnc 00007F030CFB86A4h
mov eax, ebx
add eax, ebx
cmp eax, ebx
jc 00007F030CFB86B1h
push eax
push dword ptr [ebp-04h]
call 00007F030CFBF763h
pop ecx
pop ecx
test eax, eax
jne 00007F030CFB86B8h
lea eax, dword ptr [ebx+10h]
cmp eax, ebx
jc 00007F030CFB86E0h
push eax
push dword ptr [ebp-04h]
call 00007F030CFBF74Dh
pop ecx
pop ecx
test eax, eax
je 00007F030CFB86D1h
sar edi, 02h
push eax
lea esi, dword ptr [eax+edi*4]
call dword ptr [0051C294h]
mov dword ptr [005957A8h], eax
push dword ptr [ebp+08h]
mov edi, dword ptr [0051C294h]
call edi
mov dword ptr [esi], eax
add esi, 04h
push esi
call edi
mov dword ptr [005957A4h], eax
mov eax, dword ptr [ebp+08h]
jmp 00007F030CFB86A4h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15ab58	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x196000	0x14020	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1ab000	0x19964	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11ccd0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1457b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11c000	0x908	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11ab56	0x11ac00	81f07ad9401bb030f6fd4b22bfc8020d	False	0.5604173574270557	data	6.522543309935167	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11c000	0x41c80	0x41e00	53ba3f6835c1465c9f6599c95a09247d	False	0.2668665500474383	data	4.99171438264604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x15e000	0x377bc	0x30200	0925c3d4d81457481990a402b0e891aa	False	0.896190137987013	data	7.817358833843515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x196000	0x14020	0x14200	0d1402167d2e62a9452ff3195ff8375e	False	0.7321549883540373	data	6.846851273620952	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1ab000	0x28678	0x28800	b766fbb210faa4b699434a30410c6ed0	False	0.26442539544753085	data	4.952802281401289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x196d78	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x196eac	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x196f60	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x197094	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x1971c8	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x1972fc	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x197430	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x197564	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x197698	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1977cc	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x197900	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x197a34	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x197b68	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x197c9c	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x197dd0	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x197f04	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x198038	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x1980f0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x198234	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	Chinese	China	0.5335365853658537
RT_ICON	0x19889c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Chinese	China	0.646505376344086
RT_ICON	0x198b84	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	Chinese	China	0.6598360655737705
RT_ICON	0x198d6c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Chinese	China	0.6385135135135135
RT_ICON	0x198e94	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Chinese	China	0.6260660980810234
RT_ICON	0x199d3c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.7793321299638989
RT_ICON	0x19a5e4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Chinese	China	0.8231566820276498
RT_ICON	0x19acac	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Chinese	China	0.6575144508670521
RT_ICON	0x19b214	0x93cb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9988106250825954
RT_ICON	0x1a45e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.5116182572614107
RT_ICON	0x1a6b88	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.6109287054409006
RT_ICON	0x1a7c30	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Chinese	China	0.6221311475409836
RT_ICON	0x1a85b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.7402482269503546
RT_DIALOG	0x1a8a20	0x120	data	Chinese	China	0.6145833333333334
RT_DIALOG	0x1a8b40	0xd8	data	Chinese	China	0.7268518518518519
RT_DIALOG	0x1a8c18	0xe2	data	Chinese	China	0.6769911504424779
RT_DIALOG	0x1a8cfc	0x34	data	Chinese	China	0.8653846153846154
RT_STRING	0x1a8d30	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x1a8d74	0x4e	data	Chinese	China	0.8461538461538461
RT_STRING	0x1a8dc4	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x1a8df0	0x84	data	Chinese	China	0.9166666666666666
RT_STRING	0x1a8e74	0x1c4	data	Chinese	China	0.8053097345132744
RT_STRING	0x1a9038	0x14e	data	Chinese	China	0.5179640718562875
RT_STRING	0x1a9188	0x10e	data	Chinese	China	0.7037037037037037
RT_STRING	0x1a9298	0x50	data	Chinese	China	0.7125
RT_STRING	0x1a92e8	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x1a932c	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x1a9394	0x1b2	data	Chinese	China	0.6474654377880185
RT_STRING	0x1a9548	0xf4	data	Chinese	China	0.6065573770491803
RT_STRING	0x1a963c	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x1a9660	0x1a6	data	Chinese	China	0.6658767772511849
RT_GROUP_CURSOR	0x1a9808	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x1a982c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9840	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9854	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9868	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a987c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9890	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a98f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9908	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a991c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x1a9930	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x1a9944	0xbc	data	Chinese	China	0.6117021276595744
RT_VERSION	0x1a9a00	0x2bc	data	Chinese	China	0.4542857142857143
RT_MANIFEST	0x1a9cbc	0x362	ASCII text, with very long lines (866), with no line terminators	English	United States	0.4515011547344111

Imports

DLL	Import
KERNEL32.dll	IsDebuggerPresent, IsProcessorFeaturePresent, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetStringTypeW, GetTimeZoneInformation, LCMapStringW, GetConsoleCP, GetConsoleMode, UnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, HeapCreate, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStdHandle, SetUnhandledExceptionFilter, GetFileType, SetStdHandle, VirtualQuery, GetSystemInfo, WriteConsoleW, SetEnvironmentVariableA, FindResourceW, LoadResource, LockResource, SizeofResource, GetModuleFileNameW, CreateThread, VirtualAlloc, GetSystemTimeAsFileTime, HeapSize, HeapQueryInformation, HeapReAlloc, RaiseException, ExitThread, RtlUnwind, ExitProcess, HeapAlloc, HeapFree, DecodePointer, EncodePointer, GetStartupInfoW, HeapSetInformation, GetCommandLineW, FindResourceExW, SearchPathW, GetProfileIntW, GetTickCount, InitializeCriticalSectionAndSpinCount, GetNumberFormatW, GetWindowsDirectoryW, GetTempPathW, GetTempFileNameW, GetFileTime, GetFileSizeEx, GetFileAttributesW, FileTimeToLocalFileTime, GetFileAttributesExW, SetErrorMode, FileTimeToSystemTime, lstrlenA, GlobalGetAtomNameW, GetFullPathNameW, GetVolumeInformationW, FindFirstFileW, FindClose, GetCurrentProcess, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, CreateFileW, lstrcmpiW, lstrcpyW, DeleteFileW, InterlockedIncrement, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GlobalFlags, GetCurrentDirectoryW, GlobalFindAtomW, GetVersionExW, CompareStringW, InterlockedDecrement, ReleaseActCtx, CreateActCtxW, CopyFileW, GlobalSize, FormatMessageW, LocalFree, MulDiv, GlobalUnlock, GlobalFree, FreeResource, GetCurrentProcessId, GlobalAddAtomW, GetPrivateProfileStringW, lstrlenW, WritePrivateProfileStringW, GetPrivateProfileIntW, WaitForSingleObject, ResumeThread, SetThreadPriority, lstrcmpA, GlobalDeleteAtom, GetCurrentThread, GetCurrentThreadId, GetUserDefaultUILanguage, ConvertDefaultLocale, GetSystemDefaultUILanguage, GetLocaleInfoW, ActivateActCtx, LoadLibraryW, GetLastError, DeactivateActCtx, SetLastError, MultiByteToWideChar, WideCharToMultiByte, GlobalLock, lstrcmpW, GlobalAlloc, GetModuleHandleW, GetProcAddress, InterlockedExchange, FreeLibrary, TerminateThread, Sleep, CloseHandle, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot, VirtualProtect
USER32.dll	RegisterClipboardFormatW, FrameRect, CopyIcon, CharUpperBuffW, PostThreadMessageW, GetKeyNameTextW, DefFrameProcW, DefMDIChildProcW, DrawMenuBar, HideCaret, InvertRect, LockWindowUpdate, SetCursorPos, SetRect, CreateAcceleratorTableW, GetKeyboardState, GetKeyboardLayout, MapVirtualKeyW, ToUnicodeEx, CopyAcceleratorTableW, TranslateMDISysAccel, DrawFrameControl, DrawIconEx, SetClassLongW, DestroyAcceleratorTable, SetParent, UnpackDDElParam, ReuseDDElParam, LoadImageW, LoadAcceleratorsW, InsertMenuItemW, BringWindowToTop, TranslateAcceleratorW, UnregisterClassW, GetMenuDefaultItem, SetMenuDefaultItem, CreatePopupMenu, IsMenu, MonitorFromPoint, UpdateLayeredWindow, EnableScrollBar, EmptyClipboard, IsRectEmpty, IsZoomed, GetAsyncKeyState, NotifyWinEvent, MessageBeep, RedrawWindow, SetWindowRgn, LoadMenuW, OffsetRect, IntersectRect, CharUpperW, DestroyIcon, GetSysColorBrush, SetLayeredWindowAttributes, EnumDisplayMonitors, SetRectEmpty, KillTimer, SetTimer, RealChildWindowFromPoint, DeleteMenu, WaitMessage, ReleaseCapture, LoadCursorW, WindowFromPoint, SetCapture, ShowWindow, MoveWindow, SetWindowTextW, IsDialogMessageW, CheckDlgButton, RegisterWindowMessageW, SendDlgItemMessageW, SendDlgItemMessageA, WinHelpW, IsChild, CloseClipboard, SetClipboardData, OpenClipboard, GetNextDlgGroupItem, CopyImage, UnionRect, GetIconInfo, CreateMenu, IsClipboardFormatAvailable, GetUpdateRect, GetDoubleClickTime, IsCharLowerW, MapVirtualKeyExW, SubtractRect, DestroyCursor, MapDialogRect, DrawFocusRect, GetCapture, GetClassLongW, SetPropW, GetPropW, RemovePropW, GetWindowRgn, DrawEdge, GetKeyState, EnableWindow, DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, SendMessageW, AppendMenuW, GetSystemMenu, LoadIconW, PostMessageW, PostQuitMessage, CheckMenuItem, EnableMenuItem, GetMenuState, ModifyMenuW, GetParent, GetFocus, LoadBitmapW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, ValidateRect, GetCursorPos, PeekMessageW, IsWindowVisible, GetActiveWindow, DispatchMessageW, TranslateMessage, GetMessageW, CallNextHookEx, SetWindowsHookExW, SetCursor, ShowOwnedPopups, MessageBoxW, IsWindowEnabled, GetLastActivePopup, GetWindowLongW, GetWindowThreadProcessId, DrawStateW, FillRect, UpdateWindow, InvalidateRect, GetClassNameW, EndDialog, GetNextDlgTabItem, GetDlgItem, IsWindow, DestroyWindow, CreateDialogIndirectParamW, SetActiveWindow, GetDesktopWindow, RemoveMenu, GetSubMenu, GetMenuItemCount, InsertMenuW, GetMenuItemID, GetMenuStringW, TabbedTextOutW, DrawTextW, DrawTextExW, GrayStringW, ScreenToClient, ClientToScreen, GetDC, ReleaseDC, GetWindowDC, BeginPaint, EndPaint, GetSysColor, PtInRect, GetWindowRect, UnhookWindowsHookEx, CopyRect, InflateRect, GetMenuItemInfoW, DestroyMenu, SystemParametersInfoW, GetWindow, SetWindowPos, SetWindowLongW, GetMenu, CallWindowProcW, DefWindowProcW, GetDlgCtrlID, GetWindowPlacement, SetWindowPlacement, SetScrollInfo, GetScrollInfo, DeferWindowPos, EqualRect, AdjustWindowRectEx, RegisterClassW, GetClassInfoW, GetClassInfoExW, CreateWindowExW, ShowScrollBar, SetForegroundWindow, GetScrollPos, SetScrollPos, GetScrollRange, SetScrollRange, SetMenu, TrackPopupMenu, ScrollWindow, MapWindowPoints, GetMonitorInfoW, MonitorFromWindow, GetMessagePos, GetMessageTime, GetTopWindow, EndDeferWindowPos, BeginDeferWindowPos, GetForegroundWindow, GetWindowTextW, GetWindowTextLengthW, SetFocus
GDI32.dll	GetStockObject, GetDeviceCaps, CopyMetaFileW, CreateDCW, SaveDC, RestoreDC, SetBkColor, SetBkMode, SetPolyFillMode, SetROP2, SetTextColor, SetMapMode, GetClipBox, ExcludeClipRect, IntersectClipRect, LineTo, MoveToEx, SetTextAlign, GetLayout, SetLayout, SelectClipRgn, CreateRectRgn, GetViewportExtEx, GetWindowExtEx, BitBlt, GetPixel, PtVisible, RectVisible, TextOutW, ExtTextOutW, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, OffsetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, DeleteDC, GetObjectW, CreatePatternBrush, CreateCompatibleDC, CreateSolidBrush, GetObjectType, CreatePen, CreateHatchBrush, CreateFontIndirectW, GetTextExtentPoint32W, CreateDIBitmap, CreateCompatibleBitmap, CreateRectRgnIndirect, GetTextMetricsW, EnumFontFamiliesW, GetTextCharsetInfo, SetRectRgn, CombineRgn, PatBlt, DPtoLP, CreateRoundRectRgn, CreateDIBSection, CreatePolygonRgn, GetBkColor, GetTextColor, CreateEllipticRgn, Polyline, Ellipse, Polygon, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, RealizePalette, GetSystemPaletteEntries, OffsetRgn, GetRgnBox, SetDIBColorTable, StretchBlt, SetPixel, Rectangle, EnumFontFamiliesExW, ExtFloodFill, SetPaletteEntries, LPtoDP, GetWindowOrgEx, GetViewportOrgEx, PtInRegion, FillRgn, FrameRgn, GetBoundsRect, GetTextFaceW, SetPixelV, DeleteObject, CreateBitmap, SelectPalette
MSIMG32.dll	AlphaBlend, TransparentBlt
COMDLG32.dll	GetFileTitleW
WINSPOOL.DRV	OpenPrinterW, DocumentPropertiesW, ClosePrinter
ADVAPI32.dll	RegQueryValueExW, RegOpenKeyExW, RegCreateKeyExW, RegSetValueExW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyW, RegQueryValueW, RegCloseKey, RegEnumValueW, RegEnumKeyExW
SHELL32.dll	SHBrowseForFolderW, SHAppBarMessage, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetDesktopFolder, ShellExecuteW, DragQueryFileW, DragFinish, SHGetFileInfoW
COMCTL32.dll	ImageList_GetIconSize, InitCommonControlsEx
SHLWAPI.dll	PathFindExtensionW, PathFindFileNameW, PathStripToRootW, PathIsUNCW, PathRemoveFileSpecW
ole32.dll	OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleLockRunning, OleGetClipboard, RegisterDragDrop, CoLockObjectExternal, RevokeDragDrop, CoCreateGuid, CoTaskMemFree, DoDragDrop, CreateStreamOnHGlobal, CoInitializeEx, CoInitialize, CoCreateInstance, CoUninitialize, OleDuplicateData, CoTaskMemAlloc, ReleaseStgMedium
OLEAUT32.dll	SysFreeString, SysAllocString, SysAllocStringLen, VariantClear, VariantChangeType, VariantInit, SysStringLen, VarBstrFromDate, SystemTimeToVariantTime, VariantTimeToSystemTime
gdiplus.dll	GdipGetImagePaletteSize, GdipGetImagePalette, GdipCreateBitmapFromStream, GdipCreateBitmapFromScan0, GdipGetImagePixelFormat, GdipBitmapUnlockBits, GdipGetImageGraphicsContext, GdipDrawImageI, GdipCreateFromHDC, GdiplusShutdown, GdiplusStartup, GdipGetImageHeight, GdipCloneImage, GdipGetImageWidth, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipDeleteGraphics, GdipAlloc, GdipDrawImageRectI, GdipBitmapLockBits, GdipFree, GdipSetInterpolationMode
IPHLPAPI.DLL	GetTcpTable2, SetTcpEntry
WS2_32.dll	htonl, inet_ntop
OLEACC.dll	AccessibleObjectFromWindow, CreateStdAccessibleObject, LresultFromObject
IMM32.dll	ImmGetOpenStatus, ImmReleaseContext, ImmGetContext
WINMM.dll	PlaySoundW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 08:26:59.612432957 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:26:59.617337942 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:26:59.617418051 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:26:59.617727995 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:26:59.622481108 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.525938034 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.526187897 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:00.531095982 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.531110048 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.531117916 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861836910 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861857891 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861865997 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861906052 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:00.861941099 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861953020 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861962080 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861972094 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861984015 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.861984968 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:00.861994028 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.862005949 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.862010002 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:00.862015963 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.862030029 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:00.862046957 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:00.866882086 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.866892099 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.866899967 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:00.866930008 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:00.866946936 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.084624052 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084636927 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084645987 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084656000 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084675074 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.084702969 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.084887028 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084896088 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084929943 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.084954977 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084965944 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084975004 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084985018 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.084996939 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.085016966 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.085772038 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.085782051 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.085787058 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.085791111 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.085794926 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.085799932 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.085854053 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.086675882 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.086685896 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.086694956 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.086705923 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.086713076 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.086715937 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.086726904 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.086743116 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.086759090 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.087471008 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.087493896 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.087528944 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.307775021 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.307794094 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.307801962 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.307842970 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.307843924 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.307853937 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.307863951 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.307876110 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.307887077 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.307904005 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.308244944 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.308254004 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.308263063 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.308274031 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.308279991 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.308284044 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.308296919 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.308299065 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.308309078 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.308320045 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.308326006 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.308363914 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.309094906 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309104919 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309114933 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309127092 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.309128046 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309138060 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309146881 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309158087 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309159994 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.309168100 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309181929 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.309201002 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.309966087 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309976101 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309986115 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.309994936 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310005903 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310010910 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.310017109 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310025930 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310039043 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310043097 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.310056925 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.310859919 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310868979 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310878992 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310889959 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310895920 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.310900927 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310913086 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310914040 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.310923100 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.310937881 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.310957909 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.530795097 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.530826092 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.530834913 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.530869007 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.530875921 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.530879021 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.530893087 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.530905008 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.530913115 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.530931950 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531025887 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531049013 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531059980 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531064034 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531091928 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531117916 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531136990 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531146049 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531151056 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531157017 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531188965 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531661034 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531685114 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531697035 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531698942 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531708002 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531717062 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531728983 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531730890 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531738997 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531750917 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531754017 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531760931 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531773090 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531776905 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531783104 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.531804085 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.531827927 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.532442093 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532453060 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532461882 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532473087 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532480001 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.532483101 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532491922 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532502890 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532510996 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.532514095 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532521963 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.532525063 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532536030 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532541037 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.532546997 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532561064 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.532581091 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.532603979 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.533334970 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533344984 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533355951 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533365011 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533375025 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533381939 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533386946 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.533387899 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533396959 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533416033 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533420086 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.533426046 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533437967 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533447981 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533451080 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.533457994 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.533471107 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.533497095 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.534265041 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534275055 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534282923 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534292936 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534305096 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.534305096 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534313917 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534322977 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534334898 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534338951 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.534346104 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534354925 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534365892 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.534379959 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.534390926 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.754057884 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754071951 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754081964 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754091024 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754101038 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754112005 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754143953 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754153967 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754163027 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754172087 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754183054 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754182100 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.754213095 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754223108 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754226923 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.754231930 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754240990 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754251003 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754292011 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.754292011 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.754303932 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754313946 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754323006 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754333973 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754343033 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754343987 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.754379034 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.754945040 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754955053 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754964113 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754972935 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754981995 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754990101 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.754995108 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755004883 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755006075 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.755018950 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755043030 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.755064011 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.755518913 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755527973 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755537987 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755546093 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755557060 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755565882 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.755565882 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755573034 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755580902 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755589962 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755594015 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.755599022 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755609035 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755614042 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.755619049 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755630016 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.755640984 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.755660057 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.756122112 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.756131887 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.756141901 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.756151915 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.756160975 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.756161928 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.756170034 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.756180048 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.756181002 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.756189108 CET	7777	49730	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:01.756210089 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.756228924 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:01.759438992 CET	49730	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:03.778707027 CET	49731	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:03.783535004 CET	7777	49731	124.156.117.13	192.168.2.4
Dec 31, 2024 08:27:03.783608913 CET	49731	7777	192.168.2.4	124.156.117.13
Dec 31, 2024 08:27:53.946475983 CET	49731	7777	192.168.2.4	124.156.117.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 08:26:59.613339901 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:26:59.613390923 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:26:59.643448114 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:26:59.693531036 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:26:59.758982897 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:26:59.832403898 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:26:59.942410946 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:00.072438955 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:00.222424030 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:00.382404089 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:00.572406054 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:00.783428907 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:01.002394915 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:01.253408909 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:01.532686949 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:01.812422037 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:02.123460054 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:02.453526974 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:02.802423954 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:03.173448086 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:03.552423954 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:03.951925039 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:04.387423038 CET	55677	6341	192.168.2.4	192.168.1.2
Dec 31, 2024 08:27:19.326793909 CET	55677	6341	192.168.2.4	192.168.1.2

Target ID:	0
Start time:	02:26:48
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1.exe"
Imagebase:	0x170000
File size:	1'874'432 bytes
MD5 hash:	A2ECCD0AC68E32F1763FF60E5B151304
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000000.1685554270.00000000002CE000.00000008.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:27:03
Start date:	31/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7380 -s 1424
Imagebase:	0xcf0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	79.3%
Signature Coverage:	12.5%
Total number of Nodes:	1546
Total number of Limit Nodes:	33

Executed Functions

Function 00187E35 Relevance: 105.6, APIs: 48, Strings: 12, Instructions: 557
libraryloaderstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00187E3F

Part of subcall function 0017A078: __EH_prolog3.LIBCMT ref: 0017A07F
Part of subcall function 0017A078: GetWindowDC.USER32(00000000,00000004,00187938,00000000,?,?,00298F40), ref: 0017A0AB

GetDeviceCaps.GDI32(?,00000058), ref: 00187E65
DeleteObject.GDI32(00000000), ref: 00187EC6
DeleteObject.GDI32(00000000), ref: 00187EE3
DeleteObject.GDI32(00000000), ref: 00187F00
DeleteObject.GDI32(00000000), ref: 00187F17
DeleteObject.GDI32(00000000), ref: 00187F34
DeleteObject.GDI32(00000000), ref: 00187F4B
DeleteObject.GDI32(00000000), ref: 00187F62
DeleteObject.GDI32(00000000), ref: 00187F79
DeleteObject.GDI32(00000000), ref: 00187F96
DeleteObject.GDI32(00000000), ref: 00187FAD
_memset.LIBCMT ref: 00187FC4
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 00187FD4
lstrcpyW.KERNEL32(?,?), ref: 00188023
EnumFontFamiliesW.GDI32(?,00000000,Function_00017DEC), ref: 0018804A
lstrcpyW.KERNEL32(?), ref: 0018805A
EnumFontFamiliesW.GDI32(?,00000000,Function_00017DEC), ref: 00188075
lstrcpyW.KERNEL32(?), ref: 0018808D
CreateFontIndirectW.GDI32(?), ref: 00188099
CreateFontIndirectW.GDI32(?), ref: 001880E9
CreateFontIndirectW.GDI32(?), ref: 00188124
CreateFontIndirectW.GDI32(?), ref: 0018814C
CreateFontIndirectW.GDI32(?), ref: 00188169
GetSystemMetrics.USER32(00000048), ref: 00188184
lstrcpyW.KERNEL32(?), ref: 00188198
CreateFontIndirectW.GDI32(?), ref: 0018819E
GetStockObject.GDI32(00000011), ref: 001881CC
GetObjectW.GDI32(?,0000005C,?), ref: 001881EE
lstrcpyW.KERNEL32(?), ref: 00188227
CreateFontIndirectW.GDI32(?), ref: 00188231
CreateFontIndirectW.GDI32(?), ref: 00188250
GetStockObject.GDI32(00000011), ref: 00188266
GetObjectW.GDI32(?,0000005C,?), ref: 00188277
CreateFontIndirectW.GDI32(?), ref: 00188281
CreateFontIndirectW.GDI32(?), ref: 001882A4
__EH_prolog3_GS.LIBCMT ref: 0018832F
GetVersionExW.KERNEL32(?,0000011C), ref: 00188485
KiUserCallbackDispatcher.NTDLL(00001000), ref: 00188490
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 00188515
GetProcAddress.KERNEL32(?,DrawThemeTextEx), ref: 00188528
GetProcAddress.KERNEL32(?,BufferedPaintInit), ref: 0018853B
GetProcAddress.KERNEL32(?,BufferedPaintUnInit), ref: 0018854E
GetProcAddress.KERNEL32(?,BeginBufferedPaint), ref: 00188561
GetProcAddress.KERNEL32(?,EndBufferedPaint), ref: 00188574
GetProcAddress.KERNEL32(00000000,DwmExtendFrameIntoClientArea), ref: 001885BD
GetProcAddress.KERNEL32(?,DwmDefWindowProc), ref: 001885D0
GetProcAddress.KERNEL32(?,DwmIsCompositionEnabled), ref: 001885E3

Strings

(, xrefs: 001883A6
EndBufferedPaint, xrefs: 00188563
DwmExtendFrameIntoClientArea, xrefs: 001885B7
DrawThemeTextEx, xrefs: 00188517
dwmapi.dll, xrefs: 001885A2
BufferedPaintInit, xrefs: 0018852A
DwmIsCompositionEnabled, xrefs: 001885D2
DrawThemeParentBackground, xrefs: 0018850F
UxTheme.dll, xrefs: 001884F4
DwmDefWindowProc, xrefs: 001885BF
BufferedPaintUnInit, xrefs: 0018853D
BeginBufferedPaint, xrefs: 00188550

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Object$Font$CreateDeleteIndirect$AddressProc$lstrcpy$EnumFamiliesH_prolog3_Stock$CallbackCapsCharsetDeviceDispatcherH_prolog3InfoMetricsSystemTextUserVersionWindow_memset
String ID: BeginBufferedPaint$BufferedPaintInit$BufferedPaintUnInit$DrawThemeParentBackground$DrawThemeTextEx$DwmDefWindowProc$DwmExtendFrameIntoClientArea$DwmIsCompositionEnabled$EndBufferedPaint$UxTheme.dll$dwmapi.dll$(
API String ID: 2460119550-1884402367
Opcode ID: 5d8759c39dd6aa0f008598e2dbe045dc836fd8782ff987ff4e954a25392b401d
Instruction ID: 12384ac725f5c91c3bead42c336e266a5ea7cf2e462841d2623b82fe1c039d39
Opcode Fuzzy Hash: 5d8759c39dd6aa0f008598e2dbe045dc836fd8782ff987ff4e954a25392b401d
Instruction Fuzzy Hash: 703226B08057189FCB21AFB5C844BDEFBF8AF55300F1089AAE5AE97251DB709A44CF51

Function 02AF2320 Relevance: 89.7, APIs: 38, Strings: 13, Instructions: 447
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

_memset.LIBCMT ref: 02AF2366
_memset.LIBCMT ref: 02AF237F
_memset.LIBCMT ref: 02AF238F
gethostname.WS2_32(?,00000032), ref: 02AF239D
gethostbyname.WS2_32(?), ref: 02AF23A7
inet_ntoa.WS2_32 ref: 02AF23BF
_strcat_s.LIBCMT ref: 02AF23D2
_strcat_s.LIBCMT ref: 02AF23EB
inet_ntoa.WS2_32 ref: 02AF240C
_strcat_s.LIBCMT ref: 02AF241F
_strcat_s.LIBCMT ref: 02AF2438
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000001), ref: 02AF2465
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000001), ref: 02AF247F
GetLastInputInfo.USER32 ref: 02AF2492
GetTickCount.KERNEL32 ref: 02AF2498
wsprintfW.USER32 ref: 02AF24CD
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,?,?,?), ref: 02AF24E0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,0000021E,00000000,?,?,?), ref: 02AF24FA
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 02AF2557
wsprintfW.USER32 ref: 02AF2576
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?), ref: 02AF2591
GetWindowTextW.USER32(00000000,000005A2,000000FA), ref: 02AF25A8
lstrlenW.KERNEL32(000007A0,?,?,?,?,?,?,?,?), ref: 02AF25C5
lstrlenW.KERNEL32(00000868,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AF2624
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 02AF2698
GetProcAddress.KERNEL32(00000000), ref: 02AF269F
GetSystemInfo.KERNEL32(?), ref: 02AF26BB
wsprintfW.USER32 ref: 02AF26FA
AllocateAndInitializeSid.ADVAPI32 ref: 02AF2740
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 02AF2760
FreeSid.ADVAPI32(?), ref: 02AF276D
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 02AF2806
wsprintfW.USER32 ref: 02AF284F
GetLocaleInfoW.KERNEL32(00000800,00000002,00000C1C,00000040), ref: 02AF2864
_memset.LIBCMT ref: 02AF2878
EnumDisplayMonitors.USER32 ref: 02AF289A
GetSystemDirectoryW.KERNEL32(?,00000032), ref: 02AF28C1
GetCurrentHwProfileW.ADVAPI32(?), ref: 02AF28CE

Strings

x64, xrefs: 02AF26DB
%d min, xrefs: 02AF24C7
Network, xrefs: 02AF25B9, 02AF2618
kernel32.dll, xrefs: 02AF265D
REMARK, xrefs: 02AF2632
1.0, xrefs: 02AF25F7
2024.12.25, xrefs: 02AF2646
AppEvents, xrefs: 02AF25B2, 02AF2611
GROUP, xrefs: 02AF25D3
X86 %s, xrefs: 02AF26F4
Run:%s Con:%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 02AF2849
GetNativeSystemInfo, xrefs: 02AF2658
x86, xrefs: 02AF26E2, 02AF26ED

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ByteCharInfoMultiWide_memset_strcat_swsprintf$System$Windowinet_ntoalstrlen$AddressAllocateCheckCountCurrentDirectoryDisplayEnumForegroundFreeHandleInitializeInputLastLocalLocaleMembershipModuleMonitorsProcProfileTextTickTimeToken_mallocgethostbynamegethostname
String ID: %d min$1.0$2024.12.25$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$Run:%s Con:%4d.%2d.%2d-%2d:%2d:%2d$X86 %s$kernel32.dll$x64$x86
API String ID: 152478060-3937765074
Opcode ID: afd4af809a2050bcae8e742f08e8bd0800a9bdd64c01683c108cabe0b958a303
Instruction ID: 4ee74261cc08a09e0f80e425243fd3bc76c8efa4e7c10bc4312d212144cf46e6
Opcode Fuzzy Hash: afd4af809a2050bcae8e742f08e8bd0800a9bdd64c01683c108cabe0b958a303
Instruction Fuzzy Hash: BDF1C771E40314ABEB24DB64DC89FEAB7B9FF08740F404599F609A7181EB746A94CF90

Function 02AF9DF0 Relevance: 47.6, APIs: 20, Strings: 7, Instructions: 330
sleepsynchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B02905: __fassign.LIBCMT ref: 02B028FB

Sleep.KERNEL32(00000000), ref: 02AF9E44
CloseHandle.KERNEL32(00000000), ref: 02AF9E71

Part of subcall function 02AF1320: WSAStartup.WS2_32(00000202,?), ref: 02AF1371
Part of subcall function 02AF1320: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 02AF137C
Part of subcall function 02AF1320: InterlockedExchange.KERNEL32(0000003C,00000000), ref: 02AF138A

GetLocalTime.KERNEL32(?), ref: 02AF9EB7
wsprintfW.USER32 ref: 02AF9EEE
SetUnhandledExceptionFilter.KERNEL32(02AF43B0), ref: 02AF9EFC
CloseHandle.KERNEL32(00000000), ref: 02AF9F15

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

Sleep.KERNEL32(00000000), ref: 02AFA088
EnumWindows.USER32(Function_00002D40,?), ref: 02AFA0AA
Sleep.KERNEL32(00004E20), ref: 02AFA0B7
EnumWindows.USER32(Function_00002D40,?), ref: 02AFA0CB
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02AFA12E
Sleep.KERNEL32(00000FA0,?,?,00000208,124.156.117.13), ref: 02AFA1A8
CloseHandle.KERNEL32(?), ref: 02AFA1EC

Part of subcall function 02B017EF: ___set_flsgetvalue.LIBCMT ref: 02B01814
Part of subcall function 02B017EF: __calloc_crt.LIBCMT ref: 02B01820
Part of subcall function 02B017EF: __getptd.LIBCMT ref: 02B0182D
Part of subcall function 02B017EF: CreateThread.KERNEL32(00000000,?,02B0178A,00000000,00000000,02AFA571), ref: 02B01864
Part of subcall function 02B017EF: GetLastError.KERNEL32(?,02AFA571,00000000,00000000,02AF2F50,?,00000000,00000000), ref: 02B0186E
Part of subcall function 02B017EF: _free.LIBCMT ref: 02B01877
Part of subcall function 02B017EF: __dosmaperr.LIBCMT ref: 02B01882

Sleep.KERNEL32(000003E8), ref: 02AFA232
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02AFA25C
CloseHandle.KERNEL32(?), ref: 02AFA263
CloseHandle.KERNEL32(?), ref: 02AFA281
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02AFA2A3
CloseHandle.KERNEL32(?), ref: 02AFA2AA
CloseHandle.KERNEL32(?), ref: 02AFA2C8

Strings

7777, xrefs: 02AF9F49, 02AF9F91, 02AF9FEF, 02AFA0D5, 02AFA0FD
124.156.117.13, xrefs: 02AF9F73
7777, xrefs: 02AF9F42
7777, xrefs: 02AF9F8A
124.156.117.13, xrefs: 02AF9F2B
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 02AF9EE8
124.156.117.13, xrefs: 02AF9F35, 02AF9F7D, 02AF9FDB, 02AFA0E6, 02AFA13A

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CloseHandle$Sleep$Create$EnumEventObjectSingleWaitWindows$ErrorExceptionExchangeFilterInterlockedLastLocalStartupThreadTimeUnhandled___set_flsgetvalue__calloc_crt__dosmaperr__fassign__getptd_free_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$124.156.117.13$124.156.117.13$124.156.117.13$7777$7777$7777
API String ID: 988101634-1715954754
Opcode ID: 106f6ed6f0bd81f0873db96b1eee74c6144ad5d33c24c8a37764a43eb064be26
Instruction ID: 6d491ddedb79ecf5a07a47044237e890176d19192115f23d2a256183fccde8d6
Opcode Fuzzy Hash: 106f6ed6f0bd81f0873db96b1eee74c6144ad5d33c24c8a37764a43eb064be26
Instruction Fuzzy Hash: 6EC125B1D84301AFE3A0EFA8AC84B5B77E5EB88754F400929F65E93181DB784458CF92

Function 02AF3D60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,00000000,74DEDF80), ref: 02AF3D98
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 02AF3DB4
_memset.LIBCMT ref: 02AF3DEB
GlobalMemoryStatusEx.KERNEL32(?), ref: 02AF3DFE
swprintf.LIBCMT ref: 02AF3E43
swprintf.LIBCMT ref: 02AF3E56

Strings

@, xrefs: 02AF3DF7
HDD:%d, xrefs: 02AF3E38
:, xrefs: 02AF3D8D
%sFree%d Gb , xrefs: 02AF3E4B

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: 639f51decffe1c7d586d0a37d5c91ad332a31db76ec021e8c4674c885245670e
Instruction ID: 5356ad3ea3885d90dd3876ce249c852b7f90ca003a681e82a3fe30833de0246c
Opcode Fuzzy Hash: 639f51decffe1c7d586d0a37d5c91ad332a31db76ec021e8c4674c885245670e
Instruction Fuzzy Hash: 6C315EB2D5025C9BDB04CBE9DC85FEEBBB9FB84700F50421DE906A7280EA746945CB90

Function 028A3840 Relevance: 16.5, APIs: 11, Instructions: 43threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00002820), ref: 028A3846
GetConsoleWindow.KERNEL32(00000000), ref: 028A384E
ShowWindow.USER32(00000000), ref: 028A3855
GetCurrentThreadId.KERNEL32 ref: 028A3861
PostThreadMessageA.USER32(00000000), ref: 028A3868
GetInputState.USER32 ref: 028A386E

Part of subcall function 028A29A0: _memset.LIBCMT ref: 028A29D1
Part of subcall function 028A29A0: _memset.LIBCMT ref: 028A29E1

CreateThread.KERNEL32(00000000,00000000,Function_00002140,00000000,00000000,00000000), ref: 028A388E
CreateThread.KERNEL32(00000000,00000000,Function_00002460,00000000,00000000,00000000), ref: 028A38A4
WaitForSingleObject.KERNEL32(028C50D4,000000FF), ref: 028A38AE
CloseHandle.KERNEL32(028C50D4), ref: 028A38BB
Sleep.KERNEL32(0000012C), ref: 028A38C6

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Thread$CreateWindow_memset$CloseConsoleCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait
String ID:
API String ID: 80679444-0
Opcode ID: 5c267eda5d71feaed944071444f57180a5e9a13d827bff5c9d5d0694b3030495
Instruction ID: efa80909d18f9166adb2b6ff56f6c1865373282819680dfe50ea86026eecfca2
Opcode Fuzzy Hash: 5c267eda5d71feaed944071444f57180a5e9a13d827bff5c9d5d0694b3030495
Instruction Fuzzy Hash: C501CD7DFC4304BBF6216BB0AC0EF193B64BB04B16F600908B726EE1C0CAF464228B55

Function 02AF4110 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75comstringnativeCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 02AF412A

Part of subcall function 02AF3E70: _memset.LIBCMT ref: 02AF3ED8
Part of subcall function 02AF3E70: RegOpenKeyExW.KERNEL32(?,SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000,00000000,00020019,?,00000000,0000052A,0000039A), ref: 02AF3EFD

CoInitialize.OLE32(00000000), ref: 02AF4152
CoCreateInstance.OLE32(02B16FBC,00000000,00000017,02B16FCC,?), ref: 02AF416D
NtProtectVirtualMemory.NTDLL(?,00000000), ref: 02AF4185
swprintf.LIBCMT ref: 02AF41EC

Strings

DriverDesc, xrefs: 02AF413E
%s , xrefs: 02AF41E4
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000, xrefs: 02AF4143

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateInitializeInstanceMemoryOpenProtectVirtual_memsetlstrlenswprintf
String ID: %s $DriverDesc$SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
API String ID: 2282874092-2074342395
Opcode ID: 6415240ce7379609713c5b14a9b1335bb0ca2f97d86723ed1da36010add0aa40
Instruction ID: 810b7814fc8756323defc9dddffafb26e246814b7c4082b5197824132ef0d132
Opcode Fuzzy Hash: 6415240ce7379609713c5b14a9b1335bb0ca2f97d86723ed1da36010add0aa40
Instruction Fuzzy Hash: EE21B870B40104ABEB18DB58DC56FAAB779DB48300F5081D8F60EAB2D0DA706D54CF50

Function 00171410 Relevance: 7.5, APIs: 5, Instructions: 49processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0017142E
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00171452
__wcsicoll.LIBCMT ref: 00171467
Process32NextW.KERNEL32(000000FF,0000022C), ref: 00171489
CloseHandle.KERNEL32(000000FF), ref: 00171497

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll
String ID:
API String ID: 3102623508-0
Opcode ID: e3b121850141676bb8a676aab7a7f4c96f1add60abf990602a7094cbd31593af
Instruction ID: 632ae6c7bbf6421226ac86286d72faa6d6a16840336183bd21997663c12fd237
Opcode Fuzzy Hash: e3b121850141676bb8a676aab7a7f4c96f1add60abf990602a7094cbd31593af
Instruction Fuzzy Hash: EE113375E01208EBCB24DFA4EC4DBADB7B9AF48304F108199E509A7240E7349A84CF50

Function 02AF15C0 Relevance: 3.1, APIs: 2, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 02AF1633
recv.WS2_32(?,?,00040000,00000000), ref: 02AF1654

Part of subcall function 02AF1830: _memmove.LIBCMT ref: 02AF185E
Part of subcall function 02AF1830: _memmove.LIBCMT ref: 02AF1922

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _memmove$_mallocrecvselect
String ID:
API String ID: 1734404984-0
Opcode ID: 0139b8771b9d7cd6ed96ed7003d35a5ad3b97aa9333e601fe1a7a9fd45ee0cd8
Instruction ID: 424548e12166701934699461719d226c811824b25cb3bc97c456272b64252d99
Opcode Fuzzy Hash: 0139b8771b9d7cd6ed96ed7003d35a5ad3b97aa9333e601fe1a7a9fd45ee0cd8
Instruction Fuzzy Hash: F521F9B0A40204DFDBA0DFA8DCC4B9A77B5EF44350F5441A5FA08AB2C0DBB4A994CF91

Function 001878DC Relevance: 64.8, APIs: 43, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 001878E3
GetSysColor.USER32(00000016), ref: 001878F2
GetSysColor.USER32(0000000F), ref: 001878FF
GetSysColor.USER32(00000015), ref: 00187912
GetSysColor.USER32(0000000F), ref: 0018791A
GetDeviceCaps.GDI32(?,0000000C), ref: 00187940
GetSysColor.USER32(0000000F), ref: 0018794E
GetSysColor.USER32(00000010), ref: 00187958
GetSysColor.USER32(00000015), ref: 00187962
GetSysColor.USER32(00000016), ref: 0018796C
GetSysColor.USER32(00000014), ref: 00187976
GetSysColor.USER32(00000012), ref: 00187980
GetSysColor.USER32(00000011), ref: 0018798A
GetSysColor.USER32(00000006), ref: 00187991
GetSysColor.USER32(0000000D), ref: 00187998
GetSysColor.USER32(0000000E), ref: 0018799F
GetSysColor.USER32(00000005), ref: 001879A6
GetSysColor.USER32(00000008), ref: 001879B0
GetSysColor.USER32(00000009), ref: 001879B7
GetSysColor.USER32(00000007), ref: 001879BE
GetSysColor.USER32(00000002), ref: 001879C5
GetSysColor.USER32(00000003), ref: 001879CC
GetSysColor.USER32(0000001B), ref: 001879D3
GetSysColor.USER32(0000001C), ref: 001879DD
GetSysColor.USER32(0000000A), ref: 001879E7
GetSysColor.USER32(0000000B), ref: 001879F1
GetSysColor.USER32(00000013), ref: 001879FB
GetSysColor.USER32(0000001A), ref: 00187A15
GetSysColorBrush.USER32(00000010), ref: 00187A30
GetSysColorBrush.USER32(00000014), ref: 00187A47
GetSysColorBrush.USER32(00000005), ref: 00187A59
CreateSolidBrush.GDI32(?), ref: 00187A7D
CreateSolidBrush.GDI32(?), ref: 00187A99
CreateSolidBrush.GDI32(?), ref: 00187AB5
CreateSolidBrush.GDI32(?), ref: 00187AD1
CreateSolidBrush.GDI32(?), ref: 00187AED
CreateSolidBrush.GDI32(?), ref: 00187B09
CreateSolidBrush.GDI32(?), ref: 00187B25
CreatePen.GDI32(00000000,00000001), ref: 00187B4E
CreatePen.GDI32(00000000,00000001), ref: 00187B71
CreatePen.GDI32(00000000,00000001), ref: 00187B94
CreateSolidBrush.GDI32(?), ref: 00187C18
CreatePatternBrush.GDI32(00000000), ref: 00187C59

Part of subcall function 0017A27D: DeleteObject.GDI32(00000000), ref: 0017A28C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Color$BrushCreate$Solid$CapsDeleteDeviceH_prolog3ObjectPattern
String ID:
API String ID: 3754413814-0
Opcode ID: fa26f02b3781ffb5e24a7a8300e3257b64972c662e6bd707ee054640d3728239
Instruction ID: 2c56ed72ec6248bcf3e32b8f697efd92c07c4b70536e334139fd1cd9468dfb63
Opcode Fuzzy Hash: fa26f02b3781ffb5e24a7a8300e3257b64972c662e6bd707ee054640d3728239
Instruction Fuzzy Hash: 3FB17B70904B449ADB34BF71CC89BAFBAF0AF90700F11892DE19B965D2EB71A644DF11

Function 001D6E09 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 421
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 001D6E13
LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002000), ref: 001D6FD5
GetObjectW.GDI32(00000082,00000018,?), ref: 001D6FE7
CreateCompatibleDC.GDI32(00000000), ref: 001D7039
GetObjectW.GDI32(00000082,00000018,?), ref: 001D7054
SelectObject.GDI32(?,00000082), ref: 001D7068
CreateCompatibleBitmap.GDI32(?,?,?), ref: 001D708C
SelectObject.GDI32(?,00000000), ref: 001D709F
CreateCompatibleDC.GDI32(?), ref: 001D70B5
SelectObject.GDI32(?,?), ref: 001D70CA
SelectObject.GDI32(?,00000000), ref: 001D70D9
DeleteObject.GDI32(?), ref: 001D70DE
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 001D70FE
GetPixel.GDI32(?,?,?), ref: 001D711D
SetPixel.GDI32(?,?,?,00000000), ref: 001D7153
SelectObject.GDI32(?,?), ref: 001D7175
SelectObject.GDI32(?,00000000), ref: 001D717D
DeleteObject.GDI32(00000082), ref: 001D7182
DeleteObject.GDI32(00000082), ref: 001D71B4
__EH_prolog3.LIBCMT ref: 001D71E8
CreateCompatibleDC.GDI32(00000000), ref: 001D72B3
CreateCompatibleDC.GDI32(00000000), ref: 001D72BF

Strings

, xrefs: 001D6FED

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Object$Select$CompatibleCreate$Delete$H_prolog3Pixel$BitmapImageLoad
String ID:
API String ID: 1197801157-3916222277
Opcode ID: bfe5faa7046f0992acd6c7572ae21e8e5da9cad1b0c6e8ffc6b6b1eca50bc831
Instruction ID: 980b0a5280f06bc57437e9e946ed844f256540d85cd3354de59cf29204a71779
Opcode Fuzzy Hash: bfe5faa7046f0992acd6c7572ae21e8e5da9cad1b0c6e8ffc6b6b1eca50bc831
Instruction Fuzzy Hash: E0024970D11229DFCF15DFA4D884AAEBBB5FF18710F10816BF809AA29AD7704945CFA0

Function 02AFA2E0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223
sleepsynchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B02905: __fassign.LIBCMT ref: 02B028FB

Sleep.KERNEL32(00000000), ref: 02AFA33A
GetLocalTime.KERNEL32(?), ref: 02AFA341
wsprintfW.USER32 ref: 02AFA378
Sleep.KERNEL32(00000000), ref: 02AFA401
EnumWindows.USER32(02AF2D40,?), ref: 02AFA417
Sleep.KERNEL32(00004E20), ref: 02AFA425
EnumWindows.USER32(02AF2D40,00000000), ref: 02AFA439
Sleep.KERNEL32(0000C350), ref: 02AFA447
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02AFA4A4
CloseHandle.KERNEL32(?), ref: 02AFA54D

Part of subcall function 02AF1270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF1291
Part of subcall function 02AF1270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF12AA
Part of subcall function 02AF1270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF12C3
Part of subcall function 02AF1270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF12E3
Part of subcall function 02AF1270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF12FA
Part of subcall function 02AF1270: VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF1311

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

Sleep.KERNEL32(000003E8), ref: 02AFA585
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02AFA5A6
CloseHandle.KERNEL32(00000000), ref: 02AFA5B3
CloseHandle.KERNEL32(?), ref: 02AFA5CD
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02AFA5E6
CloseHandle.KERNEL32(00000000), ref: 02AFA5F3
CloseHandle.KERNEL32(?), ref: 02AFA60D

Strings

6341, xrefs: 02AFA44B, 02AFA473
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 02AFA372
192.168.1.2, xrefs: 02AFA45C, 02AFA4AA

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: FreeVirtual$CloseHandleSleep$EnumObjectSingleWaitWindows$CreateEventLocalTime__fassign_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$192.168.1.2$6341
API String ID: 3548684339-291747511
Opcode ID: 84a2ae2f676e1e71b6d3f365fb69d042bc0dad54534e4d2562d90061e5796f6f
Instruction ID: 88c85150291701c9fdfcbb57904c0b4a8c40fb4cbb3696bfab910366da957306
Opcode Fuzzy Hash: 84a2ae2f676e1e71b6d3f365fb69d042bc0dad54534e4d2562d90061e5796f6f
Instruction Fuzzy Hash: 0281D2B19483409BE364EFA8DC84B6BB7E5BB88750F100B5DF59D93280DB78A544CF92

Function 02AF3E70 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 165
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02AF3ED8
RegOpenKeyExW.KERNEL32(?,SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000,00000000,00020019,?,00000000,0000052A,0000039A), ref: 02AF3EFD
RegQueryValueExW.ADVAPI32(?,DriverDesc,00000000,00000001,?,00000208), ref: 02AF3F77
lstrcmpW.KERNEL32(?,02B178F0), ref: 02AF3F8D
lstrcpyW.KERNEL32(80000002,?), ref: 02AF3FA3

Strings

DriverDesc, xrefs: 02AF3F6F, 02AF3FFB, 02AF4062
error, xrefs: 02AF40BA
%s-%d, xrefs: 02AF408F
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000, xrefs: 02AF3EF5

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: OpenQueryValue_memsetlstrcmplstrcpy
String ID: %s-%d$DriverDesc$SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000$error
API String ID: 2102619503-1280345570
Opcode ID: 3dbeb6726ad67a593da5b67bfe1cca1d6b0d76b7cb09e8e609cff9a54d93cc5b
Instruction ID: 6a129e59616b57a365cb58d9edc8d8d9bd3af576aa667fafa8955739e46232bc
Opcode Fuzzy Hash: 3dbeb6726ad67a593da5b67bfe1cca1d6b0d76b7cb09e8e609cff9a54d93cc5b
Instruction Fuzzy Hash: CB516671940215EBDB71DFA4DD8CFAAB7B8EB48710F104AD9F60597280DB789A84CF60

Function 02AF2D40 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindowVisible.USER32(?), ref: 02AF2D53

Strings

Malwarebytes, xrefs: 02AF2DB3
Metascan, xrefs: 02AF2E21
TCPEye, xrefs: 02AF2DC9
Capsa, xrefs: 02AF2EB7, 02AF2EDB
TaskExplorer, xrefs: 02AF2DDF
Wireshark, xrefs: 02AF2E37
ApateDNS, xrefs: 02AF2D9D
CurrPorts, xrefs: 02AF2DF5
Port, xrefs: 02AF2E0B
Process, xrefs: 02AF2EED
Fiddler, xrefs: 02AF2E8F
Sniff, xrefs: 02AF2EC9

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: 59107de7e53303bfa89a40dbf001057e1c7f547fc3bdda07a4397d49e6de06c5
Instruction ID: 1591c02bf7359ec91bbb3bf722096de7110ca47eeb5bdc174d1e024303601b62
Opcode Fuzzy Hash: 59107de7e53303bfa89a40dbf001057e1c7f547fc3bdda07a4397d49e6de06c5
Instruction Fuzzy Hash: 0E411717EB421421B97327667C86B6B56486F227CAF0400B6FD0DA5180FF09E235A9B2

Function 028A2310 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedExchange.KERNEL32(00000000,00000001), ref: 028A234D
_memset.LIBCMT ref: 028A23AD
_memset.LIBCMT ref: 028A23D1
_memset.LIBCMT ref: 028A23E3
_memmove.LIBCMT ref: 028A240A
VirtualAlloc.KERNEL32(00000000,028C2F18,00003000,00000040), ref: 028A246E
_memmove.LIBCMT ref: 028A2487
CloseHandle.KERNEL32(00000000), ref: 028A24A3

Strings

_, xrefs: 028A2392
!jWW, xrefs: 028A2374
l, xrefs: 028A2388
., xrefs: 028A237E
i, xrefs: 028A239C
{vU_, xrefs: 028A236A

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: _memset$_memmove$AllocCloseExchangeHandleInterlockedVirtual
String ID: !jWW$.$_$i$l${vU_
API String ID: 3421416217-3065862289
Opcode ID: 260b1ae0ef4822238a054def376a3dd31bbbcfdd45ed974c756f5ca6c53c35b3
Instruction ID: ded10f2497746d63d7128dc559ab8ab9499b672858303b0335a6dd129a6f0a29
Opcode Fuzzy Hash: 260b1ae0ef4822238a054def376a3dd31bbbcfdd45ed974c756f5ca6c53c35b3
Instruction Fuzzy Hash: 9741E878A403189BE724DF14CC94F9A77B5FF49710F0041A9FA0DAB285DBB45A84CF96

Function 02AF2FC0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 99
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,2024.12.25), ref: 02AF2FE6
GetLastError.KERNEL32 ref: 02AF2FEE
Sleep.KERNEL32(000003E8), ref: 02AF3005
CreateMutexW.KERNEL32(00000000,00000000,2024.12.25), ref: 02AF3010
GetLastError.KERNEL32 ref: 02AF3012
_memset.LIBCMT ref: 02AF3039
lstrlenW.KERNEL32(?), ref: 02AF3046
lstrcmpW.KERNEL32(?,02B17AEC), ref: 02AF3074
Sleep.KERNEL32(000003E8), ref: 02AF307F
GetModuleHandleW.KERNEL32(00000000), ref: 02AF308C
GetConsoleWindow.KERNEL32 ref: 02AF3096

Strings

open, xrefs: 02AF3054
2024.12.25, xrefs: 02AF2FDD, 02AF3007
key, xrefs: 02AF3059

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: 2024.12.25$key$open
API String ID: 2922109467-228899315
Opcode ID: 7a085289da70af467e47ea7bfcd683f9207068e5bac46875f38cced62aad1505
Instruction ID: 5a00d55e5892adf60a61d3779ead13c6ad0804547d72763d1b443bb8cb40373f
Opcode Fuzzy Hash: 7a085289da70af467e47ea7bfcd683f9207068e5bac46875f38cced62aad1505
Instruction Fuzzy Hash: 4E212871D803059BE710EBB0EC85F1A77A5EB94784F400869F705931C0DF749529CB92

Function 02AF1410 Relevance: 21.2, APIs: 14, Instructions: 157
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 02AF1431
InterlockedExchange.KERNEL32(?,00000000), ref: 02AF143D
timeGetTime.WINMM ref: 02AF1443
socket.WS2_32(00000002,00000001,00000006), ref: 02AF146A
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 02AF1496
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02AF14A2
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000), ref: 02AF14C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 02AF14CD
gethostbyname.WS2_32(00000000), ref: 02AF14DB
htons.WS2_32(?), ref: 02AF14FE
connect.WS2_32(?,?,00000010), ref: 02AF151C
setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 02AF1544
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 02AF1576
InterlockedExchange.KERNEL32(?,00000001), ref: 02AF1581

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ByteCharExchangeInterlockedMultiWidelstrlen$EventIoctlResetTimeconnectgethostbynamehtonssetsockoptsockettime
String ID:
API String ID: 2541589167-0
Opcode ID: 0545408c3a5bb113bf659850f46a859e6d7efea086c2175f8dc0979612ee52ae
Instruction ID: 72e0597cf4fb0236197c239318b31bfd73555a19a79dbfa283a501e709b4d022
Opcode Fuzzy Hash: 0545408c3a5bb113bf659850f46a859e6d7efea086c2175f8dc0979612ee52ae
Instruction Fuzzy Hash: 5B5183B1A40304AFD710DFA4EC85FAABBF9FF48710F504529F606E7680D7B0A9558B54

Function 028A1410 Relevance: 21.2, APIs: 14, Instructions: 157
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 028A1431
InterlockedExchange.KERNEL32(?,00000000), ref: 028A143D
timeGetTime.WINMM ref: 028A1443
socket.WS2_32(00000002,00000001,00000006), ref: 028A146A
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 028A1496
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 028A14A2
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000), ref: 028A14C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 028A14CD
gethostbyname.WS2_32(00000000), ref: 028A14DB
htons.WS2_32(?), ref: 028A14FE
connect.WS2_32(?,?,00000010), ref: 028A151C
setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 028A1544
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 028A1576
InterlockedExchange.KERNEL32(?,00000001), ref: 028A1581

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ByteCharExchangeInterlockedMultiWidelstrlen$EventIoctlResetTimeconnectgethostbynamehtonssetsockoptsockettime
String ID:
API String ID: 2541589167-0
Opcode ID: 2575fb9af5e10589e3df80ff88067b3b62ae835981a6caf9746104011a42472d
Instruction ID: 78cf934f8a155f64cc1db6090392c0f87a79b7ba30c2d79061cae98793f56ee9
Opcode Fuzzy Hash: 2575fb9af5e10589e3df80ff88067b3b62ae835981a6caf9746104011a42472d
Instruction Fuzzy Hash: DA514B79A40304AFE720DFA8DC45FAEB7B9BB48714F10451DFA16E76D0D7B0A8058B60

Function 02AF4290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ntdll.dll,75BF73E0,?,?,?,02AF2515,000002E6,00000282,?,?,?), ref: 02AF429C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 02AF42B2
swprintf.LIBCMT ref: 02AF42EF

Part of subcall function 02AF4210: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,02AF4323), ref: 02AF423D
Part of subcall function 02AF4210: GetProcAddress.KERNEL32(00000000), ref: 02AF4244
Part of subcall function 02AF4210: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,02AF4323), ref: 02AF4252

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,00000282), ref: 02AF4347
RegQueryValueExW.KERNEL32(00000282,ProductName,00000000,00000001,00000000,?), ref: 02AF4363
RegCloseKey.KERNEL32(00000282), ref: 02AF4386
FreeLibrary.KERNEL32(00000000,?,?,?,02AF2515,000002E6,00000282,?,?,?), ref: 02AF4398

Strings

ntdll.dll, xrefs: 02AF4297
RtlGetNtVersionNumbers, xrefs: 02AF42AC
ProductName, xrefs: 02AF435D
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 02AF433D
%d.%d.%d, xrefs: 02AF42E7

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: dea35be05041cfd3b187e5218470170ccf25974da3e894e3c8ef7f0aa4d4958f
Instruction ID: f68292c1033ad5827e001cfde8d2ef2de52792c19df7f11cff0892956d41e4bb
Opcode Fuzzy Hash: dea35be05041cfd3b187e5218470170ccf25974da3e894e3c8ef7f0aa4d4958f
Instruction Fuzzy Hash: 95318876A40208BBE714DBE4DC85FBFBBBDDB48740F544598FB09A7181DB749A1087A0

Function 00171660 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001714C0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001714D7

Part of subcall function 00171590: Sleep.KERNEL32(00000000,?,000003E8,00002710,00000000,000000FF,6C078965,002B533E,745E08A5,?,0028A0EB,000000FF), ref: 00171640

Part of subcall function 00171410: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0017142E
Part of subcall function 00171410: Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00171452
Part of subcall function 00171410: __wcsicoll.LIBCMT ref: 00171467
Part of subcall function 00171410: CloseHandle.KERNEL32(000000FF), ref: 00171497

Part of subcall function 00171410: Process32NextW.KERNEL32(000000FF,0000022C), ref: 00171489

TerminateThread.KERNEL32(00000000,00000000), ref: 001716F3
CloseHandle.KERNEL32(00000000), ref: 001716FD
TerminateThread.KERNEL32(00000000,00000000), ref: 00171716
CloseHandle.KERNEL32(00000000), ref: 00171720
CreateThread.KERNEL32(00000000,00000000,Function_000013B0,00000000,00000000,?), ref: 00171752
CreateThread.KERNEL32(00000000,00000000,Function_000013B0,00000000,00000000,?), ref: 00171774
CreateThread.KERNEL32(00000000,00000000,Function_000014B0,00000000,00000000,?), ref: 001717AF
CreateThread.KERNEL32(00000000,00000000,Function_000014B0,00000000,00000000,?), ref: 001717D6
Sleep.KERNEL32(00001388), ref: 001717E8

Strings

360Safe.exe, xrefs: 00171677, 001716C7
360Tray.exe, xrefs: 00171670, 001716B8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CreateThread$CloseHandle$Process32SleepSnapshotTerminateToolhelp32$FirstNext__wcsicoll
String ID: 360Safe.exe$360Tray.exe
API String ID: 1169703884-80816502
Opcode ID: 7ff438b0522e53fa82c7cd8241f343f32e0bcf645c887d5da70aced63847a184
Instruction ID: 92f985d0991d560fc12795790208d48d057ebe4a6cdd79753b578b5424884962
Opcode Fuzzy Hash: 7ff438b0522e53fa82c7cd8241f343f32e0bcf645c887d5da70aced63847a184
Instruction Fuzzy Hash: F0510975D40208ABEB14DFE8D84ABEEB7B4BB48705F248418E5057A2C0D7B55A84CFA5

Function 001A25A3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 001A25E0
PathFindExtensionW.SHLWAPI(?), ref: 001A25FA
__wcsdup.LIBCMT ref: 001A2644
__wcsdup.LIBCMT ref: 001A2682
__wcsdup.LIBCMT ref: 001A26B6
__wcsdup.LIBCMT ref: 001A271C
__wcsdup.LIBCMT ref: 001A275D

Strings

.HLP, xrefs: 001A26FB
.CHM, xrefs: 001A26F4
.INI, xrefs: 001A273E

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: __wcsdup$ExtensionFileFindModuleNamePath
String ID: .CHM$.HLP$.INI
API String ID: 2477486372-4017452060
Opcode ID: bf4f06054465d5891bd19f976396a731513b56cbdc57b4ff0d593502547b544f
Instruction ID: 1b149e3d8a89cc1a5547e53f0a61b6d9ec7d5e176f9d69feb254a7ef9cb70291
Opcode Fuzzy Hash: bf4f06054465d5891bd19f976396a731513b56cbdc57b4ff0d593502547b544f
Instruction Fuzzy Hash: 0D5193B49113099BDB20EB78CC45BAA73FCBF15314F0048AAE94AD6181EF70D998CF65

Function 028A8ED0 Relevance: 16.8, APIs: 11, Instructions: 324timenetworkCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 028A8FCF
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF,80004005,?,00000000,000000FF,00000000), ref: 028A9035
_free.LIBCMT ref: 028A905D
_malloc.LIBCMT ref: 028A90A4

Part of subcall function 028AB087: __FF_MSGBANNER.LIBCMT ref: 028AB0A0
Part of subcall function 028AB087: __NMSG_WRITE.LIBCMT ref: 028AB0A7
Part of subcall function 028AB087: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 028AB0CC

_free.LIBCMT ref: 028A90BC

Part of subcall function 028AB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1DE
Part of subcall function 028AB1C8: GetLastError.KERNEL32(00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1F0

std::exception::exception.LIBCMT ref: 028A90DF
__CxxThrowException@8.LIBCMT ref: 028A90F4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 028A9121
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 028A91BE
CloseHandle.KERNEL32(00000000), ref: 028A922A
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 028A9247

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ErrorLast$HeapTimerWaitable_free$AllocateCloseCreateEventsException@8FreeHandleMultipleThrowWait_mallocstd::exception::exception
String ID:
API String ID: 1916819448-0
Opcode ID: cd4d5d1db2a42a961286643634559280016bd7a2e3a59c94c2578578a96b158e
Instruction ID: d788787c3bde66d155626269a9381ea284f40f2e0ad0812420b9b6b8ad0e290d
Opcode Fuzzy Hash: cd4d5d1db2a42a961286643634559280016bd7a2e3a59c94c2578578a96b158e
Instruction Fuzzy Hash: 62C19DBCA046058FEB20DF69C864B6EB7F5AF88304F144529D95AD7780EF79E900CB91

Function 0018386E Relevance: 16.6, APIs: 11, Instructions: 106memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(002FFD28,?,?,?,002FFD0C,002FFD0C,?,00183CC4,00000004,0017B9B7,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00183881
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,002FFD0C,002FFD0C,?,00183CC4,00000004,0017B9B7,00175FA4,00175A05,?,0017612F,00000004), ref: 001838D7
GlobalHandle.KERNEL32(008064C8), ref: 001838E0
GlobalUnlock.KERNEL32(00000000), ref: 001838EA
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 00183903
GlobalHandle.KERNEL32(008064C8), ref: 00183915
GlobalLock.KERNEL32(00000000), ref: 0018391C
LeaveCriticalSection.KERNEL32(?,?,?,?,002FFD0C,002FFD0C,?,00183CC4,00000004,0017B9B7,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00183925
GlobalLock.KERNEL32(00000000), ref: 00183931
_memset.LIBCMT ref: 0018394B
LeaveCriticalSection.KERNEL32(?), ref: 00183979

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: c06ec9d99f6e45d8db9bf3316c20c9e69a93ae12754f7afdbf839481d4719043
Instruction ID: 9f9d88203f77305882012d7e026faa69533fd316eb4c7aa8bc4f040dfedd6e40
Opcode Fuzzy Hash: c06ec9d99f6e45d8db9bf3316c20c9e69a93ae12754f7afdbf839481d4719043
Instruction Fuzzy Hash: 5C31C171A00704AFD720AF64EC8DA1A7BF9FF44700B198969F466D3651DB70EA458F60

Function 028A7ED0 Relevance: 15.1, APIs: 10, Instructions: 113networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000030), ref: 028A7EE8
connect.WS2_32(?,?,-0000001D), ref: 028A7F10
WSAGetLastError.WS2_32 ref: 028A7F23
connect.WS2_32(?,?,-0000001D), ref: 028A7F57
WSAEventSelect.WS2_32(?,?,00000023), ref: 028A7F70
SetLastError.KERNEL32(00000000), ref: 028A7F8F
GetLastError.KERNEL32 ref: 028A7FA6
WSASetLastError.WS2_32(00000000), ref: 028A7FB6
send.WS2_32(?,00000000,00000000,00000000), ref: 028A7FCD
WSAGetLastError.WS2_32 ref: 028A7FD8

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ErrorLast$EventSelectconnect$send
String ID:
API String ID: 1826129850-0
Opcode ID: ec93c4ffaa2e2369712f6e48653ebb26226b8d64482b6007baf5323bd8a1a4bc
Instruction ID: 14caf08ba2643d02f753e06ce928b4691d688447c50adba66a49f646acfec42a
Opcode Fuzzy Hash: ec93c4ffaa2e2369712f6e48653ebb26226b8d64482b6007baf5323bd8a1a4bc
Instruction Fuzzy Hash: 4531B47E6006005FE3345B79EC59A2FB7A9EBC4324B144B1DF92AC76C0DB74D9158B60

Function 028A87C0 Relevance: 13.7, APIs: 9, Instructions: 154networkCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 028A8803
RtlLeaveCriticalSection.NTDLL(?), ref: 028A884E
send.WS2_32(?,?,?,00000000), ref: 028A8877
RtlEnterCriticalSection.NTDLL(?), ref: 028A888A
RtlLeaveCriticalSection.NTDLL(?), ref: 028A889D
SetLastError.KERNEL32(00000000), ref: 028A88A5
WSAGetLastError.WS2_32 ref: 028A8902
RtlEnterCriticalSection.NTDLL(?), ref: 028A8916
RtlLeaveCriticalSection.NTDLL(?), ref: 028A894F

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ErrorLast$send
String ID:
API String ID: 484515946-0
Opcode ID: 1d430c64c5a38b97980a97e4e4aa0453ee8dcc99d2fa8d9d1560cf08ba2eff9a
Instruction ID: ebaee380180dd7454a05975f7d2bb14ae44a0ac65628cce6440098f1e0f5d608
Opcode Fuzzy Hash: 1d430c64c5a38b97980a97e4e4aa0453ee8dcc99d2fa8d9d1560cf08ba2eff9a
Instruction Fuzzy Hash: DE515DB9904705DFD321CF68D998BAAB7F4FB48315F504A2EE86AC3740EB34A444CB61

Function 028A3140 Relevance: 10.7, APIs: 7, Instructions: 203sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 028AAE62: __fassign.LIBCMT ref: 028AAE58

Sleep.KERNEL32(00000000), ref: 028A3194
Sleep.KERNEL32(000007D0), ref: 028A31B5
Sleep.KERNEL32(00000000), ref: 028A3327
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 028A3372
Sleep.KERNEL32(000003E8), ref: 028A33D0
CloseHandle.KERNEL32(?), ref: 028A3415
CloseHandle.KERNEL32(?), ref: 028A3451

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Sleep$CloseHandle$CreateEvent__fassign
String ID:
API String ID: 1692144934-0
Opcode ID: dc91db76a2bf042f3fa904be5ea3f1e46bced5d39e8e598763322f8041542915
Instruction ID: 3a405765966bf4f488956de00eb2bd3931a335e93c79537899f7eed135878a6c
Opcode Fuzzy Hash: dc91db76a2bf042f3fa904be5ea3f1e46bced5d39e8e598763322f8041542915
Instruction Fuzzy Hash: F87113BCA48381AFE724DF68D891B5AB7E4AB84304F20496DF489D3380DF749555CB93

Function 028A5F70 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 028A5FB8
_free.LIBCMT ref: 028A5FF6
_free.LIBCMT ref: 028A6035
_free.LIBCMT ref: 028A6075
_free.LIBCMT ref: 028A609D
_free.LIBCMT ref: 028A60C1
_free.LIBCMT ref: 028A60F9

Part of subcall function 028AB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1DE
Part of subcall function 028AB1C8: GetLastError.KERNEL32(00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1F0

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ce42a144bcb5237e3a7e614b2cb928886a4212882dc10d8c6945b558058cb364
Instruction ID: 8daa2a963097c7923dca37494c50f1936107c217c2d4e69972742b28cc196097
Opcode Fuzzy Hash: ce42a144bcb5237e3a7e614b2cb928886a4212882dc10d8c6945b558058cb364
Instruction Fuzzy Hash: E2514FBEA00115CFDB10DF18C4D4955BBA6FF4921872A806DC50EEB311DB72AD42CF91

Function 028A2190 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82sleepCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 028A21C5
GetExitCodeProcess.KERNEL32(00000000,?), ref: 028A224B
Sleep.KERNEL32(00000BB8), ref: 028A2264
_wprintf.LIBCMT ref: 028A2272

Strings

houmenpeizhi, xrefs: 028A21D5
denglupeizhi, xrefs: 028A21A6

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CodeExitProcessSleep_memmove_wprintf
String ID: denglupeizhi$houmenpeizhi
API String ID: 272709134-95055996
Opcode ID: 5a4a729de6651fb2f14cb70860b4ef8d59e28fb1cc5af34e504bc036cf9436e4
Instruction ID: 83f472f425470b03f2307525fdc67a388e93da062a58f0c86c5421febafc7002
Opcode Fuzzy Hash: 5a4a729de6651fb2f14cb70860b4ef8d59e28fb1cc5af34e504bc036cf9436e4
Instruction Fuzzy Hash: AF21297EA443059FF720DE689C15A9B37A8AB94328F040928FD18D32C4FB70D915C7E2

Function 02B017EF Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02B01814
__calloc_crt.LIBCMT ref: 02B01820
__getptd.LIBCMT ref: 02B0182D
CreateThread.KERNEL32(00000000,?,02B0178A,00000000,00000000,02AFA571), ref: 02B01864
GetLastError.KERNEL32(?,02AFA571,00000000,00000000,02AF2F50,?,00000000,00000000), ref: 02B0186E
_free.LIBCMT ref: 02B01877
__dosmaperr.LIBCMT ref: 02B01882

Part of subcall function 02B04208: __getptd_noexit.LIBCMT ref: 02B04208

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 730f7c859b0e2bf49331852f63cd68545e2e343e22beb4cb5b30cc460553ccbd
Instruction ID: 2eaaf664da931985e1db71af1b2be8262f5407285677387b9ea8d6093b3df4c6
Opcode Fuzzy Hash: 730f7c859b0e2bf49331852f63cd68545e2e343e22beb4cb5b30cc460553ccbd
Instruction Fuzzy Hash: 431129322103066FE71BAFA89CC099B3FF9EF5537470005A9F918971D0DB70D9108AA4

Function 028AAA21 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 028AAA46
__calloc_crt.LIBCMT ref: 028AAA52
__getptd.LIBCMT ref: 028AAA5F
CreateThread.KERNEL32(?,?,028AA9BC,00000000,?,?), ref: 028AAA96
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 028AAAA0
_free.LIBCMT ref: 028AAAA9
__dosmaperr.LIBCMT ref: 028AAAB4

Part of subcall function 028ACA78: __getptd_noexit.LIBCMT ref: 028ACA78

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 6094db01a9b1cd46f3e8751f83a003bb65ecd151471d87b6b0205c829f1dd858
Instruction ID: b408c40329bf776a5a792a7933bf8b7b120ad19e63a3642e2639f66582d85625
Opcode Fuzzy Hash: 6094db01a9b1cd46f3e8751f83a003bb65ecd151471d87b6b0205c829f1dd858
Instruction Fuzzy Hash: A311E93E1047066FFB15AFA89C50D6B3BEAEF05364B10001AF91AD6590DF71E821CBA1

Function 0017B140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0017B173
SetLastError.KERNEL32(0000006F), ref: 0017B18A
CreateActCtxWWorker.KERNEL32(?), ref: 0017B1D2
CreateActCtxWWorker.KERNEL32(00000020), ref: 0017B1F0
CreateActCtxWWorker.KERNEL32(00000020), ref: 0017B212

Strings

, xrefs: 0017B1B4

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CreateWorker$ErrorFileLastModuleName
String ID:
API String ID: 3218422885-3916222277
Opcode ID: 3bb4f65ea0068db9c5804add20fee5184df7be42ef711f04e1502ec732e4916a
Instruction ID: 9aceb4981983dbec03b69484fdeecaba2e4401d2c49fe5dc2a8517da93579ef6
Opcode Fuzzy Hash: 3bb4f65ea0068db9c5804add20fee5184df7be42ef711f04e1502ec732e4916a
Instruction Fuzzy Hash: 0E217C718052189ECB20DF75E89C7EEB7F8BF54324F10869AD069E2190DB746A89CF60

Function 001714C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001714D7
_memset.LIBCMT ref: 00171509
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 00171526
Process32NextW.KERNEL32(000000FF,0000022C), ref: 00171542
CloseHandle.KERNEL32(000000FF), ref: 00171576

Strings

P, xrefs: 00171562

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID: P
API String ID: 2526126748-3110715001
Opcode ID: 82f380d6d078311017ca81a78a851880b8ffbe8d10ef04d792e95e2f302fdce5
Instruction ID: 1f996de66b57058fb43aa0dcbb1fb348320d7f09f7a415823f519062080d9909
Opcode Fuzzy Hash: 82f380d6d078311017ca81a78a851880b8ffbe8d10ef04d792e95e2f302fdce5
Instruction Fuzzy Hash: 20111F74D02218EBDB24EFA4EC9DB99B7B8EB48704F6082D5E50A67291DB345BC4CF50

Function 02AF4210 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,02AF4323), ref: 02AF423D
GetProcAddress.KERNEL32(00000000), ref: 02AF4244
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,02AF4323), ref: 02AF4252
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,02AF4323), ref: 02AF425A

Strings

kernel32.dll, xrefs: 02AF421D
GetNativeSystemInfo, xrefs: 02AF4218

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 107caea2fbbb54f307169f3c4a3189e13ed687ee90dc431588dee41b6a4ac909
Instruction ID: 03a1c4c107e34d1865e3b8d3252422efb5605ad785dadf75090d0cd10c94a80d
Opcode Fuzzy Hash: 107caea2fbbb54f307169f3c4a3189e13ed687ee90dc431588dee41b6a4ac909
Instruction Fuzzy Hash: EA012CB0D402099FDF90DFF498446AEBBF4EB4C300F5045AAE509E3240EB759A50CB60

Function 001F7D69 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001F7D70

Part of subcall function 0018872C: EnterCriticalSection.KERNEL32(00300170,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188766
Part of subcall function 0018872C: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188778
Part of subcall function 0018872C: LeaveCriticalSection.KERNEL32(00300170,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188785
Part of subcall function 0018872C: EnterCriticalSection.KERNEL32(?,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188795

GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 001F7DC8
GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 001F7DDA

Strings

windows, xrefs: 001F7DC2, 001F7DC7, 001F7DD4
DragMinDist, xrefs: 001F7DBD
DragDelay, xrefs: 001F7DCF

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: edee8ad05bc8ef39b85dfa1b6709a4b29a192acdd04965d529d62f4b4ff320aa
Instruction ID: 39c30e18f535607c496f7de30786e1dd156e84736450a65f4723d72758874e07
Opcode Fuzzy Hash: edee8ad05bc8ef39b85dfa1b6709a4b29a192acdd04965d529d62f4b4ff320aa
Instruction Fuzzy Hash: EC0184B19527049BDB62AF2A9D41A0AFAFCBFA4700F90090FE68597791C7F05551CF84

Function 02B0178A Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 02B01790

Part of subcall function 02B04429: TlsGetValue.KERNEL32(00000000,02B04582,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000,00000000), ref: 02B04432
Part of subcall function 02B04429: DecodePointer.KERNEL32(?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000,00000000,?,02B0468F,0000000D), ref: 02B04444
Part of subcall function 02B04429: TlsSetValue.KERNEL32(00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000,00000000,?,02B0468F), ref: 02B04453

___fls_getvalue@4.LIBCMT ref: 02B0179B

Part of subcall function 02B04409: TlsGetValue.KERNEL32(?,?,02B017A0,00000000), ref: 02B04417

___fls_setvalue@8.LIBCMT ref: 02B017AE

Part of subcall function 02B0445D: DecodePointer.KERNEL32(?,?,?,02B017B3,00000000,?,00000000), ref: 02B0446E

GetLastError.KERNEL32(00000000,?,00000000), ref: 02B017B7
ExitThread.KERNEL32 ref: 02B017BE
GetCurrentThreadId.KERNEL32 ref: 02B017C4
__freefls@4.LIBCMT ref: 02B017E4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: d4c1a4267ae73a6983dff18817b5006a67f88ec6b690df17a6c68ae1830b1d8d
Instruction ID: 4915132864d27ebf6217c7820ec707769273ce7daf5c35650872f6202b1d566d
Opcode Fuzzy Hash: d4c1a4267ae73a6983dff18817b5006a67f88ec6b690df17a6c68ae1830b1d8d
Instruction Fuzzy Hash: 24F090B5900201AFC70ABFB5D58884E7FFAEF483443148898EA0987291DF34E882CF91

Function 028AA9BC Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 028AA9C2

Part of subcall function 028ACB2A: TlsGetValue.KERNEL32(7FFFFFFF,028ACC83,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000,?,028AAE5D,?), ref: 028ACB33
Part of subcall function 028ACB2A: RtlDecodePointer.NTDLL ref: 028ACB45
Part of subcall function 028ACB2A: TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000,?,028AAE5D,?,00000000), ref: 028ACB54

___fls_getvalue@4.LIBCMT ref: 028AA9CD

Part of subcall function 028ACB0A: TlsGetValue.KERNEL32(?,?,028AA9D2,00000000), ref: 028ACB18

___fls_setvalue@8.LIBCMT ref: 028AA9E0

Part of subcall function 028ACB5E: RtlDecodePointer.NTDLL(?), ref: 028ACB6F

GetLastError.KERNEL32(00000000,?,00000000), ref: 028AA9E9
RtlExitUserThread.NTDLL(00000000), ref: 028AA9F0
GetCurrentThreadId.KERNEL32 ref: 028AA9F6
__freefls@4.LIBCMT ref: 028AAA16

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLastUser___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2876972746-0
Opcode ID: b8e623e5b4dbb46393da88e317037db38acb781fd55b513739cf50e326f52de1
Instruction ID: 362c5b028cfd5d9b2bbcd1a3599776a7d4e697b4f4279995139399b56ad34c92
Opcode Fuzzy Hash: b8e623e5b4dbb46393da88e317037db38acb781fd55b513739cf50e326f52de1
Instruction Fuzzy Hash: 1DF0907C401244AFE70CBF65C55884E7BEAEF483087108459E81AD7211EF35D843CFA2

Function 028A3460 Relevance: 9.1, APIs: 6, Instructions: 149sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 028AAE62: __fassign.LIBCMT ref: 028AAE58

Sleep.KERNEL32(00000000), ref: 028A34BA
Sleep.KERNEL32(000007D0), ref: 028A34CC
Sleep.KERNEL32(00000000), ref: 028A3557
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 028A35A5
CloseHandle.KERNEL32(?), ref: 028A364D

Part of subcall function 028AA8DC: _malloc.LIBCMT ref: 028AA8F6

CloseHandle.KERNEL32(?), ref: 028A368E

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Sleep$CloseHandle$CreateEvent__fassign_malloc
String ID:
API String ID: 1495094446-0
Opcode ID: dd124715b231aa5ce6788e0d501c7218f278f096c9ae2dc768ecc4c98dee7500
Instruction ID: 57026ed3c3423051fa361202a6899459b82517b19aa455637a2a82df19f84cd5
Opcode Fuzzy Hash: dd124715b231aa5ce6788e0d501c7218f278f096c9ae2dc768ecc4c98dee7500
Instruction Fuzzy Hash: F2518BBCA043409FE721DF28C89479BB7E4AB88718F100A59E599D73C0DB34E645CB92

Function 028A92D0 Relevance: 9.1, APIs: 6, Instructions: 134networkCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 028A93DD

Part of subcall function 028A7ED0: WSAEventSelect.WS2_32(?,?,00000030), ref: 028A7EE8
Part of subcall function 028A7ED0: connect.WS2_32(?,?,-0000001D), ref: 028A7F10
Part of subcall function 028A7ED0: WSAGetLastError.WS2_32 ref: 028A7F23

ResetEvent.KERNEL32(?), ref: 028A93AF
WSAGetLastError.WS2_32 ref: 028A93CE
WSAGetLastError.WS2_32 ref: 028A93F5
WSAGetLastError.WS2_32 ref: 028A9404
GetLastError.KERNEL32 ref: 028A942E

Part of subcall function 028A7DF0: bind.WS2_32(?,?,-0000001D), ref: 028A7E28

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ErrorLast$Event$ResetSelectbindconnect
String ID:
API String ID: 1052395590-0
Opcode ID: d2ac855089277878522db42fc53950ea1b8c4dee6fc51efaf5040f777f9c6c3b
Instruction ID: d33f731a3a1354b0bcdce8734e50ccb49adf53cacb296c072578b26e3c971c6e
Opcode Fuzzy Hash: d2ac855089277878522db42fc53950ea1b8c4dee6fc51efaf5040f777f9c6c3b
Instruction Fuzzy Hash: AD4182796046048FD720DF99D894A6FB7F9BF88304F14892EE90AC7240DF75E905CBA1

Function 028A9950 Relevance: 9.1, APIs: 6, Instructions: 102timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 028A9978

Part of subcall function 028AB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1DE
Part of subcall function 028AB1C8: GetLastError.KERNEL32(00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1F0

_malloc.LIBCMT ref: 028A99C6
_free.LIBCMT ref: 028A99E1
std::exception::exception.LIBCMT ref: 028A9A0D
__CxxThrowException@8.LIBCMT ref: 028A9A22
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF), ref: 028A9A70

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: _free$ErrorException@8FreeHeapLastThrowTimerWaitable_mallocstd::exception::exception
String ID:
API String ID: 2829241915-0
Opcode ID: c12476bc2188c6d3366a8a28bf27b25340cee2d0b8d71e1d0e584109b907d328
Instruction ID: 96b05b12f1bea17b48e495dcfedfda9fa869c75fd451c84dba9d6556b4c3a58a
Opcode Fuzzy Hash: c12476bc2188c6d3366a8a28bf27b25340cee2d0b8d71e1d0e584109b907d328
Instruction Fuzzy Hash: 533170BDA45705ABE720DF7988A0BEBB7E9BF89304F14042ED55AD3240EF71A904CB51

Function 028A85F0 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 028A8622
_free.LIBCMT ref: 028A8635

Part of subcall function 028AB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1DE
Part of subcall function 028AB1C8: GetLastError.KERNEL32(00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1F0

HeapDestroy.KERNELBASE(?,?,?,?,?,?,028BA808,000000FF), ref: 028A8685
HeapCreate.KERNEL32(?,?,?,?,?,?,?,?,028BA808,000000FF), ref: 028A8697
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 028A86CB
RtlLeaveCriticalSection.NTDLL(?), ref: 028A86D5

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Heap$CriticalSection$CreateDestroyEnterErrorEventFreeLastLeave_free
String ID:
API String ID: 2758866208-0
Opcode ID: 9b4d72ec15c040c31789e6dd2f1796e67de2877da81915a3df6821b29f582c1b
Instruction ID: 04bef5d46dddd0e3b1ae59bcc5a9c6fbe29ab1cc5b6199978004a616444e1b6d
Opcode Fuzzy Hash: 9b4d72ec15c040c31789e6dd2f1796e67de2877da81915a3df6821b29f582c1b
Instruction Fuzzy Hash: FC31D8B9900B049FD721DF69D894AABF7E8FB48314F504A2EE95AC3750DB74A904CF50

Function 028A7CA0 Relevance: 9.1, APIs: 6, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000023), ref: 028A7CBB
WSAGetLastError.WS2_32 ref: 028A7CC6
SetLastError.KERNEL32(00000000), ref: 028A7CF6
send.WS2_32(?,00000000,00000000,00000000), ref: 028A7D17
WSAGetLastError.WS2_32 ref: 028A7D22
GetLastError.KERNEL32 ref: 028A7D45

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: 80f2d52462798315c4f76a16245f07f4454838c19ac3cc9cb0664fc6707d5073
Instruction ID: ea6e04c711979b0db0471dba518e2044d14dd02fa7c4d4de02eadc7430e708ef
Opcode Fuzzy Hash: 80f2d52462798315c4f76a16245f07f4454838c19ac3cc9cb0664fc6707d5073
Instruction Fuzzy Hash: 81212F796407009FE3309F69E858B2BB7E5EB44328F104A2EE655C66C0DB75E5049B91

Function 028AA9B0 Relevance: 9.0, APIs: 6, Instructions: 29threadCOMMON

Download Yara Rule

APIs

Part of subcall function 028AD2B2: _doexit.LIBCMT ref: 028AD2BE

___set_flsgetvalue.LIBCMT ref: 028AA9C2

Part of subcall function 028ACB2A: TlsGetValue.KERNEL32(7FFFFFFF,028ACC83,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000,?,028AAE5D,?), ref: 028ACB33
Part of subcall function 028ACB2A: RtlDecodePointer.NTDLL ref: 028ACB45
Part of subcall function 028ACB2A: TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000,?,028AAE5D,?,00000000), ref: 028ACB54

___fls_getvalue@4.LIBCMT ref: 028AA9CD

Part of subcall function 028ACB0A: TlsGetValue.KERNEL32(?,?,028AA9D2,00000000), ref: 028ACB18

___fls_setvalue@8.LIBCMT ref: 028AA9E0

Part of subcall function 028ACB5E: RtlDecodePointer.NTDLL(?), ref: 028ACB6F

GetLastError.KERNEL32(00000000,?,00000000), ref: 028AA9E9
RtlExitUserThread.NTDLL(00000000), ref: 028AA9F0
GetCurrentThreadId.KERNEL32 ref: 028AA9F6
__freefls@4.LIBCMT ref: 028AAA16

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLastUser___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 811752470-0
Opcode ID: a0c66045a897e61fecadbf20ec158ce8c142ec4d484d86467457f914af0321d2
Instruction ID: 3afaf42c6fe68514f15914ec62d4867884979e1d9b551130cdd97e6a61f89f61
Opcode Fuzzy Hash: a0c66045a897e61fecadbf20ec158ce8c142ec4d484d86467457f914af0321d2
Instruction Fuzzy Hash: B7E0E53D841209ABEB193BB5C92899F7BAEAE04345B110815ED26E3900EF359553CEA3

Function 02B016AA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02B016C4

Part of subcall function 02B01DDE: __FF_MSGBANNER.LIBCMT ref: 02B01DF7
Part of subcall function 02B01DDE: __NMSG_WRITE.LIBCMT ref: 02B01DFE
Part of subcall function 02B01DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01E23

std::exception::exception.LIBCMT ref: 02B016F9
std::exception::exception.LIBCMT ref: 02B01713
__CxxThrowException@8.LIBCMT ref: 02B01724

Strings

bad allocation, xrefs: 02B016F2

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: b9e534ab91c9da32a88f9262a0ca58be9b65f47bc4e160fd6bf55094a101be94
Instruction ID: 6968916876c7df279560f49832e419c7cff9f0f3eab654dcaae6cd9c174ef89c
Opcode Fuzzy Hash: b9e534ab91c9da32a88f9262a0ca58be9b65f47bc4e160fd6bf55094a101be94
Instruction Fuzzy Hash: 6AF0F93191030996DB1AEF5DDC84AAF7FB6EB00394F0505D5E41CE70D1DB7096098F50

Function 028AA8DC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 028AA8F6

Part of subcall function 028AB087: __FF_MSGBANNER.LIBCMT ref: 028AB0A0
Part of subcall function 028AB087: __NMSG_WRITE.LIBCMT ref: 028AB0A7
Part of subcall function 028AB087: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 028AB0CC

std::exception::exception.LIBCMT ref: 028AA92B
std::exception::exception.LIBCMT ref: 028AA945
__CxxThrowException@8.LIBCMT ref: 028AA956

Strings

W), xrefs: 028AA9A8

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: W)
API String ID: 615853336-1400489827
Opcode ID: 707049b51a08aa07790fd662e8071ec29e1f383b838777b6e27870259d044f18
Instruction ID: 2d69f6865e7603c34c44a981e83e785d7a36c4d2708d6f6767638f89045c430f
Opcode Fuzzy Hash: 707049b51a08aa07790fd662e8071ec29e1f383b838777b6e27870259d044f18
Instruction Fuzzy Hash: 32F0F93D900209A6FB19E758EC75AAE37B5AF04718F14001DE515D69C1DFB0CA15CF81

Function 02AFB2E0 Relevance: 7.6, APIs: 5, Instructions: 147COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,CD663CB9,00000000,00000000,74DF0F00,00000004,02AFC01F,02B12DFC,000000FF,?,02AFBB12,02AFC01F,CD663CB9), ref: 02AFB31F
InitializeCriticalSectionAndSpinCount.KERNEL32(00000158,00000000,00000400,00000400,00001000,?,02AFBB12,02AFC01F,CD663CB9,00000000,02AFA3DC,74DF0F00,00000000,00000000,02B12EEF,000000FF), ref: 02AFB3F1
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,02AFBB12,02AFC01F,CD663CB9,00000000,02AFA3DC,74DF0F00,00000000,00000000,02B12EEF,000000FF), ref: 02AFB42F
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,02AFBB12,02AFC01F,CD663CB9,00000000,02AFA3DC,74DF0F00,00000000,00000000,02B12EEF,000000FF), ref: 02AFB454
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,02AFBB12,02AFC01F,CD663CB9,00000000,02AFA3DC,74DF0F00,00000000,00000000,02B12EEF,000000FF), ref: 02AFB479

Part of subcall function 02AF62D0: __CxxThrowException@8.LIBCMT ref: 02AF62E2
Part of subcall function 02AF62D0: GdipCloneImage.GDIPLUS(?,00000002,00000074,?,?,02AFC01F,02B1976C,?,02AFB100,80004005,?,02AFB3DF,00000400,00000400,00001000), ref: 02AF6306
Part of subcall function 02AF62D0: GdipAlloc.GDIPLUS(00000010,?,?,02AFC01F,02B1976C,?,02AFB100,80004005,?,02AFB3DF,00000400,00000400,00001000,?,02AFBB12,02AFC01F), ref: 02AF6315

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateEvent$Gdip$AllocCloneCountCriticalException@8ImageInitializeSectionSpinThrow
String ID:
API String ID: 2321832077-0
Opcode ID: c1288ff3b6e706c37ffcc49a549ddf764317fb3182dd4857953f3202d8874a05
Instruction ID: 77a8db6818bd21202cf5849cbe8f6f8d360e7622cd607847daaae640e5226631
Opcode Fuzzy Hash: c1288ff3b6e706c37ffcc49a549ddf764317fb3182dd4857953f3202d8874a05
Instruction Fuzzy Hash: 4F510BB1940B44AFD320CF6AC984A9BFBF8FF99704F50491EE29A97650DB74A540CF60

Function 02AF13B0 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02AF13D2
CancelIo.KERNEL32(?), ref: 02AF13DC
InterlockedExchange.KERNEL32(?,00000000), ref: 02AF13E8
closesocket.WS2_32(?), ref: 02AF13F2
SetEvent.KERNEL32(?), ref: 02AF13FC

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 4562f6e5d61d35d9e03eb95b9d49bb646457498753439c4b1badb5730560c0a4
Instruction ID: e481772f8143ac8082bf60e8c0633e4eba648133b6db8fd81a3eb48e9e1855a6
Opcode Fuzzy Hash: 4562f6e5d61d35d9e03eb95b9d49bb646457498753439c4b1badb5730560c0a4
Instruction Fuzzy Hash: 35F09075540300AFC324DBD4E908E67BBB8EB48B50F404A1CF68297680CBF4A914CB90

Function 028A13B0 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 028A13D2
CancelIo.KERNEL32(?), ref: 028A13DC
InterlockedExchange.KERNEL32(?,00000000), ref: 028A13E8
closesocket.WS2_32(?), ref: 028A13F2
SetEvent.KERNEL32(?), ref: 028A13FC

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 21aa1c3e699cebe5ebc51b41783ca89a3ccc487803fa330f59bc15cc242e8ad9
Instruction ID: 3d9c5a3f36928c2a2b5ea5fb01e7be15aaea1c65d401b01f0324716cb2ff188f
Opcode Fuzzy Hash: 21aa1c3e699cebe5ebc51b41783ca89a3ccc487803fa330f59bc15cc242e8ad9
Instruction Fuzzy Hash: D7F03675941704AFD320DB94D949E6B77B8FB48714F404A0CBA56876C0CBF5A814CBA0

Function 02AF19A0 Relevance: 6.1, APIs: 4, Instructions: 102timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(02AFA418,00000000), ref: 02AF1A27
timeGetTime.WINMM ref: 02AF1A2D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 02AF1A41
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02AF1A4A

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateEvent$ExchangeInterlockedTimetime
String ID:
API String ID: 2985171241-0
Opcode ID: 86c0a54da043771852651f2d01a122f5d3d8cdd9277319a342dac395a0611da3
Instruction ID: e914a387af6412d617f8255d9690aeac740eccd3b0c3e2d8a912846a453c0766
Opcode Fuzzy Hash: 86c0a54da043771852651f2d01a122f5d3d8cdd9277319a342dac395a0611da3
Instruction Fuzzy Hash: 2141F7B5A40B409FD320CF5AC980A17FBF8FF99714B104A5EE58AC7B60D7B0A941CB90

Function 028A1BE0 Relevance: 6.1, APIs: 4, Instructions: 101synchronizationtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 028A1BFA
InterlockedExchange.KERNEL32(?,00000000), ref: 028A1C09
WaitForSingleObject.KERNEL32(?,00001770), ref: 028A1C6B

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ExchangeInterlockedObjectSingleTimeWaittime
String ID:
API String ID: 3701969524-0
Opcode ID: 3e5bf3b165d515ffe273f610006a27ce2b530ba8a54fdae7a4500b43ea535883
Instruction ID: c792c72076216ba5fff54ccf9698cfbdddbc2ffe59fbf8df27d669efea66368c
Opcode Fuzzy Hash: 3e5bf3b165d515ffe273f610006a27ce2b530ba8a54fdae7a4500b43ea535883
Instruction Fuzzy Hash: 9B31417A640704AFE320DBA9DC84F5AB7E8FF88324F10491DE64AC7690D6B5F445CB50

Function 028A1190 Relevance: 6.1, APIs: 4, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 028A11C9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 028A1206
_memmove.LIBCMT ref: 028A1222
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 028A1235

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4_memmove
String ID:
API String ID: 1828152804-0
Opcode ID: 4d359c4436cd71e1cbcb1ed49ad2a0e10f67a302724ff455fe79af5fba9f16f0
Instruction ID: f2ea436ace7868f6db1ed33ffdbf4e9749faaa36c9ccc4a71dcbfbc0bd32f0c3
Opcode Fuzzy Hash: 4d359c4436cd71e1cbcb1ed49ad2a0e10f67a302724ff455fe79af5fba9f16f0
Instruction Fuzzy Hash: 9121B038E402089FEB109FAED855B6EBBF4EF40705F0089ADE85DD2640EA70A8108B04

Function 028A10E0 Relevance: 6.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 028A110F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 028A113F
_memmove.LIBCMT ref: 028A115B
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 028A1172

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4_memmove
String ID:
API String ID: 1828152804-0
Opcode ID: 4b90c5e07fed0e268b509dd66fe85b2f9f47e2f63230685eda999d38083f2d84
Instruction ID: a29fc36af304f38bf3aed2d90712412b4c94f38c4f580aa9d774afed864d686b
Opcode Fuzzy Hash: 4b90c5e07fed0e268b509dd66fe85b2f9f47e2f63230685eda999d38083f2d84
Instruction Fuzzy Hash: 8A11D678E40308AFEB109FA9D885B6EBBF8FF04705F00896DED5DD2240EA70A810CB14

Function 028A8540 Relevance: 6.1, APIs: 4, Instructions: 64threadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 028A8544
WSACloseEvent.WS2_32(?), ref: 028A85A7
shutdown.WS2_32(028A4BD7,00000001), ref: 028A85BB
closesocket.WS2_32(028A4BD7), ref: 028A85C5

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CloseCurrentEventThreadclosesocketshutdown
String ID:
API String ID: 802825583-0
Opcode ID: f689e6189354a1f961060564313059116c8877ffdec79c12437b2f7234838a12
Instruction ID: b6a88de5a288af058c6be8d870a4020f72e64de27e97352cdaec07b7e8a00a9f
Opcode Fuzzy Hash: f689e6189354a1f961060564313059116c8877ffdec79c12437b2f7234838a12
Instruction Fuzzy Hash: E0117C7DA00A008BD630DF2DD85491AF3FAAF88710B108B1DE95AC3780DB30E9428BA1

Function 028A8C00 Relevance: 4.6, APIs: 3, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 028A76E0: StrChrW.SHLWAPI(?,0000005E), ref: 028A76EE

WSASetLastError.WS2_32(0000273F), ref: 028A8CCE
socket.WS2_32(?,00000002,00000011), ref: 028A8D07
WSACreateEvent.WS2_32 ref: 028A8D50

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CreateErrorEventLastsocket
String ID:
API String ID: 2854923884-0
Opcode ID: fc3e128b248cd27b198aacfe699284538fa5500ee5311a37ad792e6150001867
Instruction ID: aa112b421dfbb3dfb9169f430dd3f7ea2a268bc790d3c2d9c9b186b1d4b57804
Opcode Fuzzy Hash: fc3e128b248cd27b198aacfe699284538fa5500ee5311a37ad792e6150001867
Instruction Fuzzy Hash: 4C4194BEA003059BFB14DF68D855BABB7B8EB04715F00452AED15D3280EF75A854CBB1

Function 001D71E1 Relevance: 4.6, APIs: 3, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D71E8
CreateCompatibleDC.GDI32(00000000), ref: 001D72B3
CreateCompatibleDC.GDI32(00000000), ref: 001D72BF

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreate$H_prolog3
String ID:
API String ID: 2193723985-0
Opcode ID: f78b2963f543087b640c677a8472d49977b9b391280574c461742e659b6b8665
Instruction ID: 1c8045b7ff5413910d85d2a9dd47bf8caeda44428491e2eae2af880811b9e403
Opcode Fuzzy Hash: f78b2963f543087b640c677a8472d49977b9b391280574c461742e659b6b8665
Instruction Fuzzy Hash: CC51B0B0921365CFCB44DF69D4812997BB8BF09B10F1081ABEC09DF29AD7B08640CF91

Function 028A5550 Relevance: 4.6, APIs: 3, Instructions: 96COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000000,00000004), ref: 028A55BE
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 028A55D0

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: ce09f4dedfdec83746f4688c265e94442eada3b770f0220af621a10d8124e98e
Instruction ID: a80f010a115f7a034d00dc01c431da7fb183954716a9ce7f0b63c24bd7172a69
Opcode Fuzzy Hash: ce09f4dedfdec83746f4688c265e94442eada3b770f0220af621a10d8124e98e
Instruction Fuzzy Hash: C921D676B4420A7AEA10D6849C81FBDB328EF45B74F600775FB18EB2D0DAB099049790

Function 001743C6 Relevance: 4.6, APIs: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,002CE008,00000000,00000001,?), ref: 0017440B
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,00000004), ref: 0017442B
RegCloseKey.ADVAPI32(?), ref: 0017446F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: ba2fdfe1f5bdc40a46b3bd8b7a6b5cd5d2883328597920bf8d79961d03c4c685
Instruction ID: 171746431f845a21cc41764c17a3a3b3bf98642e3b241efae41938dfadc28468
Opcode Fuzzy Hash: ba2fdfe1f5bdc40a46b3bd8b7a6b5cd5d2883328597920bf8d79961d03c4c685
Instruction Fuzzy Hash: FC2129B1D00208EFDF15CF85D988AAEFBB8FF90315F2180AAE45AA6210D7715A44DB61

Function 00268212 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

__stbuf.LIBCMT ref: 00268260
__output_l.LIBCMT ref: 00268278
__ftbuf.LIBCMT ref: 00268289

Part of subcall function 00268FB0: __getptd_noexit.LIBCMT ref: 00268FB0

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: __ftbuf__getptd_noexit__output_l__stbuf
String ID:
API String ID: 1135767703-0
Opcode ID: a19e903f0e5ffc6853a4477e460c9af94314948428dac1d15d846fcb53c444ea
Instruction ID: 719c985018fbf3b9e3aa1458ba757396166cca9e34f5594bf61a392bcfe5ac74
Opcode Fuzzy Hash: a19e903f0e5ffc6853a4477e460c9af94314948428dac1d15d846fcb53c444ea
Instruction Fuzzy Hash: 9E01A772930208AAEF51BFB0ED83AAE3664DF01360F204235B414DA1D3DD758DF54EA1

Function 028A58D0 Relevance: 4.5, APIs: 3, Instructions: 39networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00002741), ref: 028A58E9
WSAStringToAddressW.WS2_32(?,?,00000000,?,?), ref: 028A590F
htons.WS2_32(?), ref: 028A5922

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: AddressErrorLastStringhtons
String ID:
API String ID: 1418563660-0
Opcode ID: 2318f44789005ba58380cd0b2fd46cdd802e60c33ebd5b33cf20829d156edf13
Instruction ID: 79f7e4b2173102f21cc0c9b8e7c7024232f57b021e2f2081e272a55730bf3023
Opcode Fuzzy Hash: 2318f44789005ba58380cd0b2fd46cdd802e60c33ebd5b33cf20829d156edf13
Instruction Fuzzy Hash: 5FF06239A402486BEB249F54D819BAB37A8FF04355F84481AF95DC7180DB74D590C790

Function 02AFA620 Relevance: 4.5, APIs: 3, Instructions: 32threadsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,02AF9DF0,00000000,00000000,00000000), ref: 02AFA642
CreateThread.KERNEL32(00000000,00000000,02AFA2E0,00000000,00000000,00000000), ref: 02AFA658
WaitForSingleObject.KERNEL32(?,000000FF,?,?,02B02AE0,?,?,?,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02AFA662

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateThread$ObjectSingleWait
String ID:
API String ID: 1771687473-0
Opcode ID: c1a2e56ca5e6dd43cd8abe9eaadd36f47cb2ae60a47c338ed7480a75342839e3
Instruction ID: 0d13d0bbeb53a36b92a055bc72bab8fb206a0bdc6b8fa0f33faf70870d38607c
Opcode Fuzzy Hash: c1a2e56ca5e6dd43cd8abe9eaadd36f47cb2ae60a47c338ed7480a75342839e3
Instruction Fuzzy Hash: B6F09BB2ED03147BFB6057A8AC46FA6379CD308750F104902BE14EB2C0CAB87C508F94

Function 028A8DA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 028A8DC8

Part of subcall function 028A7C20: WSAGetLastError.WS2_32 ref: 028A7C28
Part of subcall function 028A7C20: WSAResetEvent.WS2_32(?), ref: 028A7C65

Strings

, xrefs: 028A8E6B

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: EnumErrorEventEventsLastNetworkReset
String ID:
API String ID: 1050048411-3916222277
Opcode ID: f7658bb13e7e535cbcde8538a8d6f3ea73ad07b717dac3ce74e23ac7302e4bdc
Instruction ID: b41df58aa9f8b9589e1f75cb651b22dde703a248916a76826c7ebd96b400af81
Opcode Fuzzy Hash: f7658bb13e7e535cbcde8538a8d6f3ea73ad07b717dac3ce74e23ac7302e4bdc
Instruction Fuzzy Hash: 7C315F7DA007088BE724DF69D860B6EF7F6AF84614F14462DD84AC3640EF30E914CBA1

Function 00171820 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,745E08A5), ref: 0017185F

Strings

C:\Users\Administrator\Desktop, xrefs: 001718E0

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: C:\Users\Administrator\Desktop
API String ID: 514040917-3755706383
Opcode ID: 070d447111b28fff23b236c3d53699b71cac66e8cea9d727c3cbd28847c37568
Instruction ID: c05a59aaa1ee5860e023db53ca3396299d3eb0bd13e56db4e7bb5c0b3a9d50ff
Opcode Fuzzy Hash: 070d447111b28fff23b236c3d53699b71cac66e8cea9d727c3cbd28847c37568
Instruction Fuzzy Hash: 72414D70905158EFDB54DBA8DC99BEDB7B4EF24700F508299E01A6B291EB742F48CF90

Function 028A4550 Relevance: 3.1, APIs: 2, Instructions: 147COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,028C012C,00000000,00000000,00000000,00000004,028A527F,028BA64C,000000FF,?,028A4D72,028A527F,028C012C), ref: 028A458F
InitializeCriticalSectionAndSpinCount.KERNEL32(00000158,00000000,00000400,00000400,028C1EA8,?,028A4D72,028A527F,028C012C,00000000,028A3302,00000000,00000000,00000000,028BA73F,000000FF), ref: 028A4661

Part of subcall function 028A3FB0: __CxxThrowException@8.LIBCMT ref: 028A3FC2

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CountCreateCriticalEventException@8InitializeSectionSpinThrow
String ID:
API String ID: 2367981338-0
Opcode ID: a820dcd949b51392075a49462c3ed36fbcf1abe99b09142595aeb0acd2594f3e
Instruction ID: b455e3c44ab16884f9851fed3f69cd22c70ab6104016f4681dc1c173427001ab
Opcode Fuzzy Hash: a820dcd949b51392075a49462c3ed36fbcf1abe99b09142595aeb0acd2594f3e
Instruction Fuzzy Hash: 545129B5900B40AFD720CF2A8884A9BFBF8FF99700F10891E919AD7650DBB0A504CB50

Function 028A1840 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 028A186E
_memmove.LIBCMT ref: 028A1932

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 88b8b18900c2fea2e440f5d790c4ff52a3da6065c29ca646272ceb9d63bd851c
Instruction ID: 8373e353946bf58f5b7b3427b55b847f1bf39af37b8f22069a9455d328e6482f
Opcode Fuzzy Hash: 88b8b18900c2fea2e440f5d790c4ff52a3da6065c29ca646272ceb9d63bd851c
Instruction Fuzzy Hash: A3317F7E7006069FE714DEAAC8A8966F3AABF44254B088628D41DD7604EF30FC50CB90

Function 028A19B0 Relevance: 3.1, APIs: 2, Instructions: 102timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(028A333E,00000000), ref: 028A1A37
timeGetTime.WINMM ref: 028A1A3D

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ExchangeInterlockedTimetime
String ID:
API String ID: 1255932121-0
Opcode ID: 09f9ae25ce361201aacaff254dd7e07e9cf82d37c191f56075bf71a6768406c2
Instruction ID: 2cd1a7ed33922ce770054c6d668d0f338e2b6d07f13f7aaccd74b4bc9bb10efc
Opcode Fuzzy Hash: 09f9ae25ce361201aacaff254dd7e07e9cf82d37c191f56075bf71a6768406c2
Instruction Fuzzy Hash: AA41F7B9A40740AFD320CF5AC980A56FBF8FF89714B10495EE58AC7B60D7B0B845CB50

Function 028A15C0 Relevance: 3.1, APIs: 2, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 028AA8DC: _malloc.LIBCMT ref: 028AA8F6

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 028A1633
recv.WS2_32(?,?,00040000,00000000), ref: 028A1654

Part of subcall function 028A1840: _memmove.LIBCMT ref: 028A186E
Part of subcall function 028A1840: _memmove.LIBCMT ref: 028A1932

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: _memmove$_mallocrecvselect
String ID:
API String ID: 1734404984-0
Opcode ID: fc761c89f385addf293f0691a91f00aa8b95a6eb4d738ca66cd6c18d92e71f7a
Instruction ID: 40a51b338244ae76024fac9aac5e9d9f71bf23afaf20e6f7a3c915f6678112de
Opcode Fuzzy Hash: fc761c89f385addf293f0691a91f00aa8b95a6eb4d738ca66cd6c18d92e71f7a
Instruction Fuzzy Hash: 8221D7BCA002089BEB24DF28CC98BDA77B5EF04314F144195E91DEB2C1DBB0A984CF91

Function 028A7B90 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 028A7BAE
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,-00000001,00000000,00000000), ref: 028A7BE5

Part of subcall function 028A3FB0: __CxxThrowException@8.LIBCMT ref: 028A3FC2

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ByteCharMultiWide$Exception@8Throw
String ID:
API String ID: 2985342829-0
Opcode ID: e4ab6ad87ac1426af0c56d20c91c170b5822192433daf64a6fcf4885a9ad47c6
Instruction ID: 939a8dda47f36d098e29e45ce49200012b261ef3be933dd892586bd3070fb0fd
Opcode Fuzzy Hash: e4ab6ad87ac1426af0c56d20c91c170b5822192433daf64a6fcf4885a9ad47c6
Instruction Fuzzy Hash: E511083E3412156FF6219A4CDC98F2EF79AEB84760F200119F715EB2C0CFA068128BE4

Function 00174210 Relevance: 3.1, APIs: 2, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

_wmemcpy_s.LIBCPMTD ref: 0017428B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: _wmemcpy_s
String ID:
API String ID: 67063488-0
Opcode ID: 3149fa814990a70032cac697e70eefd725a9569572b24ec6260fcca1de6a0001
Instruction ID: fabb33553547926799bd5af1c9305718597db737b88841df8323cdd820fda0cc
Opcode Fuzzy Hash: 3149fa814990a70032cac697e70eefd725a9569572b24ec6260fcca1de6a0001
Instruction Fuzzy Hash: 0821FE75900119EFCB04EFD8E891DAE77B5BF54300F10C558F52DA7292DB306A50DB95

Function 028A1750 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 028A1781
send.WS2_32(?,?,?,00000000), ref: 028A17BE

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 90083705e32f619ee1e834a252314836c689a52d148bfd2c3193b01fd0106c5e
Instruction ID: d2980feee3398bd7998e24d47088347496c80b95bca479f2d9228ab87309f9dc
Opcode Fuzzy Hash: 90083705e32f619ee1e834a252314836c689a52d148bfd2c3193b01fd0106c5e
Instruction Fuzzy Hash: D911A17EB022046BE720CA7EDC9CB6EB799FB41268F106125FA0DD7284DF709D419A51

Function 028A7100 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 028A7125
_free.LIBCMT ref: 028A716A

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: _free_malloc
String ID:
API String ID: 845055658-0
Opcode ID: d4ad71267091536156d0a39dafb9f693faee925de1e7b2ba016b9c73b0c415ed
Instruction ID: 7a9277bee234629ba3bdf39aa621c9d75551141826356d0aba81d112b416a389
Opcode Fuzzy Hash: d4ad71267091536156d0a39dafb9f693faee925de1e7b2ba016b9c73b0c415ed
Instruction Fuzzy Hash: B30192BFA056165BEB04DBACA8905DBF799EF40238B00023AEA1DC3645EB71E51087D2

Function 028A42B0 Relevance: 3.0, APIs: 2, Instructions: 49COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 028A42C3
RtlEnterCriticalSection.NTDLL(?), ref: 028A42CD

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: a90d8d14779d693d5dfbb31d96c12afd1a58582e1bf9b0982923ce6bdbc4d60a
Instruction ID: c61d59220b5e43de88bf50f77f5b980f9504148468046b2ffa9d4af086c007f3
Opcode Fuzzy Hash: a90d8d14779d693d5dfbb31d96c12afd1a58582e1bf9b0982923ce6bdbc4d60a
Instruction Fuzzy Hash: CB01677E6006109FE721DB69FCC4B9BB7E8EF88729F01081DE54AD3540DB74E8468A60

Function 02AFB0D0 Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,00000000,00000004,?,02AFB3DF,00000400,00000400,00001000,?,02AFBB12,02AFC01F,CD663CB9,00000000,02AFA3DC), ref: 02AFB0EA
_free.LIBCMT ref: 02AFB129

Part of subcall function 02AF62D0: __CxxThrowException@8.LIBCMT ref: 02AF62E2
Part of subcall function 02AF62D0: GdipCloneImage.GDIPLUS(?,00000002,00000074,?,?,02AFC01F,02B1976C,?,02AFB100,80004005,?,02AFB3DF,00000400,00000400,00001000), ref: 02AF6306
Part of subcall function 02AF62D0: GdipAlloc.GDIPLUS(00000010,?,?,02AFC01F,02B1976C,?,02AFB100,80004005,?,02AFB3DF,00000400,00000400,00001000,?,02AFBB12,02AFC01F), ref: 02AF6315

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Gdip$AllocCloneCreateException@8HeapImageThrow_free
String ID:
API String ID: 279427069-0
Opcode ID: be14a22e07f5c2dbf468104b607ed07fe94f656b26a5b917920b224e9b59ab82
Instruction ID: e3c676c6bcd26890e815e6383a1083e6fa3ff851b71483585f9bde49a92ec100
Opcode Fuzzy Hash: be14a22e07f5c2dbf468104b607ed07fe94f656b26a5b917920b224e9b59ab82
Instruction Fuzzy Hash: 8B0183B1A00B449BC720DF6AD844A57FBF8FF95750B108A1EE59A87710D7B0A504CF95

Function 028A4340 Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,00000000,00000004,?,028A464F,00000400,00000400,028C1EA8,?,028A4D72,028A527F,028C012C,00000000,028A3302), ref: 028A435A
_free.LIBCMT ref: 028A4399

Part of subcall function 028A3FB0: __CxxThrowException@8.LIBCMT ref: 028A3FC2

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CreateException@8HeapThrow_free
String ID:
API String ID: 1065114656-0
Opcode ID: 0e3904c184a46522c14ba3b84e3151e6cb60ce9e040db43ffb8cd93c58acf7dd
Instruction ID: bf6b44daff17d510306b193f514545e9418af5514ee038d0931225999410a2cc
Opcode Fuzzy Hash: 0e3904c184a46522c14ba3b84e3151e6cb60ce9e040db43ffb8cd93c58acf7dd
Instruction Fuzzy Hash: 6F017EB8A00B049BD720DF2A9844A57FBF8FF95710B108A1EE99A87B10D7B0A505CB95

Function 001A277F Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000), ref: 001A278D
SetErrorMode.KERNEL32(00000000), ref: 001A2795

Part of subcall function 0017B140: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0017B173
Part of subcall function 0017B140: SetLastError.KERNEL32(0000006F), ref: 0017B18A

Part of subcall function 001A25A3: GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 001A25E0
Part of subcall function 001A25A3: PathFindExtensionW.SHLWAPI(?), ref: 001A25FA
Part of subcall function 001A25A3: __wcsdup.LIBCMT ref: 001A2644
Part of subcall function 001A25A3: __wcsdup.LIBCMT ref: 001A2682
Part of subcall function 001A25A3: __wcsdup.LIBCMT ref: 001A26B6

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Error__wcsdup$FileModeModuleName$ExtensionFindLastPath
String ID:
API String ID: 972848482-0
Opcode ID: 5d70e4742880576c549949e2c8caa8e83148c38b2bb110ab0d6497282664d8d4
Instruction ID: c8ea953c2d444e483f8bfd7c622cf354fad21ce00c6867dcabdbe8755d3f1133
Opcode Fuzzy Hash: 5d70e4742880576c549949e2c8caa8e83148c38b2bb110ab0d6497282664d8d4
Instruction Fuzzy Hash: 57F090B5A142145FDB60EFA8D489B5D3BA8AFA5320F05805AF65C9B352DB34DD00CFA2

Function 028A5630 Relevance: 3.0, APIs: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 028A564E
WSAGetLastError.WS2_32 ref: 028A5659

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ErrorIoctlLast
String ID:
API String ID: 4052769934-0
Opcode ID: a11bd343a07edd277e8afba99f231a2a5bf1a2517196d138653e59267d580532
Instruction ID: 0079171657a7a6e435c9db404fff19d8a30a66a9aff8fe1477d4a7fe8b70972e
Opcode Fuzzy Hash: a11bd343a07edd277e8afba99f231a2a5bf1a2517196d138653e59267d580532
Instruction Fuzzy Hash: 57E0927A9060287BE620DAA9AC48DEB7F5CDB06674F504759FE1DC2080D6709A10C7E0

Function 028A8130 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 028A814B

Part of subcall function 028A7580: SetLastError.KERNEL32(000005B4,028A4BD7,028C012C), ref: 028A75BC

Part of subcall function 028A3FB0: __CxxThrowException@8.LIBCMT ref: 028A3FC2

CloseHandle.KERNEL32(00000000), ref: 028A8178

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CloseErrorEventException@8HandleLastThrow
String ID:
API String ID: 2527162062-0
Opcode ID: 92567334b49d7cc101499d433edaf54d8f85d706c204681d4dc9a36cd794f0ca
Instruction ID: 3eeab66350c28419434f1c3deb7f80b91bfe11edacd0e839f77dabe4e63cd98c
Opcode Fuzzy Hash: 92567334b49d7cc101499d433edaf54d8f85d706c204681d4dc9a36cd794f0ca
Instruction Fuzzy Hash: 6CF05EBA600720ABE3349B64C854B67B7F8BB04718F144A1DFB6996680DB72E400CBA4

Function 02B04189 Relevance: 3.0, APIs: 2, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,02B041C2,00000000,00000000,00000000,00000000,00000000,02B0DA42,?,02B0524C,00000003,02B01DFC,00000001,00000000,00000000), ref: 02B04194
__invoke_watson.LIBCMT ref: 02B041B0

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: DecodePointer__invoke_watson
String ID:
API String ID: 4034010525-0
Opcode ID: f3982e988fe094863b372ccab6f921d90252059ec10a6640c10b42a70e6307e1
Instruction ID: 361bb56116e0bc2e22f45e2edef482ff8fe1f1196045d61a99758b28e7c53e55
Opcode Fuzzy Hash: f3982e988fe094863b372ccab6f921d90252059ec10a6640c10b42a70e6307e1
Instruction Fuzzy Hash: 39E0EC7255020DBBDF022E61DC448AA3F7AEF54790B4448A0FE1491460D736CCB1DB90

Function 001748E0 Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

ActivateActCtx.KERNEL32(?,?,002BDF70,00000010,00174AC8,KERNEL32.DLL), ref: 00174900
LoadLibraryW.KERNEL32(?), ref: 00174917

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ActivateLibraryLoad
String ID:
API String ID: 389599620-0
Opcode ID: e69a5e2c11c0e0f613c37adfa50c7a03cbdb352d90c95cd10b6e1ac583aa8393
Instruction ID: 4b9176892fa0c45c8935050003d4da8f44ad8ad907c7ee88a4e6eb891ecc2159
Opcode Fuzzy Hash: e69a5e2c11c0e0f613c37adfa50c7a03cbdb352d90c95cd10b6e1ac583aa8393
Instruction Fuzzy Hash: 64F01CB4C14219AFCF10AFA0DC499DEBA74FF18751F108566F555E2191CB3446529FA0

Function 028A17F0 Relevance: 3.0, APIs: 2, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 028A1807
InterlockedExchange.KERNEL32(?,00000000), ref: 028A1813

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: ExchangeInterlockedSleep
String ID:
API String ID: 3334789516-0
Opcode ID: 91870bf7dfe40166af9f13569ad32ad5eb958ffd37190b1af3d24d56b65cb32f
Instruction ID: fd7d1e39682c9cedd331d2114b105d5b31a65974f1410eeef55f5489a6c55b1a
Opcode Fuzzy Hash: 91870bf7dfe40166af9f13569ad32ad5eb958ffd37190b1af3d24d56b65cb32f
Instruction Fuzzy Hash: EBE0863A548310ABC220A7A9EC44D677768FBC8730B110B0CB675836C08970E4058B60

Function 028A9610 Relevance: 3.0, APIs: 2, Instructions: 16timeCOMMON

Download Yara Rule

APIs

CancelWaitableTimer.KERNEL32(?), ref: 028A961A
_free.LIBCMT ref: 028A962B

Part of subcall function 028AB1C8: RtlFreeHeap.NTDLL(00000000,00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1DE
Part of subcall function 028AB1C8: GetLastError.KERNEL32(00000000,?,028ACCD6,00000000,?,?,?,?,?,?,028AF702,?,?,028C012C,00000000), ref: 028AB1F0

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: CancelErrorFreeHeapLastTimerWaitable_free
String ID:
API String ID: 4005552338-0
Opcode ID: c69375caec5cba1ed666e18e7a8e3e3bc567f2110db42d237b8e5beba4f1c740
Instruction ID: cbff23f4f95a8927f330878fd5de4071f2040a0206ce21046819449dda1cf768
Opcode Fuzzy Hash: c69375caec5cba1ed666e18e7a8e3e3bc567f2110db42d237b8e5beba4f1c740
Instruction Fuzzy Hash: 93E0ECB55457004BF7609B28D498BC377D8BF14304F04081DE55AC7280DB76E8148B94

Function 00176385 Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00176398
SetWindowsHookExW.USER32(000000FF,Function_000061EA,00000000,00000000), ref: 001763A8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: b0ee8b1be311bda91301ad77cddb6e38e9fecbceae20e228610424fa28d7bdc9
Instruction ID: 8bc8b0b0490e8d609183db725a89aea03dd1f26f3c99e4736cee35bd2c8460bc
Opcode Fuzzy Hash: b0ee8b1be311bda91301ad77cddb6e38e9fecbceae20e228610424fa28d7bdc9
Instruction Fuzzy Hash: B9D0A7714497506FDB2037707C0DF593A646B14331F108341F629914D1C77099C187A2

Function 028AA97B Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 028AA987

Part of subcall function 028ACCE5: __getptd_noexit.LIBCMT ref: 028ACCE8
Part of subcall function 028ACCE5: __amsg_exit.LIBCMT ref: 028ACCF5

__endthreadex.LIBCMT ref: 028AA997

Part of subcall function 028AA97B: __getptd_noexit.LIBCMT ref: 028AA961

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: __getptd_noexit$__amsg_exit__endthreadex__getptd
String ID:
API String ID: 1746327785-0
Opcode ID: aa54be4f83e31ad2cf48e9daf0eff865b2c8f23a314e80ebd9a693763652139c
Instruction ID: 15057c0da9f893916ee1fe5d9b4b0df257204734daed39eade52bba7eb2d5476
Opcode Fuzzy Hash: aa54be4f83e31ad2cf48e9daf0eff865b2c8f23a314e80ebd9a693763652139c
Instruction Fuzzy Hash: 0EC08C7C541200AEFB093BE88D19F4C7B236F00302F020040A001D60B1CEB89844EE12

Function 02AF40F4 Relevance: 3.0, APIs: 2, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,02AF40D2), ref: 02AF4101
RegCloseKey.ADVAPI32(?), ref: 02AF410A

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 82127673270bee672779c2ca74d3e3f3ed0b4dbccdca8689e03548a3383ec1c8
Instruction ID: 6b44dbfa428f3965974bf221619f3e72cdd31382260b012dd5c66846ad3a8abe
Opcode Fuzzy Hash: 82127673270bee672779c2ca74d3e3f3ed0b4dbccdca8689e03548a3383ec1c8
Instruction Fuzzy Hash: 95C09272D101389BCBA4FB68EC48A8977B8AB48200F0205C6B108A3150CB38BFC1CF90

Function 02AFBAD0 Relevance: 1.6, APIs: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

Part of subcall function 02AFB2E0: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,CD663CB9,00000000,00000000,74DF0F00,00000004,02AFC01F,02B12DFC,000000FF,?,02AFBB12,02AFC01F,CD663CB9), ref: 02AFB31F
Part of subcall function 02AFB2E0: InitializeCriticalSectionAndSpinCount.KERNEL32(00000158,00000000,00000400,00000400,00001000,?,02AFBB12,02AFC01F,CD663CB9,00000000,02AFA3DC,74DF0F00,00000000,00000000,02B12EEF,000000FF), ref: 02AFB3F1

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02AFBBA0

Part of subcall function 02AF62D0: __CxxThrowException@8.LIBCMT ref: 02AF62E2
Part of subcall function 02AF62D0: GdipCloneImage.GDIPLUS(?,00000002,00000074,?,?,02AFC01F,02B1976C,?,02AFB100,80004005,?,02AFB3DF,00000400,00000400,00001000), ref: 02AF6306
Part of subcall function 02AF62D0: GdipAlloc.GDIPLUS(00000010,?,?,02AFC01F,02B1976C,?,02AFB100,80004005,?,02AFB3DF,00000400,00000400,00001000,?,02AFBB12,02AFC01F), ref: 02AF6315

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateGdip$AllocCloneCountCriticalEventException@8ImageInitializeSectionSpinThrowTimerWaitable
String ID:
API String ID: 1469226031-0
Opcode ID: 0368678fd8d26bceb2498b5c4326377888e653ffb008d66ca11f38bc25ee3554
Instruction ID: a7b44e88b9ad9ba3578f18f6caf68315c5b2c00d1ced1146b20083b93719963f
Opcode Fuzzy Hash: 0368678fd8d26bceb2498b5c4326377888e653ffb008d66ca11f38bc25ee3554
Instruction Fuzzy Hash: 6F3140B1945B449BE320CF6AC944BDBFBF8EF9A700F40495EE4AA97240CBB46404CF90

Function 028A4D30 Relevance: 1.6, APIs: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

Part of subcall function 028A4550: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,028C012C,00000000,00000000,00000000,00000004,028A527F,028BA64C,000000FF,?,028A4D72,028A527F,028C012C), ref: 028A458F
Part of subcall function 028A4550: InitializeCriticalSectionAndSpinCount.KERNEL32(00000158,00000000,00000400,00000400,028C1EA8,?,028A4D72,028A527F,028C012C,00000000,028A3302,00000000,00000000,00000000,028BA73F,000000FF), ref: 028A4661

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 028A4E00

Part of subcall function 028A3FB0: __CxxThrowException@8.LIBCMT ref: 028A3FC2

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Create$CountCriticalEventException@8InitializeSectionSpinThrowTimerWaitable
String ID:
API String ID: 723600342-0
Opcode ID: 0b4293aefc0c4185f98799dfa587d9e4b7286919c4be2b38e4eae426edfa287c
Instruction ID: a1577145d9a5f0dfec67ffeee942f5b355a760f9678dbcc2490cd1a40b6ec5c5
Opcode Fuzzy Hash: 0b4293aefc0c4185f98799dfa587d9e4b7286919c4be2b38e4eae426edfa287c
Instruction Fuzzy Hash: E03143B8905B409FE721CF29C444BDBFBE8EF89700F10890ED4AA97240CBB46404CB91

Function 00173A00 Relevance: 1.6, APIs: 1, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

_wmemcpy_s.LIBCPMTD ref: 00173A8A

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: _wmemcpy_s
String ID:
API String ID: 67063488-0
Opcode ID: 3f724cf5154d8ca0fe87611ebe55cf9766e02ad78a46917bdf66656ea6427406
Instruction ID: 6db84e984125334e0be1b4f0fb0550c86e7f073197abcf56b99413c7551de8cd
Opcode Fuzzy Hash: 3f724cf5154d8ca0fe87611ebe55cf9766e02ad78a46917bdf66656ea6427406
Instruction Fuzzy Hash: AE217974E00109DFCB04EF98C8929AEB7B5FF98300F108599E569A7355DB30AE41DF95

Function 028A1040 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 028A106E

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b27a90baf602e52cd30daa3db4f014a74a11944b0ff310d0bdf42e13ae600d1b
Instruction ID: 1de2ca2e6bf947de69c093fb3e64b462b4c25f63bd1f7c132d26b02de6719e3b
Opcode Fuzzy Hash: b27a90baf602e52cd30daa3db4f014a74a11944b0ff310d0bdf42e13ae600d1b
Instruction Fuzzy Hash: A711C47A7042469BE718CE2ED8D1967B759FB98254F048628ED0DD3241DF31E861CBE1

Function 028AA290 Relevance: 1.6, APIs: 1, Instructions: 50timeCOMMON

Download Yara Rule

APIs

Part of subcall function 028AA310: timeGetTime.WINMM(028C012C,?,?,028BA9CE,000000FF,?,028AA2CF), ref: 028AA34D

timeGetTime.WINMM ref: 028AA2E6

Part of subcall function 028A9C00: SetLastError.KERNEL32(0000139F,028C012C), ref: 028A9C36

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Timetime$ErrorLast
String ID:
API String ID: 2961902989-0
Opcode ID: 0dbae639c21db9cd6e0942f08bdd49b44dc4802e8ae192e7890e614d0aec1a83
Instruction ID: 1b1d35b154813189b6eeeca16b066595fd0a25e0e1aa0ccd0e11757eb4816c48
Opcode Fuzzy Hash: 0dbae639c21db9cd6e0942f08bdd49b44dc4802e8ae192e7890e614d0aec1a83
Instruction Fuzzy Hash: 280129B5A006059FD724DF7EC98598BF7F9FF89704B104A2ED05AC3600EB74AA05CB91

Function 00183C70 Relevance: 1.5, APIs: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00183C77

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: b84623038b5941dbeee06b8cb5328966c6abd421ec14f5a13ebf170875d7568b
Instruction ID: e9af9337839f704b24475afd047c113ab219cc67a9011d6fe69921711f606832
Opcode Fuzzy Hash: b84623038b5941dbeee06b8cb5328966c6abd421ec14f5a13ebf170875d7568b
Instruction Fuzzy Hash: 9D014F746102028BDB68BF64D91563D76A2AFA0BA0F18453DE5A1D7290DF70CF81DF14

Function 00174010 Relevance: 1.5, APIs: 1, Instructions: 37memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00174065

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AllocatorDebugHeap
String ID:
API String ID: 571936431-0
Opcode ID: 925bc5096a5e7444e16c82b43c25d5c18f8fc7c06cb415e9f5d9cce6475d6444
Instruction ID: fe57d52462287fb05aac357a00e8be29118b786a2425ecc9b113b9dca2e5e5d6
Opcode Fuzzy Hash: 925bc5096a5e7444e16c82b43c25d5c18f8fc7c06cb415e9f5d9cce6475d6444
Instruction Fuzzy Hash: 91016DB1A04109EBCB04DF98EC51BAEB7B8FB58710F008729F429973C0CB35A9008B90

Function 00173590 Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000006), ref: 001735AC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: d294accc76f7680fdf643d05ed31cbb63d253605b678686765fe2a393264ae2b
Instruction ID: ec641088fb2e1f24e54a2b338e06429ea115da57b55a6e883eaa563a6a1e996a
Opcode Fuzzy Hash: d294accc76f7680fdf643d05ed31cbb63d253605b678686765fe2a393264ae2b
Instruction Fuzzy Hash: E9F065BAA1510CBBDB04DF98DC45A7A73B8EB48300F10C168F91D8B240D635DB00A7A0

Function 001791AE Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 001791CD

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 1d617edf50bdc2224914ce1c75ef6dc234a16cbaba0a8ac514ddf607c57187dc
Instruction ID: 4a6b8a0b9b3a8d99b4a22a80edbcc18d827a2525b38c7e3de9194823d857acb5
Opcode Fuzzy Hash: 1d617edf50bdc2224914ce1c75ef6dc234a16cbaba0a8ac514ddf607c57187dc
Instruction Fuzzy Hash: 04E06D325002165BC7008B49D408A86BBEDEF91371F56C466E408CB262CB71E8188BA0

Function 0026FFA1 Relevance: 1.5, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 0026FFC2

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: __flsbuf
String ID:
API String ID: 2056685748-0
Opcode ID: 05b21295f4039f2a48b0280d9254d2143f31e1f3bae67ceb3e2901a480aa6268
Instruction ID: 06cbcfbafe067fa5dc4eff0c322cae78f545b2e2ca1ee234016171233de815d7
Opcode Fuzzy Hash: 05b21295f4039f2a48b0280d9254d2143f31e1f3bae67ceb3e2901a480aa6268
Instruction Fuzzy Hash: 3AE09A30020200CAEEA50F24E1456347BA09F0372AB3886AEE594898E7C73A94E6DB10

Function 028BAB70 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 028BAB8E

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: f529757e95f7814db7287e4bfa334b28a3384f806e090d6d3852ce1b5ae60ef7
Instruction ID: a71abd777c07aa8d0e4b83f560246109014f9fd979fb4e129891d3120b7f2533
Opcode Fuzzy Hash: f529757e95f7814db7287e4bfa334b28a3384f806e090d6d3852ce1b5ae60ef7
Instruction Fuzzy Hash: E8E0DF7CE40208EBE704EBA9DC16A8EB3A5DB09304F100469ED19C3380EE306A24CA83

Function 02B01749 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02B01755

Part of subcall function 02B045E4: __getptd_noexit.LIBCMT ref: 02B045E7
Part of subcall function 02B045E4: __amsg_exit.LIBCMT ref: 02B045F4

Part of subcall function 02B0172A: __getptd_noexit.LIBCMT ref: 02B0172F
Part of subcall function 02B0172A: __freeptd.LIBCMT ref: 02B01739
Part of subcall function 02B0172A: ExitThread.KERNEL32 ref: 02B01742

Part of subcall function 02B04BDC: __getptd_noexit.LIBCMT ref: 02B04BE2

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: __getptd_noexit$ExitThread__amsg_exit__freeptd__getptd
String ID:
API String ID: 133325885-0
Opcode ID: 70dcef7aee23cca2023904fc34334a585155b4d91028d2f424118dfbea503727
Instruction ID: 0950b353b71c9f958eb01dc6680a14918eda9df2e8bf69ea94b61ab8d367cb89
Opcode Fuzzy Hash: 70dcef7aee23cca2023904fc34334a585155b4d91028d2f424118dfbea503727
Instruction Fuzzy Hash: 51E0ECB5940600AFEB0DABA0D995E6E7B76EF44301F2000C9E2025B2F1DE75A951DE21

Function 00186BCB Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 0019EED6: GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 0019EF09
Part of subcall function 0019EED6: _memset.LIBCMT ref: 0019EF22

SystemParametersInfoW.USER32(00000029,-000001F8,?,00000000), ref: 00186BEF

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AddressInfoParametersProcSystem_memset
String ID:
API String ID: 831922234-0
Opcode ID: 14bd04be0be16233ddea66d657984ab4579b954e26553dd7b81a76a0cdc61700
Instruction ID: 07cd318bc7e4fcc5f8a8239d7ee76070d781653c918e0b4f20d1de3478e3b2f9
Opcode Fuzzy Hash: 14bd04be0be16233ddea66d657984ab4579b954e26553dd7b81a76a0cdc61700
Instruction Fuzzy Hash: 13D0A7B3590604AFE3005B74FC0AF76364DE770721F140630B524CA1D0EBBAD8408610

Function 028A4020 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 028A5527

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 5bd4640da4fb7005c0af0110065c3a8149f3291458b4565b93b31229ac1bd1b8
Instruction ID: eacab557ec2f173355440b4d3a8b96961a64a1d9165ee9e84cab10e8a8ae66cf
Opcode Fuzzy Hash: 5bd4640da4fb7005c0af0110065c3a8149f3291458b4565b93b31229ac1bd1b8
Instruction Fuzzy Hash: 1ED022392C430DB7E600AA809C06EB5339C9B08B00FC08020BB188A1C09AB2F910C3D4

Function 028A4030 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 028A5547

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: e722637bea9b94ae57367f11d4cb92c8d9c252f3a5f8c55bde5d240d4f22b62b
Instruction ID: ff248cbba1ff9d60f77072171a22fdc24db0e9e7db5bf99d53dd3faccf81fc78
Opcode Fuzzy Hash: e722637bea9b94ae57367f11d4cb92c8d9c252f3a5f8c55bde5d240d4f22b62b
Instruction Fuzzy Hash: BBD0223929430DB7EA009AC0AC02EB5339C8B08B10F804020BB188A1C0DAB2F540C3D4

Function 001713E0 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(002D39F8,0002A55F,00000040,?), ref: 001713F6

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1061cd4c86a946612d2e33ee088ffd95e0ab4d339aa1e8f2d7d066cf13100abc
Instruction ID: 80294ed90614b3f8a54c15ad580726181911398485ba2d07088f6ef3b1c581c0
Opcode Fuzzy Hash: 1061cd4c86a946612d2e33ee088ffd95e0ab4d339aa1e8f2d7d066cf13100abc
Instruction Fuzzy Hash: F9D0C774A9520C7BC740DBE8AC1BA9DBBB8DB45701F500292AE04E5280E6B05B5886A7

Function 028A56E0 Relevance: 1.5, APIs: 1, Instructions: 10networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,028BB604,00000010,00000000), ref: 028A56F0

Memory Dump Source

Source File: 00000000.00000002.2325467228.00000000028A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 028A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28a1000_1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 14ee6b8ff2a3d601be35d35d53156fc6352e77b6a8c6dda5e574e56434697640
Instruction ID: 966c8d1612ca23c97852f29a86d1d6d068d8cf1e0e6a7ad290e1289bbc1fdb6b
Opcode Fuzzy Hash: 14ee6b8ff2a3d601be35d35d53156fc6352e77b6a8c6dda5e574e56434697640
Instruction Fuzzy Hash: 70C09B3D6C430C77E5115595DC46FC5775C5709F18F4044047A099A3C2C5F5B4504558

Function 0017A27D Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0017A28C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 5f28314d2c58fcd6566eb4aa9ad3283483f84dc96f689cf6c683d4d6da55b76c
Instruction ID: 70f00862bb0aaf7d7df2cba655d51d2064f0e20b7750e3917d6aced61f312c97
Opcode Fuzzy Hash: 5f28314d2c58fcd6566eb4aa9ad3283483f84dc96f689cf6c683d4d6da55b76c
Instruction Fuzzy Hash: D2B09270902104AADE806730A94C71A27646FD1306F60C894B009D5443DB3AC0418A12

Function 00171270 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

std::tr1::_Random_device.LIBCPMT ref: 00171277

Part of subcall function 0027EBB3: _rand_s.LIBCMT ref: 0027EBBF
Part of subcall function 0027EBB3: std::exception::exception.LIBCMT ref: 0027EBD7
Part of subcall function 0027EBB3: __CxxThrowException@8.LIBCMT ref: 0027EBEC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Exception@8Random_deviceThrow_rand_sstd::exception::exceptionstd::tr1::_
String ID:
API String ID: 3795384516-0
Opcode ID: c45f4bd1007560787cde0ef8e5e5411bf9392eba5c60d02c7db98903bcf4f06c
Instruction ID: c1e19b5bf319459dacb8a19373f70a0a4a68f351758ef9e2ebf3a5f782f242d5
Opcode Fuzzy Hash: c45f4bd1007560787cde0ef8e5e5411bf9392eba5c60d02c7db98903bcf4f06c
Instruction Fuzzy Hash: F7B01270C1D30C634A14AB956902419BB5CD505214B0042DDBC0C0370198B3992009E5

Function 00171590 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00171270: std::tr1::_Random_device.LIBCPMT ref: 00171277

Sleep.KERNEL32(00000000,?,000003E8,00002710,00000000,000000FF,6C078965,002B533E,745E08A5,?,0028A0EB,000000FF), ref: 00171640

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Random_deviceSleepstd::tr1::_
String ID:
API String ID: 1866270999-0
Opcode ID: 76e34a74a81d6921aedfd76c679a54f4e406bb43647ce26a7e4047d547e9d5d3
Instruction ID: 29abd6bbcc08d7641e42df79f8782eeed7a3618774543cd48f0ad32996ed3ba3
Opcode Fuzzy Hash: 76e34a74a81d6921aedfd76c679a54f4e406bb43647ce26a7e4047d547e9d5d3
Instruction Fuzzy Hash: 25116031914158ABCB14EB58EC95BEDB3B8EB14750F104399B41AA25D1EF302B44CF54

Non-executed Functions

Function 02AF46E0 Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 240libraryloaderinjectionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF4704
_memset.LIBCMT ref: 02AF4750
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 02AF4764

Part of subcall function 02AF5330: _vswprintf_s.LIBCMT ref: 02AF5341

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 02AF4793
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000214,00000000,00000000,00000044,?), ref: 02AF47DA

Part of subcall function 02AF4640: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,02AF47FC), ref: 02AF4656
Part of subcall function 02AF4640: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,02AF47FC,?,?,?,?,?,?,74DF0630), ref: 02AF465D

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 02AF480A
_memset.LIBCMT ref: 02AF4823
LoadLibraryA.KERNEL32(Kernel32.dll,OpenProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 02AF483B
GetProcAddress.KERNEL32(00000000), ref: 02AF4844
LoadLibraryA.KERNEL32(Kernel32.dll,ExitProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 02AF4856
GetProcAddress.KERNEL32(00000000), ref: 02AF4859
LoadLibraryA.KERNEL32(Kernel32.dll,WinExec,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 02AF486B
GetProcAddress.KERNEL32(00000000), ref: 02AF486E
LoadLibraryA.KERNEL32(Kernel32.dll,WaitForSingleObject,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 02AF4880
GetProcAddress.KERNEL32(00000000), ref: 02AF4883
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 02AF488B
GetProcessId.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 02AF4892
_memset.LIBCMT ref: 02AF48B4
GetModuleFileNameA.KERNEL32(00000000,?,000000FA,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 02AF48CA
VirtualAllocEx.KERNEL32(00000000,00000000,00000118,00003000,00000040), ref: 02AF48FF
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000118,00000000), ref: 02AF491B
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000001,?), ref: 02AF4943
VirtualAllocEx.KERNEL32(00000000,00000000,00001000,00003000,00000040), ref: 02AF4958
WriteProcessMemory.KERNEL32(00000000,00000000,02AF45F0,00001000,00000000), ref: 02AF4972
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000001,00000000), ref: 02AF4990
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 02AF49A1
Sleep.KERNEL32(0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 02AF49BA
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000040,00000000), ref: 02AF49D6
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000040,00000000), ref: 02AF49E8
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 02AF49F1

Strings

Kernel32.dll, xrefs: 02AF4836, 02AF484B, 02AF4860, 02AF4875
ExitProcess, xrefs: 02AF4846
D, xrefs: 02AF4740
WaitForSingleObject, xrefs: 02AF4870
WinExec, xrefs: 02AF485B
OpenProcess, xrefs: 02AF4831
%s%s, xrefs: 02AF4776, 02AF47AA
Windows\System32\svchost.exe, xrefs: 02AF47A4
Windows\SysWOW64\svchost.exe, xrefs: 02AF4770

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect_memset$AllocCreateCurrentFileMemoryOpenThreadWrite$AttributesDirectoryModuleNameRemoteResumeSleepSystemToken_vswprintf_s
String ID: %s%s$D$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 4176418925-3213446972
Opcode ID: 974d183e384bbc3aecfc4718fcef6ab290d31fc54f066270a522215002fbe693
Instruction ID: fb35c723e2ebd981995a32242ddb11b39303cc188a69f9ad5011dfed62c8f6e9
Opcode Fuzzy Hash: 974d183e384bbc3aecfc4718fcef6ab290d31fc54f066270a522215002fbe693
Instruction Fuzzy Hash: 6F81D571A80358ABE7219B619C49FDBBBBCAF55B40F4005D9B309A7180DFB45A848F64

Function 02AF7F30 Relevance: 58.1, APIs: 29, Strings: 4, Instructions: 354windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 02AF7F67
GetDC.USER32(00000000), ref: 02AF7F74
CreateCompatibleDC.GDI32(00000000), ref: 02AF7F7A
GetDC.USER32(00000000), ref: 02AF7F85
GetDeviceCaps.GDI32(00000000,00000008), ref: 02AF7F92
GetDeviceCaps.GDI32(00000000,00000076), ref: 02AF7F9A
ReleaseDC.USER32(00000000,00000000), ref: 02AF7FAB
GetSystemMetrics.USER32(0000004E), ref: 02AF7FD0
GetSystemMetrics.USER32(0000004F), ref: 02AF7FFE
GetSystemMetrics.USER32(0000004C), ref: 02AF8050
GetSystemMetrics.USER32(0000004D), ref: 02AF8065
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 02AF807E
SelectObject.GDI32(?,00000000), ref: 02AF808C
SetStretchBltMode.GDI32(?,00000003), ref: 02AF8098
GetSystemMetrics.USER32(0000004F), ref: 02AF80A5
GetSystemMetrics.USER32(0000004E), ref: 02AF80B8
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 02AF80DF
_memset.LIBCMT ref: 02AF8152
GetDIBits.GDI32(?,?,00000000,00000000,?,00000028,00000000), ref: 02AF816F
_memset.LIBCMT ref: 02AF8187
_memmove.LIBCMT ref: 02AF81C1

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

DeleteObject.GDI32(?), ref: 02AF8202
DeleteObject.GDI32(?), ref: 02AF820C
ReleaseDC.USER32(00000000,?), ref: 02AF8218
_memmove.LIBCMT ref: 02AF82A4
DeleteObject.GDI32(?), ref: 02AF82B0
DeleteObject.GDI32(?), ref: 02AF82BA
ReleaseDC.USER32(00000000,?), ref: 02AF82C6

Strings

(, xrefs: 02AF8116
gfff, xrefs: 02AF7FE8
gfff, xrefs: 02AF8010
6, xrefs: 02AF8139

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memmove_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 1260665799-713438465
Opcode ID: 19af87c1ec506c52f5e1032bd6a083ded6e56b3c05c1e46b6ff65fec19c649fe
Instruction ID: 506b335cbf2a76715fd51a56e324b60a0a987de648d91c1a9c86e16c819ac8c4
Opcode Fuzzy Hash: 19af87c1ec506c52f5e1032bd6a083ded6e56b3c05c1e46b6ff65fec19c649fe
Instruction Fuzzy Hash: B0D126B1E00318DFDB14DFE9D989A9EBBB9FF48300F504529E905AB290D774A905CFA1

Function 02AFAA00 Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 216filesynchronizationstringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AFAA30
Sleep.KERNEL32(00000001,?,?,02AF30D3), ref: 02AFAA42
GetTickCount.KERNEL32 ref: 02AFAA4E
GetTickCount.KERNEL32 ref: 02AFAA61
InterlockedExchange.KERNEL32(02B23358,00000000), ref: 02AFAA69
OpenClipboard.USER32(00000000), ref: 02AFAA71
GetClipboardData.USER32(0000000D), ref: 02AFAA79
GlobalSize.KERNEL32(00000000), ref: 02AFAA8A
GlobalLock.KERNEL32(00000000), ref: 02AFAA9B
_memmove.LIBCMT ref: 02AFAAFF
wsprintfW.USER32 ref: 02AFAB14
_memset.LIBCMT ref: 02AFAB32
GlobalUnlock.KERNEL32(00000000), ref: 02AFAB3B
CloseClipboard.USER32 ref: 02AFAB41
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,02AF30D3), ref: 02AFAB59
CreateFileW.KERNEL32(02B221E8,40000000,00000002,00000000,00000004,00000080,00000000,?,?,?,?,?,02AF30D3), ref: 02AFAB76
SetFilePointer.KERNEL32 ref: 02AFAB8F
lstrlenW.KERNEL32(02B18340,00000000,00000000), ref: 02AFABA3
WriteFile.KERNEL32(00000000,02B18340,00000000), ref: 02AFABAE
CloseHandle.KERNEL32(00000000), ref: 02AFABB5
ReleaseMutex.KERNEL32(?), ref: 02AFABC1
lstrlenW.KERNEL32(?,?,02AF30D3), ref: 02AFAC0D
_memset.LIBCMT ref: 02AFAC16
wsprintfW.USER32 ref: 02AFAC4A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,02AF30D3), ref: 02AFAC5C
CreateFileW.KERNEL32(02B221E8,40000000,00000002,00000000,00000004,00000080,00000000), ref: 02AFAC79
SetFilePointer.KERNEL32 ref: 02AFAC92
lstrlenW.KERNEL32(00000000,00000000,00000000), ref: 02AFACA5
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02AFACAF
CloseHandle.KERNEL32(00000000), ref: 02AFACB6
ReleaseMutex.KERNEL32(?), ref: 02AFACC3

Strings

[esc], xrefs: 02AFAC1E, 02AFAC40
[, xrefs: 02AFAB0E

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: File$ClipboardCloseGlobal_memsetlstrlen$CountCreateHandleMutexObjectPointerReleaseSingleTickWaitWritewsprintf$DataExchangeInterlockedLockOpenSizeSleepUnlock_memmove
String ID: [$[esc]
API String ID: 3350212475-1978609555
Opcode ID: 335dd6370e0bfd06e2167ea51056e18633e4b6a06d386be19ef6179f12ece374
Instruction ID: fc374e4d7896b924aadc91a2046ff00e11eb32554943b8230ec5cae3a4de31a4
Opcode Fuzzy Hash: 335dd6370e0bfd06e2167ea51056e18633e4b6a06d386be19ef6179f12ece374
Instruction Fuzzy Hash: 0971D7B2E80310ABE7209BA0DC89FDA77B5BB04740F454994FB09E7180DB749D99CF90

Function 001E659B Relevance: 42.5, APIs: 28, Instructions: 452windowkeyboardCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 001E65D0
GetWindowRect.USER32(?,?), ref: 001E65F3
PtInRect.USER32(?,?,?), ref: 001E6601

Part of subcall function 00213D3F: RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 00213DB6

GetAsyncKeyState.USER32(00000012), ref: 001E6626
ScreenToClient.USER32(?,?), ref: 001E6674
IsWindow.USER32(?), ref: 001E66BB
IsWindow.USER32(?), ref: 001E66FE
GetWindowRect.USER32(?,?), ref: 001E671E
PtInRect.USER32(?,?,?), ref: 001E672E
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 001E6763
PtInRect.USER32(-00000054,?,?), ref: 001E67AE
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 001E67D3
ScreenToClient.USER32(?,?), ref: 001E682B
PtInRect.USER32(?,?,?), ref: 001E683B
GetParent.USER32(?), ref: 001E68C5
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 001E6958
GetFocus.USER32 ref: 001E695E
WindowFromPoint.USER32(?,?,00000000), ref: 001E6996
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 001E69E0
GetSystemMenu.USER32(?,00000000,?,?,75C0A000,?), ref: 001E6A69
IsMenu.USER32(?), ref: 001E6A8B
EnableMenuItem.USER32(?,0000F030,00000000), ref: 001E6AA8
EnableMenuItem.USER32(?,0000F120,00000000), ref: 001E6AB3
IsZoomed.USER32(?), ref: 001E6AC1
IsIconic.USER32(?), ref: 001E6AE0
EnableMenuItem.USER32(?,0000F120,00000003), ref: 001E6AF4
TrackPopupMenu.USER32(?,00000100,?,?,00000000,?,00000000), ref: 001E6B1C
SendMessageW.USER32(?,00000112,00000000,00000000), ref: 001E6B36

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$MenuRect$MessageSend$EnableItem$ClientScreen$AsyncFocusFromIconicParentPointPopupRedrawStateSystemTrackVisibleZoomed
String ID:
API String ID: 3398603409-0
Opcode ID: b767ee03bd7f62e9e297d0fe652a5c54b7cc64242cc71419f0ec5dfabd6cd709
Instruction ID: 0f3818aad54409a6fb02c96d26580b0ec939fe66dd7e6dcc7e23df9f68963516
Opcode Fuzzy Hash: b767ee03bd7f62e9e297d0fe652a5c54b7cc64242cc71419f0ec5dfabd6cd709
Instruction Fuzzy Hash: 82F16A71A00649AFDB209FA5DD88EADBBF9FB18384F544529F546E7261DB30AC40CF60

Function 001F87A3 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 325windowkeyboardCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001F87AD
GetKeyState.USER32(00000001), ref: 001F87F2
GetKeyState.USER32(00000002), ref: 001F87FF
GetKeyState.USER32(00000004), ref: 001F880C
GetParent.USER32(?), ref: 001F8831
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 001F88E5
_memset.LIBCMT ref: 001F88F9
ScreenToClient.USER32(?,?), ref: 001F8920
_memset.LIBCMT ref: 001F892E
GetCursorPos.USER32(?), ref: 001F8984
SendMessageW.USER32(?,00000412,00000000,?), ref: 001F89A8
SendMessageW.USER32(?,00000432,00000000,?), ref: 001F8A08
SendMessageW.USER32(?,00000401,00000001,00000000), ref: 001F8A2E
SendMessageW.USER32(?,00000411,00000001,?), ref: 001F8A4A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000213), ref: 001F8A5D
SendMessageW.USER32(?,00000433,00000000,?), ref: 001F8A88
_memset.LIBCMT ref: 001F8AB0
_free.LIBCMT ref: 001F8ADA
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 001F8AF1
GetParent.USER32(?), ref: 001F8B1E

Strings

,, xrefs: 001F8945

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$State_memset$Parent$ClientCursorH_prolog3_ScreenWindow_free
String ID: ,
API String ID: 2464378573-3772416878
Opcode ID: b102fc94a49453f1e0eac56c098ffdc9ef8710f4b1e3d6c5928f444b90491f95
Instruction ID: aad4c858c6123af4c5d4a90b33d89fe283c622242b87a275e33eb50aad8b9e2d
Opcode Fuzzy Hash: b102fc94a49453f1e0eac56c098ffdc9ef8710f4b1e3d6c5928f444b90491f95
Instruction Fuzzy Hash: 20C19CB1A007199FEF249F64CC89BBD77B5FF05700F25066AEA05AB1A2DB719881CF50

Function 001B0A4A Relevance: 29.3, APIs: 13, Strings: 3, Instructions: 1300COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B0A54
Polygon.GDI32(?,?,00000004), ref: 001B0B6E
CreatePolygonRgn.GDI32(?,00000008,00000002), ref: 001B1295
InflateRect.USER32(?,000000FF,00000000), ref: 001B12F8
GetClientRect.USER32(?,?), ref: 001B1391
Polyline.GDI32(00000007,?,00000008), ref: 001B1430
CreatePolygonRgn.GDI32(?,?,00000002), ref: 001B0E9E

Part of subcall function 0017A40A: __EH_prolog3.LIBCMT ref: 0017A411
Part of subcall function 0017A40A: CreatePen.GDI32(?,?,?), ref: 0017A432

Part of subcall function 0017A336: SelectObject.GDI32(?,00000000), ref: 0017A35C
Part of subcall function 0017A336: SelectObject.GDI32(?,?), ref: 0017A372

Part of subcall function 00179D3E: MoveToEx.GDI32(?,?,?,?), ref: 00179D68
Part of subcall function 00179D3E: MoveToEx.GDI32(?,?,?,?), ref: 00179D79

Part of subcall function 0017A45E: __EH_prolog3.LIBCMT ref: 0017A465
Part of subcall function 0017A45E: CreateSolidBrush.GDI32(00000000), ref: 0017A480

FillRect.USER32(0000000A,?,?), ref: 001B19B9

Part of subcall function 001797C1: MoveToEx.GDI32(?,?,?,00000000), ref: 001797DE
Part of subcall function 001797C1: LineTo.GDI32(?,?,?), ref: 001797ED

CreateRectRgnIndirect.GDI32(?), ref: 001B16A8
OffsetRect.USER32(?,00000001,00000000), ref: 001B1975
FillRect.USER32(0000000A,?), ref: 001B19E3
OffsetRect.USER32(?,00000000), ref: 001B1A9B
CreateRectRgnIndirect.GDI32(?), ref: 001B1BAE

Strings

(, xrefs: 001B1AA9
L5), xrefs: 001B0BC9
(, xrefs: 001B1051

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Create$MovePolygon$FillH_prolog3IndirectObjectOffsetSelect$BrushClientH_prolog3_InflateLinePolylineSolid
String ID: L5)$($(
API String ID: 3550269515-2977858020
Opcode ID: 829fd94160229f4822a85f4b2406f4e2bb0d79cd61617c67a7f4da101fad0374
Instruction ID: dd57eaa2a8981262ca0f836b32215f59ece979b7909daa078ce7fa8714ed9107
Opcode Fuzzy Hash: 829fd94160229f4822a85f4b2406f4e2bb0d79cd61617c67a7f4da101fad0374
Instruction Fuzzy Hash: F8C21470900219DFDF25DF68CD95BEEB7B5BF58300F5081AAE50AA7291DB309A85CF60

Function 02AF4D50 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 127threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF4D6F
_memset.LIBCMT ref: 02AF4D9B
_memset.LIBCMT ref: 02AF4DD0
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 02AF4DE4

Part of subcall function 02AF5330: _vswprintf_s.LIBCMT ref: 02AF5341

GetFileAttributesA.KERNEL32(?), ref: 02AF4E11
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 02AF4E61
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 02AF4E8D
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00003000,00000040), ref: 02AF4EA5
GetThreadContext.KERNEL32(?,?,?,?,00000000,?,00003000,00000040), ref: 02AF4EC7
SetThreadContext.KERNEL32(?,00010007,?,?,00000000,?,00003000,00000040), ref: 02AF4EE5
ResumeThread.KERNEL32(?,?,?,00000000,?,00003000,00000040), ref: 02AF4EFA

Strings

D, xrefs: 02AF4DAF
%s%s, xrefs: 02AF4DF6, 02AF4E28
Windows\System32\svchost.exe, xrefs: 02AF4E22
Windows\SysWOW64\svchost.exe, xrefs: 02AF4DEA

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 2170139861-2473635271
Opcode ID: ca3a9edbd86cb257ae9e270564a81bbcf37a68d389574ab36fb9f40184f96193
Instruction ID: afc230b1637ae53fa981b4c2ed2e952e4b9610e962bdb5ac0a669dc6a76b94cd
Opcode Fuzzy Hash: ca3a9edbd86cb257ae9e270564a81bbcf37a68d389574ab36fb9f40184f96193
Instruction Fuzzy Hash: EF4185B0E40258ABEB61DB64DC85FEA77BCAB58700F5001D9B60DA71C0EFB45A848F14

Function 02AFA6D0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130synchronizationfilestringCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,02B221E8,74DEE010,74DF2FA0,?,?,02AF30AE,?), ref: 02AFA6F5
lstrcatW.KERNEL32(02B221E8,\sys_vdio.key,?,?,02AF30AE,?), ref: 02AFA705
CreateMutexW.KERNEL32(00000000,00000000,02B221E8,?,?,02AF30AE,?), ref: 02AFA714
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,02AF30AE,?), ref: 02AFA722
CreateFileW.KERNEL32(02B221E8,40000000,00000002,00000000,00000004,00000080,00000000,?,?,02AF30AE,?), ref: 02AFA73F
GetFileSize.KERNEL32(00000000,00000000,?,?,02AF30AE,?), ref: 02AFA74A
CloseHandle.KERNEL32(00000000,?,?,02AF30AE,?), ref: 02AFA753
DeleteFileW.KERNEL32(02B221E8,?,?,02AF30AE,?), ref: 02AFA766
ReleaseMutex.KERNEL32(?,?,?,02AF30AE,?), ref: 02AFA773
DirectInput8Create.DINPUT8(?,00000800,02B171F4,02B22680,00000000,?,?,02AF30AE,?), ref: 02AFA78E
GetTickCount.KERNEL32 ref: 02AFA840

Strings

\sys_vdio.key, xrefs: 02AFA6FB
<, xrefs: 02AFA812

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeTickWaitlstrcat
String ID: <$\sys_vdio.key
API String ID: 3264482950-1798576524
Opcode ID: db3d5cc51bfcd6c2f9a87892424b2761c564061d957b76f5354ef85a552363fd
Instruction ID: 2c0c8ff24291b01f9506383c7e25fc76ff8c2fc915df7ae1089f9d335e0def51
Opcode Fuzzy Hash: db3d5cc51bfcd6c2f9a87892424b2761c564061d957b76f5354ef85a552363fd
Instruction Fuzzy Hash: 3A410771B80311EFE710DFA8DC49F5A7BB5AB49740F514985FA09EB290CB70A8558B90

Function 001AAB3A Relevance: 21.3, APIs: 14, Instructions: 280keyboardwindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 001AAC1E
SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 001AAC3A
GetCapture.USER32 ref: 001AACB4
GetKeyState.USER32(00000011), ref: 001AAD16
GetKeyState.USER32(00000010), ref: 001AAD23
ImmGetContext.IMM32(?), ref: 001AAD31
ImmGetOpenStatus.IMM32(00000000,?), ref: 001AAD3E
ImmReleaseContext.IMM32(?,00000000,?), ref: 001AAD60
GetFocus.USER32 ref: 001AAD8A
IsWindow.USER32(?), ref: 001AADCB
IsWindow.USER32(?), ref: 001AAE51
ClientToScreen.USER32(?,?), ref: 001AAE61
IsWindow.USER32(?), ref: 001AAE87
ClientToScreen.USER32(?,?), ref: 001AAEB6

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$ClientContextScreenState$CaptureFocusMessageOpenReleaseSendStatus
String ID:
API String ID: 1155058817-0
Opcode ID: 18aca131c1ff80ea40015fb437826d1468b6fddaa38dca738fbc15ecd21c9876
Instruction ID: d3c5529f976c95e2443bcdfd72e471622697f46ff614b4900f4c0fbbfc5c2442
Opcode Fuzzy Hash: 18aca131c1ff80ea40015fb437826d1468b6fddaa38dca738fbc15ecd21c9876
Instruction Fuzzy Hash: 42A1F239500602AFEF359FA0DC84ABEB7AAFF06341F90442AE596D2461D731DC90DB62

Function 02AF4520 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,?,?,02AF9EB2), ref: 02AF4537
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,02AF9EB2), ref: 02AF453E
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 02AF455A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02AF4577
CloseHandle.KERNEL32(?), ref: 02AF4581
GetModuleHandleA.KERNEL32(NtDll.dll,NtSetInformationProcess,?,?,?,?,?,?,?,02AF9EB2), ref: 02AF4591
GetProcAddress.KERNEL32(00000000), ref: 02AF4598
GetCurrentProcessId.KERNEL32 ref: 02AF45BA
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 02AF45C7

Strings

SeDebugPrivilege, xrefs: 02AF454C
NtSetInformationProcess, xrefs: 02AF4587
NtDll.dll, xrefs: 02AF458C

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Process$CurrentHandleOpenToken$AddressAdjustCloseLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 1802016953-1577477132
Opcode ID: 138e03e5ba3572cc1a82ebe37c85c98c4cb199ca561aba6d0a511d6fd957af36
Instruction ID: f45b98adda93328b7df8c2e30011caa2bff8b019a1e8b5a5576946582face8d4
Opcode Fuzzy Hash: 138e03e5ba3572cc1a82ebe37c85c98c4cb199ca561aba6d0a511d6fd957af36
Instruction Fuzzy Hash: 1D217571E80209AFEB14EBE4DC4AFBF7B78DB08740F400559FA05A71C0DBB459558BA1

Function 001EE3B0 Relevance: 16.9, APIs: 11, Instructions: 446COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001EE432
SetRectEmpty.USER32(?), ref: 001EE44B
InflateRect.USER32(?,000000FE,00000000), ref: 001EE49F
OffsetRect.USER32(?,00000000,00000000), ref: 001EE691
GetSystemMetrics.USER32(00000002), ref: 001EE6DA
InflateRect.USER32(?,00000000,00000000), ref: 001EE703
InflateRect.USER32(?,000000FF,000000FF), ref: 001EE8D0
InvalidateRect.USER32(?,?,00000001), ref: 001EE8DF
GetClientRect.USER32(?,?), ref: 001EE8FA
InvalidateRect.USER32(?,?,00000001), ref: 001EE926
UpdateWindow.USER32(?), ref: 001EE92F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Inflate$ClientInvalidate$EmptyMetricsOffsetSystemUpdateWindow
String ID:
API String ID: 159692204-0
Opcode ID: 64aa7d769805a11812a730b63d29bd0628775c8a05377a71864ca63dcfda8717
Instruction ID: f433742fca555d2978c74306c94a273a6f2bdcc4ad6dcfbc96fa8a3684958abd
Opcode Fuzzy Hash: 64aa7d769805a11812a730b63d29bd0628775c8a05377a71864ca63dcfda8717
Instruction Fuzzy Hash: C502F275900A55CFCF15CF69C988AAD77F5AF48304F2941BAEC09AF24AEB309801CB60

Function 00208144 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 002081D4
_memset.LIBCMT ref: 002081E2
_free.LIBCMT ref: 0020820E
IsWindow.USER32(?), ref: 0020832F

Strings

0, xrefs: 002081F8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ClientScreenWindow_free_memset
String ID: 0
API String ID: 2869304798-4108050209
Opcode ID: 842f15ba6039ba3fc159ecd34096c71981a63b748c40612c89267dc14ab6f8ce
Instruction ID: ec3da06b7422e06d4c78086826b077a0bb09b36f0beb9d3cbe437d3606c0262d
Opcode Fuzzy Hash: 842f15ba6039ba3fc159ecd34096c71981a63b748c40612c89267dc14ab6f8ce
Instruction Fuzzy Hash: 23519230A20755DFDF209FA4D889BAEBBB5BF54710F10012AF895A72D2DFB09891CB51

Function 02AF4A70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 02AF4A89
OpenProcessToken.ADVAPI32(00000000), ref: 02AF4A90
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02AF4AB6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02AF4ACC
GetLastError.KERNEL32 ref: 02AF4AD2
CloseHandle.KERNEL32(?), ref: 02AF4AE0
CloseHandle.KERNEL32(?), ref: 02AF4AFB

Strings

SeShutdownPrivilege, xrefs: 02AF4AA2

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: a844b1231996c0c55794b73588b002311ee34fff2fa2b5daa1636238983b38a1
Instruction ID: dff736641e14ad3de036446032ea81998c9e99c609945da610d425d120baeb70
Opcode Fuzzy Hash: a844b1231996c0c55794b73588b002311ee34fff2fa2b5daa1636238983b38a1
Instruction Fuzzy Hash: 4511E771F40209ABDB14EFE4DC49BAF7B78EB08700F800558FA05AB180CB749D65CB90

Function 001D6712 Relevance: 13.6, APIs: 9, Instructions: 141clipboardwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 001D6719

Part of subcall function 0017A078: __EH_prolog3.LIBCMT ref: 0017A07F
Part of subcall function 0017A078: GetWindowDC.USER32(00000000,00000004,00187938,00000000,?,?,00298F40), ref: 0017A0AB

CreateCompatibleDC.GDI32(00000000), ref: 001D673F
CreateCompatibleBitmap.GDI32(?,?,?), ref: 001D6768
FillRect.USER32(?,?), ref: 001D67E5
OpenClipboard.USER32(?), ref: 001D6847
EmptyClipboard.USER32 ref: 001D6855
CloseClipboard.USER32 ref: 001D686C

Part of subcall function 0017769F: __EH_prolog3.LIBCMT ref: 001776A6

SetClipboardData.USER32(00000002,00000000), ref: 001D6882
CloseClipboard.USER32 ref: 001D6899

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseCompatibleCreateH_prolog3$BitmapDataEmptyFillH_prolog3_catch_OpenRectWindow
String ID:
API String ID: 519079464-0
Opcode ID: 7a2973a55b27e6cef02a4ac4fb754ea042de937f9eec436c7222655786027277
Instruction ID: 3570df2b439264aa340533c760a535b90d0339aeea0e0d7647a18c49aa473a4f
Opcode Fuzzy Hash: 7a2973a55b27e6cef02a4ac4fb754ea042de937f9eec436c7222655786027277
Instruction Fuzzy Hash: 6C514E74D01248EFDB05EFE4D9859EDBBB8BF28304F508169F41AB7292DB745A08DB21

Function 02AF4420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

PathIsDirectoryA.SHLWAPI(C:\Program Files\VMware\VMware Tools\), ref: 02AF4439
_memset.LIBCMT ref: 02AF4461
GlobalMemoryStatusEx.KERNEL32(?), ref: 02AF4493

Strings

C:\Program Files\VMware\VMware Tools\, xrefs: 02AF4434
@, xrefs: 02AF4489
VMware, xrefs: 02AF4470

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: DirectoryGlobalMemoryPathStatus_memset
String ID: @$C:\Program Files\VMware\VMware Tools\$VMware
API String ID: 3437834110-3945705589
Opcode ID: b3599460fbb71864607f7cab9fd531e0b6843b90a35c5bd73f16dca8bf1a46a7
Instruction ID: 2f4c7ce8d198835346777c65afbbc9633fd56cd80f95f94cd3793f3fe47bb47a
Opcode Fuzzy Hash: b3599460fbb71864607f7cab9fd531e0b6843b90a35c5bd73f16dca8bf1a46a7
Instruction Fuzzy Hash: 85010830E1011897DF24EBA49C85BAF7BBAEF04745F4001D9EA0E67040DF344A94DB42

Function 02AF7893 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32(?,02B18160), ref: 02AF78B6
ClearEventLogW.ADVAPI32(00000000), ref: 02AF78C4
CloseEventLog.ADVAPI32(00000000), ref: 02AF78CB

Strings

System, xrefs: 02AF78A3
Security, xrefs: 02AF789B
Application, xrefs: 02AF7893

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 9f993519c5e8d0d44aea4555c47943e3a5db43c2d36eb71d4254c7d800512f33
Instruction ID: 154306766175acc334cc38a964bfd10dedd94ce52a522ca222c9787ef3a25683
Opcode Fuzzy Hash: 9f993519c5e8d0d44aea4555c47943e3a5db43c2d36eb71d4254c7d800512f33
Instruction Fuzzy Hash: AEF0E2332002008B8311AF64A8CC86FF7B0FB89348F500A9CEA8A53100CB2144A5C792

Function 0021C056 Relevance: 9.1, APIs: 6, Instructions: 122timekeyboardCOMMON

Download Yara Rule

APIs

GetParent.USER32(0029DE08), ref: 0021C06E
KillTimer.USER32(0029DE08,00000003,00000000), ref: 0021C0B5
SetRectEmpty.USER32(?), ref: 0021C0CC
GetAsyncKeyState.USER32(00000001), ref: 0021C108
ScreenToClient.USER32(0029DE08,?), ref: 0021C12F
KillTimer.USER32(0029DE08,00000001), ref: 0021C157

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: KillTimer$AsyncClientEmptyParentRectScreenState
String ID:
API String ID: 3040166693-0
Opcode ID: 3ebda65e8b212799fb1d25b2cf5297755618c7c1da710ff8a4968b950cefe570
Instruction ID: df702d8acc976dafb92472c869be9fdb5de43af64757ac2dd34c8b5829abe512
Opcode Fuzzy Hash: 3ebda65e8b212799fb1d25b2cf5297755618c7c1da710ff8a4968b950cefe570
Instruction Fuzzy Hash: 6C418C75650205EFCF109FA0DC88AEE77B5FF58310F24457AF919AA1A2DB3099A0DF60

Function 001A05D8 Relevance: 9.1, APIs: 6, Instructions: 116keyboardwindowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000362,0000E002,00000000), ref: 001A065A
UpdateWindow.USER32(?), ref: 001A0671
GetKeyState.USER32(00000079), ref: 001A0696
GetKeyState.USER32(00000012), ref: 001A06A3
GetParent.USER32(?), ref: 001A0759
PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 001A0775

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageState$Exception@8ParentPostSendThrowUpdateWindow
String ID:
API String ID: 3830675576-0
Opcode ID: e85f65b5123416e9d4b829577c9e87f38285eb60c2fd2864a130461cfc013607
Instruction ID: 28c27d41e3e2f17a78ac810628344c9d0a5b78f87cd0d33e0155b0171dfae142
Opcode Fuzzy Hash: e85f65b5123416e9d4b829577c9e87f38285eb60c2fd2864a130461cfc013607
Instruction Fuzzy Hash: 9041D1396007059FE7728F60C848FAAB7E5BF99355F25492CE49E57191DBB1AC80CF10

Function 02AF4640 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,02AF47FC), ref: 02AF4656
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,02AF47FC,?,?,?,?,?,?,74DF0630), ref: 02AF465D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 02AF4685
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 02AF46B9

Strings

SeDebugPrivilege, xrefs: 02AF467E

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: 8c15f0117cb2b8c59d0633add5d2f4d65987de177a5aafee9be84819e5b8cec2
Instruction ID: b2a32fb48212f010dddc5646cffd830ebccf5ed54c5c498a5e1f6b74289f5fd1
Opcode Fuzzy Hash: 8c15f0117cb2b8c59d0633add5d2f4d65987de177a5aafee9be84819e5b8cec2
Instruction Fuzzy Hash: 26118271F402089BDB04DFE5DC4ABAEBBB5EB08700F104558E605AB180DB7499558B50

Function 001CC98F Relevance: 7.6, APIs: 5, Instructions: 86keyboardwindowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 001CC9C3
GetKeyState.USER32(00000012), ref: 001CC9F5
GetKeyState.USER32(00000011), ref: 001CC9FE
SendMessageW.USER32(?,00000157,00000000,00000000), ref: 001CCA17
SendMessageW.USER32(?,0000014F,00000001,00000000), ref: 001CCA28

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSendState$Parent
String ID:
API String ID: 1284845784-0
Opcode ID: 1ea3254037c58496fef2c2186c427dd34c0922fa23da71c5f7d467294636f8cb
Instruction ID: 3d9613ffa233957fa0d73970873707759c744fef40f615ae4faf29d3980184d0
Opcode Fuzzy Hash: 1ea3254037c58496fef2c2186c427dd34c0922fa23da71c5f7d467294636f8cb
Instruction Fuzzy Hash: 4221F83634051897CA26E6789C4DF79769ABBF5740F14412DE20E97554FB70DC018BE0

Function 02B0112F Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 02B038B6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02B038CB
UnhandledExceptionFilter.KERNEL32(02B14E30), ref: 02B038D6
GetCurrentProcess.KERNEL32(C0000409), ref: 02B038F2
TerminateProcess.KERNEL32(00000000), ref: 02B038F9

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 623e2136ce3eb132963dcbbc2c305d194c5d487b22391e64f1e55addf17be22a
Instruction ID: 6f3cd2967fa0ebf70f5f79c0da57372277fb5b8fbff4ef29276e5cd836514574
Opcode Fuzzy Hash: 623e2136ce3eb132963dcbbc2c305d194c5d487b22391e64f1e55addf17be22a
Instruction Fuzzy Hash: 7F21F4B8CA5314DFD761DF28E086A853BB4FB18782F52496AE50D93242E7B055E8CF05

Function 001749C6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000800,00000003,?,00000004), ref: 00174A0D
__snwprintf_s.LIBCMT ref: 00174A3F
LoadLibraryW.KERNEL32(?), ref: 00174A7A

Part of subcall function 00268FB0: __getptd_noexit.LIBCMT ref: 00268FB0

Strings

LOC, xrefs: 001749ED

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: InfoLibraryLoadLocale__getptd_noexit__snwprintf_s
String ID: LOC
API String ID: 3175857669-519433814
Opcode ID: f905930c7e84f156f2865672f7f9f15d151e8ad21cc1a49022b4bcd14c7dedb7
Instruction ID: bbce8f5c20736ce8ccf696d7e08c95b1f8681fcfe672a97b5d95dc2cc12aef64
Opcode Fuzzy Hash: f905930c7e84f156f2865672f7f9f15d151e8ad21cc1a49022b4bcd14c7dedb7
Instruction Fuzzy Hash: 0D115C31950208ABD711BB74DC89FAE33BCEF40310F5041A1F20AA7091EF748E548BA5

Function 0017810C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,00000000,00000005), ref: 00178137
LoadResource.KERNEL32(?,00000000), ref: 0017813F
LockResource.KERNEL32(00000000), ref: 00178151
FreeResource.KERNEL32(00000000), ref: 0017819F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 568dd73b2b98e259b121178b485732b18e1041f9d7fab1bcdb7b0d0d289c0db6
Instruction ID: deb517c750f7cbbbd4092457480bb130cbf1f5480f05fb7647fb6074fb8d4003
Opcode Fuzzy Hash: 568dd73b2b98e259b121178b485732b18e1041f9d7fab1bcdb7b0d0d289c0db6
Instruction Fuzzy Hash: 6D11CE39540610EFDB208FA5D88CA6BB7F4FF44311F20C429E95A93690EB70ED45E7A0

Function 001A6268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

SetForegroundWindow.USER32(?), ref: 001A6295
IsIconic.USER32(?), ref: 001A629E

Strings

H(), xrefs: 001A6274

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ForegroundIconicWindow
String ID: H()
API String ID: 1248896474-2653369260
Opcode ID: a154b5f50a928117fa948572963604cb47f620b60e537cc0a51decac7b4ca4d2
Instruction ID: 7c8ab7f9666fb32178e7a7b1a891f5b519812933a1cc42e327185f92c0b13e78
Opcode Fuzzy Hash: a154b5f50a928117fa948572963604cb47f620b60e537cc0a51decac7b4ca4d2
Instruction Fuzzy Hash: CDE0E536205610ABDA212B64AC09F6A766AFF81720B29022AF9558A1E0EF208C025B60

Function 02AFEBA0 Relevance: 4.6, APIs: 3, Instructions: 84networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,?,-0000001D), ref: 02AFEBD8
htons.WS2_32(00000000), ref: 02AFEC22
bind.WS2_32(?,00000002,-0000001D), ref: 02AFEC46

Part of subcall function 02AFC420: InterlockedIncrement.KERNEL32(02B2100C), ref: 02AFC42C
Part of subcall function 02AFC420: InterlockedIncrement.KERNEL32(02B2100C), ref: 02AFC437

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: IncrementInterlockedbind$htons
String ID:
API String ID: 1901664375-0
Opcode ID: 7ade70d035b1b3cffcae6b9581f5e182346e1031cff404413fe06fbb435ba07a
Instruction ID: df55aca4eb67bffd9aa814405c5e1f95df5bf9f1d3ef19308a8bf25791ef7e0e
Opcode Fuzzy Hash: 7ade70d035b1b3cffcae6b9581f5e182346e1031cff404413fe06fbb435ba07a
Instruction Fuzzy Hash: C821C87290010887CB109FA8E985ABF73E4EB45330B14861AFA15C7191EB79C891C7D1

Function 02AFD850 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 484COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02AFDD48

Strings

[RO] %ld bytes, xrefs: 02AFD8D8, 02AFD9EC, 02AFDA73, 02AFDCCC, 02AFDD90

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _memmove
String ID: [RO] %ld bytes
API String ID: 4104443479-772938740
Opcode ID: 0051ee8411ef247356abc9ed2ea88d0ffeae3f8bc991536f47a776c591779f60
Instruction ID: bfdf4a16eab2e3945a069d20c6d7265e85c3238f3d6b24b79132ecd3539e6ecb
Opcode Fuzzy Hash: 0051ee8411ef247356abc9ed2ea88d0ffeae3f8bc991536f47a776c591779f60
Instruction Fuzzy Hash: E8224970A00B059FDB65CFA9C5C0A9ABBF1FF48304F108A5DEA9A87755DB74E841CB90

Function 001A630C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 001A632C

Strings

H(), xrefs: 001A631B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Iconic
String ID: H()
API String ID: 110040809-2653369260
Opcode ID: 341b2834a0876d245d28c702704eeaca0c285b3263d6390317f04d12ca5aae15
Instruction ID: 92db929d5ddbaef5d6a6f012412b9a176169b536016cf4572aa999aca533be6f
Opcode Fuzzy Hash: 341b2834a0876d245d28c702704eeaca0c285b3263d6390317f04d12ca5aae15
Instruction Fuzzy Hash: F7E0DF323686006B9B256A38B809D3A27D9FFC6B10B15063AF40AC2591DF219C034A60

Function 02AF79A3 Relevance: 1.5, APIs: 1, Instructions: 16shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02AF4A70: GetCurrentProcess.KERNEL32(00000028,?), ref: 02AF4A89
Part of subcall function 02AF4A70: OpenProcessToken.ADVAPI32(00000000), ref: 02AF4A90
Part of subcall function 02AF4A70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02AF4AB6
Part of subcall function 02AF4A70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02AF4ACC
Part of subcall function 02AF4A70: GetLastError.KERNEL32 ref: 02AF4AD2
Part of subcall function 02AF4A70: CloseHandle.KERNEL32(?), ref: 02AF4AE0

ExitWindowsEx.USER32(00000005), ref: 02AF79B0

Part of subcall function 02AF4A70: CloseHandle.KERNEL32(?), ref: 02AF4AFB

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 27dde4cd2e92525563ffb1d018839289509e1a52f9e4e6996e8a706c43a3289e
Instruction ID: 2dd67141c9a784047ae57cda2a270047460b94a9bd40ce66613279e01ffceb1c
Opcode Fuzzy Hash: 27dde4cd2e92525563ffb1d018839289509e1a52f9e4e6996e8a706c43a3289e
Instruction Fuzzy Hash: 07D0C73134424046C56CB7B5745577FB756DBC8351F41456EA70F850C08D1504655955

Function 02AF7972 Relevance: 1.5, APIs: 1, Instructions: 16shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02AF4A70: GetCurrentProcess.KERNEL32(00000028,?), ref: 02AF4A89
Part of subcall function 02AF4A70: OpenProcessToken.ADVAPI32(00000000), ref: 02AF4A90
Part of subcall function 02AF4A70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02AF4AB6
Part of subcall function 02AF4A70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02AF4ACC
Part of subcall function 02AF4A70: GetLastError.KERNEL32 ref: 02AF4AD2
Part of subcall function 02AF4A70: CloseHandle.KERNEL32(?), ref: 02AF4AE0

ExitWindowsEx.USER32(00000006), ref: 02AF797F

Part of subcall function 02AF4A70: CloseHandle.KERNEL32(?), ref: 02AF4AFB

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: b7aa9889c29d9733904c6af0801085e53256b897641e88a9ef1d1fec7dd923ce
Instruction ID: c70e2fd636dfb106f2060d9030601b887a6e81c1ef62739fe7fb8e9e878875f2
Opcode Fuzzy Hash: b7aa9889c29d9733904c6af0801085e53256b897641e88a9ef1d1fec7dd923ce
Instruction Fuzzy Hash: F2D0C73134420046C56CB7B5745577FB753DBC8351F40456EA70F850C08D1604759555

Function 02AF7941 Relevance: 1.5, APIs: 1, Instructions: 16shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02AF4A70: GetCurrentProcess.KERNEL32(00000028,?), ref: 02AF4A89
Part of subcall function 02AF4A70: OpenProcessToken.ADVAPI32(00000000), ref: 02AF4A90
Part of subcall function 02AF4A70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 02AF4AB6
Part of subcall function 02AF4A70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 02AF4ACC
Part of subcall function 02AF4A70: GetLastError.KERNEL32 ref: 02AF4AD2
Part of subcall function 02AF4A70: CloseHandle.KERNEL32(?), ref: 02AF4AE0

ExitWindowsEx.USER32(00000004), ref: 02AF794E

Part of subcall function 02AF4A70: CloseHandle.KERNEL32(?), ref: 02AF4AFB

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 2c086887280acd8d9ce82ca37aabcc3792b2e56e936deab5949e20b10155c81e
Instruction ID: 45ad4249a0495e971c9623bb9b21f6aa90ccb576ef95db9f289456b8bee5280c
Opcode Fuzzy Hash: 2c086887280acd8d9ce82ca37aabcc3792b2e56e936deab5949e20b10155c81e
Instruction Fuzzy Hash: 46D0C73134420046C56CB7B5745577FB752DBC8351F40456EA70F850C08D2504655555

Function 02B137A9 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 02B137A9

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 5d5fbe14e5e7a4234ceba6f89cee2c631d30d3a49a71eaaa1b60c92cbf1db386
Instruction ID: 8a7f7ecd6dcd235f7316b859f7a49a4b37ab16e96b1b00e978c7d9d360416f51
Opcode Fuzzy Hash: 5d5fbe14e5e7a4234ceba6f89cee2c631d30d3a49a71eaaa1b60c92cbf1db386
Instruction Fuzzy Hash: D4C012618A0340CAE3209F28A10A3103FA097002C2B6208E9E00E87182D72018AC8B00

Function 02AF5530 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb89fb342e8428bf7c527ecbb30bb1072a537e57ba8d84d2e77bf4977dd6ed44
Instruction ID: 7a1ab1c6dcb2233754cde9790eb3e3bf70a34262c9060d4f19472b8d623e73a5
Opcode Fuzzy Hash: bb89fb342e8428bf7c527ecbb30bb1072a537e57ba8d84d2e77bf4977dd6ed44
Instruction Fuzzy Hash: 35226277E5151A8BDB08CA95CC515D9B3E3BBC8314B1F9129C819E3305EE78B9478BC0

Function 001D6908 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 323fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001D6912
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000A90,001D6EC6,?,00000000,00000084,001D736D,0000000A,0000000A,0000000A,00000000,00000014,001CF32A), ref: 001D69C1
__wsplitpath_s.LIBCMT ref: 001D69ED
__wsplitpath_s.LIBCMT ref: 001D6A0C
__wmakepath_s.LIBCMT ref: 001D6A39
_wcslen.LIBCMT ref: 001D6A45
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000A90,001D6EC6,?,00000000,00000084,001D736D,0000000A,0000000A), ref: 001D6A7D

Strings

, xrefs: 001D6DB9

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: File__wsplitpath_s$CreateH_prolog3_ModuleName__wmakepath_s_wcslen
String ID:
API String ID: 1221639053-3916222277
Opcode ID: 72381debf9157b96d777e21e4003aed9ab643a4dba2ebbc572a9de5eac990706
Instruction ID: 3bb371c08639b8c98a55298088f7914bb3ac284996665dbcd9c4cfc279cb52e2
Opcode Fuzzy Hash: 72381debf9157b96d777e21e4003aed9ab643a4dba2ebbc572a9de5eac990706
Instruction Fuzzy Hash: 5CD14975A00628AFDF20AF60DC84AADBB79FF1A314F1040EAF549A2651DB305F94DF12

Function 02B0479B Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B047A3
__mtterm.LIBCMT ref: 02B047AF

Part of subcall function 02B0447A: DecodePointer.KERNEL32(00000008,02B029FC,02B029E2,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0448B
Part of subcall function 02B0447A: TlsFree.KERNEL32(0000001E,02B029FC,02B029E2,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B044A5
Part of subcall function 02B0447A: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,02B029FC,02B029E2,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0B8D8
Part of subcall function 02B0447A: _free.LIBCMT ref: 02B0B8DB
Part of subcall function 02B0447A: DeleteCriticalSection.KERNEL32(0000001E,?,?,02B029FC,02B029E2,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0B902

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 02B047C5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 02B047D2
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 02B047DF
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 02B047EC
TlsAlloc.KERNEL32(?,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0483C
TlsSetValue.KERNEL32(00000000,?,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B04857
__init_pointers.LIBCMT ref: 02B04861
EncodePointer.KERNEL32(?,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B04872
EncodePointer.KERNEL32(?,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0487F
EncodePointer.KERNEL32(?,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0488C
EncodePointer.KERNEL32(?,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B04899
DecodePointer.KERNEL32(Function_000145FE,?,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B048BA
__calloc_crt.LIBCMT ref: 02B048CF
DecodePointer.KERNEL32(00000000,?,?,02B02939,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B048E9
GetCurrentThreadId.KERNEL32 ref: 02B048FB

Strings

FlsAlloc, xrefs: 02B047BF
KERNEL32.DLL, xrefs: 02B0479E
FlsSetValue, xrefs: 02B047D4
FlsGetValue, xrefs: 02B047C7
FlsFree, xrefs: 02B047E1

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 5f3de4d0528815200600dc4ba6dda48716b0276fb1321c99a29cb69c510bee6d
Instruction ID: c7676b20af210104f5d08bd9a9d0f585e6c289abd09af3c086eade407fefe0aa
Opcode Fuzzy Hash: 5f3de4d0528815200600dc4ba6dda48716b0276fb1321c99a29cb69c510bee6d
Instruction Fuzzy Hash: 53319471D90310AEDB22EBB9AD946493FB6EF457E07464D6BE508D36A1DB308066CE80

Function 02AF8670 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 170stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF8692
_wcsrchr.LIBCMT ref: 02AF869A
_memset.LIBCMT ref: 02AF86D1
_wcsrchr.LIBCMT ref: 02AF86D9
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 02AF86E6
_memset.LIBCMT ref: 02AF8754
wsprintfW.USER32 ref: 02AF876C
_memset.LIBCMT ref: 02AF8780
_memset.LIBCMT ref: 02AF879B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000002), ref: 02AF87D1
lstrcatW.KERNEL32(?,02B1785C), ref: 02AF8819
lstrcatW.KERNEL32(?,?), ref: 02AF8823
_memset.LIBCMT ref: 02AF883A

Strings

%s\shell\open\command, xrefs: 02AF8766
"%1, xrefs: 02AF87DD
D, xrefs: 02AF8846
WinSta0\Default, xrefs: 02AF8852

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _memset$_wcsrchrlstrcat$EnvironmentExpandStringslstrlenwsprintf
String ID: "%1$%s\shell\open\command$D$WinSta0\Default
API String ID: 3970221696-33419044
Opcode ID: cb27a4bd074b18110d81b4e095b6a06c399cfcaf342fcac1b2af3f51cc908f76
Instruction ID: 528e55c739896ba135df40848bb8537ab6094cb8a64998bdeb8598378fd2164b
Opcode Fuzzy Hash: cb27a4bd074b18110d81b4e095b6a06c399cfcaf342fcac1b2af3f51cc908f76
Instruction Fuzzy Hash: 79512DB2D903196AEB60E7A0CC89FEA7778AF14740F4045D4B609A60C0FF789694CFA5

Function 02AFFC80 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 324threadtimenetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02AFFCB1
GetCurrentThreadId.KERNEL32 ref: 02AFFCC6
__alloca_probe_16.LIBCMT ref: 02AFFD27
CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 02AFFD7F
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF,80004005,?,00000000,000000FF,00000000), ref: 02AFFDE5
_free.LIBCMT ref: 02AFFE0D
_malloc.LIBCMT ref: 02AFFE54

Part of subcall function 02B01DDE: __FF_MSGBANNER.LIBCMT ref: 02B01DF7
Part of subcall function 02B01DDE: __NMSG_WRITE.LIBCMT ref: 02B01DFE
Part of subcall function 02B01DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01E23

_free.LIBCMT ref: 02AFFE6C

Part of subcall function 02B01DA4: HeapFree.KERNEL32(00000000,00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01DBA
Part of subcall function 02B01DA4: GetLastError.KERNEL32(00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000), ref: 02B01DCC

std::exception::exception.LIBCMT ref: 02AFFE8F
__CxxThrowException@8.LIBCMT ref: 02AFFEA4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 02AFFED1
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 02AFFF6E
GetCurrentThreadId.KERNEL32 ref: 02AFFF8C
GetCurrentThreadId.KERNEL32 ref: 02AFFFB5
CloseHandle.KERNEL32(00000000), ref: 02AFFFDA
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 02AFFFF7

Strings

bad allocation, xrefs: 02AFFE88
---------------> Client Worker Thread 0x%08X stoped <---------------, xrefs: 02AFFFB8
---------------> Client Worker Thread 0x%08X started <---------------, xrefs: 02AFFCB4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CurrentThread$ErrorLast$HeapTimerWaitable_free$AllocateCloseCreateEventsException@8FreeHandleMultipleThrowWait__alloca_probe_16_mallocstd::exception::exception
String ID: ---------------> Client Worker Thread 0x%08X started <---------------$---------------> Client Worker Thread 0x%08X stoped <---------------$bad allocation
API String ID: 911687180-800104984
Opcode ID: aa0561629d51affd8bdab39f822e49ca48f8d5234cf1c4c0885c0aad6bc68f84
Instruction ID: a80e0284efc0fa6662986d14271e7809eb179155f0d0834e243bd1d824c67b9a
Opcode Fuzzy Hash: aa0561629d51affd8bdab39f822e49ca48f8d5234cf1c4c0885c0aad6bc68f84
Instruction Fuzzy Hash: D5C17E71A006058FDB60DFA9C980B6EB7F5AF88704F15452AEA45D77C0EB78E900CF91

Function 02AF66A0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 308windowCOMMON

Download Yara Rule

APIs

GdipGetImagePixelFormat.GDIPLUS(02AF62F0,?,?,00000000), ref: 02AF66CB
GdipGetImageHeight.GDIPLUS(02AF62F0,?,?,00000000), ref: 02AF674C
GdipGetImageWidth.GDIPLUS(02AF62F0,?,?,00000000), ref: 02AF6774
GdipGetImagePaletteSize.GDIPLUS(02AF62F0,?,?,00000000), ref: 02AF67CF
__alloca_probe_16.LIBCMT ref: 02AF67F9
_malloc.LIBCMT ref: 02AF6810

Part of subcall function 02B01DDE: __FF_MSGBANNER.LIBCMT ref: 02B01DF7
Part of subcall function 02B01DDE: __NMSG_WRITE.LIBCMT ref: 02B01DFE
Part of subcall function 02B01DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01E23

_free.LIBCMT ref: 02AF6850
GdipGetImagePalette.GDIPLUS(?,00000008,?,80070216,?,00000000), ref: 02AF6878
GdipBitmapLockBits.GDIPLUS(02AF62F0,?,00000001,?,?,?,00000000), ref: 02AF6951
_free.LIBCMT ref: 02AF6973
_memcpy_s.LIBCMT ref: 02AF69C2
GdipBitmapUnlockBits.GDIPLUS(?,?,?,00000000), ref: 02AF6A0F
GdipCreateBitmapFromScan0.GDIPLUS(?,?,02B18294,00022009,?,00000000,?,00000000), ref: 02AF6A6B
GdipGetImageGraphicsContext.GDIPLUS(00000000,00022009,?,00000000), ref: 02AF6A8B
GdipDrawImageI.GDIPLUS(00000000,02AF62F0,00000000,00000000,?,00000000), ref: 02AF6AA6
GdipDeleteGraphics.GDIPLUS(?,?,00000000), ref: 02AF6AB3
GdipDisposeImage.GDIPLUS(00000000,?,00000000), ref: 02AF6ABA
_free.LIBCMT ref: 02AF6AD5

Strings

&, xrefs: 02AF6731

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Gdip$Image$Bitmap_free$BitsGraphicsPalette$AllocateContextCreateDeleteDisposeDrawFormatFromHeapHeightLockPixelScan0SizeUnlockWidth__alloca_probe_16_malloc_memcpy_s
String ID: &
API String ID: 1957643072-3042966939
Opcode ID: 74c51139f377cb90b6e883f204435a69af791e3bbe2574fb824272d9e6139f28
Instruction ID: 18e809a6efdc2e550b10b8a206db681a8afb1326248a1177e59229d3a8f3d76e
Opcode Fuzzy Hash: 74c51139f377cb90b6e883f204435a69af791e3bbe2574fb824272d9e6139f28
Instruction Fuzzy Hash: C9C172F1A002199BDB64DF95D8C0B9AB7B8EF48704F0085ADE719A7201DB74AEC5CF94

Function 02AF3B70 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 146memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(75BF73E0), ref: 02AF3B9A

Part of subcall function 02AF39A0: GetCurrentProcessId.KERNEL32(CD663CB9,00000944,00000000,75BF73E0,00000000,02B1326B,000000FF,?,02AF3BAC,00000000), ref: 02AF39C8
Part of subcall function 02AF39A0: OpenProcess.KERNEL32(00000400,00000000,00000000,?,02AF3BAC,00000000), ref: 02AF39D7
Part of subcall function 02AF39A0: OpenProcessToken.ADVAPI32(00000000,00000008,?,?,02AF3BAC,00000000), ref: 02AF39F0
Part of subcall function 02AF39A0: CloseHandle.KERNEL32(00000000,?,02AF3BAC,00000000), ref: 02AF39FB

_memset.LIBCMT ref: 02AF3BBB
GetVersionExW.KERNEL32(?), ref: 02AF3BD4
GetCurrentProcess.KERNEL32(00000008,?), ref: 02AF3C0B
OpenProcessToken.ADVAPI32(00000000), ref: 02AF3C12
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 02AF3C38
GetLastError.KERNEL32 ref: 02AF3C42
LocalAlloc.KERNEL32(00000040,?), ref: 02AF3C56
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 02AF3C7A
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 02AF3C87
GetSidSubAuthority.ADVAPI32 ref: 02AF3C95
LocalFree.KERNEL32(00000000), ref: 02AF3C9E
CloseHandle.KERNEL32(?), ref: 02AF3CB1
wsprintfW.USER32 ref: 02AF3D27

Strings

%d/None/%s, xrefs: 02AF3CE4
%d/, xrefs: 02AF3D12
%d/, xrefs: 02AF3D21
%d/, xrefs: 02AF3CF3
%d/, xrefs: 02AF3CD5

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocal$AllocCountErrorFreeLastVersion_memsetwsprintf
String ID: %d/$%d/$%d/$%d/$%d/None/%s
API String ID: 982326441-3175268128
Opcode ID: 7003f2b60efeda864575ff1627cacb25535c38b745a2488378e4203a66016f2f
Instruction ID: 899da284eebfa65bdc6f3581d47ca3f36d377319fee8510e52f371e0ffefde86
Opcode Fuzzy Hash: 7003f2b60efeda864575ff1627cacb25535c38b745a2488378e4203a66016f2f
Instruction Fuzzy Hash: 0A51B371A402589FEF609BA0DCC9FEA7778EB49740F4048D9FA0597140DB789EA5CF60

Function 0017E64D Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001827C8: GetWindowLongW.USER32(?,000000F0), ref: 001827D3

GetParent.USER32(?), ref: 0017E687
SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 0017E6A8
GetWindowRect.USER32(?,?), ref: 0017E6C7
GetWindowLongW.USER32(00000000,000000F0), ref: 0017E6F9
MonitorFromWindow.USER32(00000000,00000001), ref: 0017E72D
GetMonitorInfoW.USER32(00000000), ref: 0017E734
CopyRect.USER32(?,?), ref: 0017E748
CopyRect.USER32(?,?), ref: 0017E752
GetWindowRect.USER32(00000000,?), ref: 0017E75B
MonitorFromWindow.USER32(00000000,00000002), ref: 0017E768
GetMonitorInfoW.USER32(00000000), ref: 0017E76F
CopyRect.USER32(?,?), ref: 0017E77D

Strings

(, xrefs: 0017E70F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Rect$Monitor$Copy$FromInfoLong$MessageParentSend
String ID: (
API String ID: 783970248-3887548279
Opcode ID: 8dc2b677584c20be0984b5e51b3e4814ad60b8e70007305e86033d920ac58589
Instruction ID: 1af33a4df9486b22206888083b101d5687f8cf3c8bb93bbac3984dec7770f40b
Opcode Fuzzy Hash: 8dc2b677584c20be0984b5e51b3e4814ad60b8e70007305e86033d920ac58589
Instruction Fuzzy Hash: 326106B5D01229ABCB15DFA8ED889EEBBF9FB48710F244256F505F3250D770A944CBA0

Function 02AF4B80 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 141libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll), ref: 02AF4BC3
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 02AF4BD7
FreeLibrary.KERNEL32(00000000), ref: 02AF4BF7
GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 02AF4C16
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02AF4C53
_memset.LIBCMT ref: 02AF4C7E
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 02AF4C8C
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02AF4CDB
CloseHandle.KERNEL32(?), ref: 02AF4CF9
Sleep.KERNEL32(00000001), ref: 02AF4D01
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 02AF4D0D
FreeLibrary.KERNEL32(00000000), ref: 02AF4D28

Strings

InternetReadFile, xrefs: 02AF4C86
InternetOpenUrlW, xrefs: 02AF4C10
InternetCloseHandle, xrefs: 02AF4D07
wininet.dll, xrefs: 02AF4BA6
MSIE 6.0, xrefs: 02AF4BE1
InternetOpenW, xrefs: 02AF4BD1

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 1463273941-1099148085
Opcode ID: 9c7c88afb79c821671fe0124d46614f53ba9a834d3c03b5c0556761dff27a865
Instruction ID: c476f0261355b76e464aa0b0c546289f3b28838833759f48d6e1ed9115938e84
Opcode Fuzzy Hash: 9c7c88afb79c821671fe0124d46614f53ba9a834d3c03b5c0556761dff27a865
Instruction Fuzzy Hash: E3419471A40218ABE7609BA49C45FDAB7F8BF48700F10C5E9F749A7180DF745A868FE4

Function 02B02910 Relevance: 27.1, APIs: 18, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

__heap_init.LIBCMT ref: 02B02924

Part of subcall function 02B06B9E: HeapCreate.KERNEL32(00000000,00001000,00000000,02B02929,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B06BA7

__RTC_Initialize.LIBCMT ref: 02B02944
GetCommandLineA.KERNEL32(02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B02949
___crtGetEnvironmentStringsA.LIBCMT ref: 02B02954

Part of subcall function 02B07DDE: GetEnvironmentStringsW.KERNEL32(?,?), ref: 02B07DE8

__ioinit.LIBCMT ref: 02B0295E

Part of subcall function 02B07815: GetStartupInfoW.KERNEL32(?), ref: 02B07822
Part of subcall function 02B07815: __calloc_crt.LIBCMT ref: 02B0782E

__ioterm.LIBCMT ref: 02B02997

Part of subcall function 02B07A5A: DeleteCriticalSection.KERNEL32(0000000D,00000000,?,02B029CC,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B07A7D
Part of subcall function 02B07A5A: _free.LIBCMT ref: 02B07A96

__mtterm.LIBCMT ref: 02B02967

Part of subcall function 02B0447A: DecodePointer.KERNEL32(00000008,02B029FC,02B029E2,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0448B
Part of subcall function 02B0447A: TlsFree.KERNEL32(0000001E,02B029FC,02B029E2,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B044A5
Part of subcall function 02B0447A: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,02B029FC,02B029E2,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0B8D8
Part of subcall function 02B0447A: _free.LIBCMT ref: 02B0B8DB
Part of subcall function 02B0447A: DeleteCriticalSection.KERNEL32(0000001E,?,?,02B029FC,02B029E2,02B191B8,00000008,02B02ACD,?,?,?,02B191D8,0000000C,02B02B88,?), ref: 02B0B902

__setargv.LIBCMT ref: 02B0296E
__setenvp.LIBCMT ref: 02B02977
__cinit.LIBCMT ref: 02B02982
__ioterm.LIBCMT ref: 02B029C7
__mtterm.LIBCMT ref: 02B029CC

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalDeleteSection$EnvironmentStrings__ioterm__mtterm_free$CommandCreateDecodeFreeHeapInfoInitializeLinePointerStartup___crt__calloc_crt__cinit__heap_init__ioinit__setargv__setenvp
String ID:
API String ID: 4115978036-0
Opcode ID: 5d0afeb448e89fa1b33e1a90aa62646010d691805f77c97da36a8b04d3e923ae
Instruction ID: 77acb5b587f4196580ef7c8f680a540ef90983d0a829d15b5f4ee70d65485c15
Opcode Fuzzy Hash: 5d0afeb448e89fa1b33e1a90aa62646010d691805f77c97da36a8b04d3e923ae
Instruction Fuzzy Hash: 0031E370D403419ADB337BB599CD76E7EA6EF407A0B105AF6DFA5920C0EF208159CD62

Function 001C4685 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 230windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001C468C
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001C46D7
ClientToScreen.USER32(?,?), ref: 001C470C
_memset.LIBCMT ref: 001C474C
SendMessageW.USER32 ref: 001C476B
SHGetDesktopFolder.SHELL32(?), ref: 001C4793
GetParent.USER32(?), ref: 001C47BB
CreatePopupMenu.USER32 ref: 001C47FD

Strings

$, xrefs: 001C48A5

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$ClientCreateDesktopFolderH_prolog3_MenuParentPopupScreen_memset
String ID: $
API String ID: 937397865-3993045852
Opcode ID: 41c1f64a02eda64915d03756c863ae78e031cb076f5870870625a2b8821c2c27
Instruction ID: ae5adafb30e236b01114e84d2ddeb3192d88a7975334bae785a7e7498827f970
Opcode Fuzzy Hash: 41c1f64a02eda64915d03756c863ae78e031cb076f5870870625a2b8821c2c27
Instruction Fuzzy Hash: FA9138B4A01228AFCB11DFA4C898EAEBBB9FF1D724B244119F505E7250DB71D950CFA0

Function 02AF31E0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 222stringcomregistryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF321B
lstrcatW.KERNEL32(02B23360,02B17834,?,CD663CB9,00000000,000009A8,75BF73E0), ref: 02AF325D
lstrcatW.KERNEL32(02B23360,02B1785C,?,CD663CB9,00000000,000009A8,75BF73E0), ref: 02AF3269
CoCreateInstance.OLE32(02B14500,00000000,00000017,02B18050,?,?,CD663CB9,00000000,000009A8,75BF73E0), ref: 02AF32B0
_memset.LIBCMT ref: 02AF335E
wsprintfW.USER32 ref: 02AF33C6
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 02AF33EF
_memset.LIBCMT ref: 02AF3406

Part of subcall function 02AF30E0: _memset.LIBCMT ref: 02AF310C
Part of subcall function 02AF30E0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 02AF3118

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 02AF33C0

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}
API String ID: 1221949200-4035668053
Opcode ID: 484a506aa5df97236f07e41a12cb2c7cfae233db105a84a275c14903211d85d5
Instruction ID: bee1473fd3561b639dd378d5403562ebd1ab1bae8b2bfc772faee6d7a7641f11
Opcode Fuzzy Hash: 484a506aa5df97236f07e41a12cb2c7cfae233db105a84a275c14903211d85d5
Instruction Fuzzy Hash: FD81BCB1940268AFEB20DB55CC85FAAB778EF48704F4045C8F709A7141DB74AE84CF64

Function 0019E3EF Relevance: 25.0, APIs: 11, Strings: 3, Instructions: 469windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0019E3F9
GetParent.USER32(?), ref: 0019E478
SendMessageW.USER32(?,00000117,?,?), ref: 0019E4DF
GetMenuItemCount.USER32(?), ref: 0019E4EE
_memset.LIBCMT ref: 0019E595

Strings

@, xrefs: 0019E8EF
7, xrefs: 0019E5CB
0, xrefs: 0019E5B2

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CountH_prolog3_ItemMenuMessageParentSend_memset
String ID: 0$7$@
API String ID: 2290845328-3997377745
Opcode ID: c4bd38a24bf70473429773571ec0dda279b6c6810c92ba7574a1e433aebbf82a
Instruction ID: 48c6396540ca601c89a397f551ac29821640179d62bc872047c73bb13a9222e3
Opcode Fuzzy Hash: c4bd38a24bf70473429773571ec0dda279b6c6810c92ba7574a1e433aebbf82a
Instruction Fuzzy Hash: 051255709002299BDF25EFA4CC85BEEBBF5BF58314F1046A9E519A7291DB319E80CF50

Function 001D63CB Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 318windowCOMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 001D63EC
IsRectEmpty.USER32(?), ref: 001D6418
IntersectRect.USER32(?,?,?), ref: 001D6497
IntersectRect.USER32(?,?,?), ref: 001D6533
IsRectEmpty.USER32(?), ref: 001D6571
IsRectEmpty.USER32(?), ref: 001D657F
SelectObject.GDI32(?), ref: 001D6595
IsRectEmpty.USER32(?), ref: 001D65AE
IsRectEmpty.USER32(?), ref: 001D65C6
StretchBlt.GDI32(00000000,?,?,?,?,?,?,?,?,00CC0020), ref: 001D666B
SelectObject.GDI32(?), ref: 001D667C
SetRectEmpty.USER32(?), ref: 001D66F7

Strings

_|%, xrefs: 001D668B, 001D6635, 001D65F9, 001D650F, 001D6539, 001D64F4
_|%, xrefs: 001D63DD

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$IntersectObjectSelect$Stretch
String ID: _|%$_|%
API String ID: 401711590-3171850423
Opcode ID: 3499c4cd6e1dfc2fbc6a23ab91025c1b51e609ec72ca268b1c8a6b97a3e0b358
Instruction ID: 4e62d0f692f9b91bdc6f551073886c2a2de5dd99b1c4eee9bb93d793fcb79ac4
Opcode Fuzzy Hash: 3499c4cd6e1dfc2fbc6a23ab91025c1b51e609ec72ca268b1c8a6b97a3e0b358
Instruction Fuzzy Hash: 4FC1D272A0110AAFCF05CFA8D9849EEBBB9BF48354F15421AF815E7219D734E945CBA0

Function 02AF6F90 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 245COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF6FDF
_memset.LIBCMT ref: 02AF7021
_memset.LIBCMT ref: 02AF70A5
swprintf.LIBCMT ref: 02AF70C4

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

_memset.LIBCMT ref: 02AF7196
swprintf.LIBCMT ref: 02AF71B5
_memset.LIBCMT ref: 02AF7211
swprintf.LIBCMT ref: 02AF7230

Strings

onlyloadinmyself, xrefs: 02AF6FB4
plugmark, xrefs: 02AF6FF6
%s %s, xrefs: 02AF70B3, 02AF7121, 02AF71A4, 02AF721F

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID: %s %s$onlyloadinmyself$plugmark
API String ID: 1873853019-591889663
Opcode ID: df3351f2cf4817ddcca678d3dd1f3fef20ec52fc06b47dfa40c6e9da2c5d8f64
Instruction ID: 6554591a80eb374b9f8b7254cea54ec6a6425ae6f34cd896cc734c58005f6acf
Opcode Fuzzy Hash: df3351f2cf4817ddcca678d3dd1f3fef20ec52fc06b47dfa40c6e9da2c5d8f64
Instruction Fuzzy Hash: AF81C4B1A407017BF214EBA4DCC5F56B7A5AF04314F1442A4FA195B3C2EB71B950CBE1

Function 00174A92 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001748E0: ActivateActCtx.KERNEL32(?,?,002BDF70,00000010,00174AC8,KERNEL32.DLL), ref: 00174900

GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 00174AD7
_memset.LIBCMT ref: 00174B03
_wcstoul.LIBCMT ref: 00174B4B

Part of subcall function 002691D5: wcstoxl.LIBCMT ref: 002691E5

_wcslen.LIBCMT ref: 00174B6C

Part of subcall function 00268FB0: __getptd_noexit.LIBCMT ref: 00268FB0

GetUserDefaultUILanguage.KERNEL32 ref: 00174B7C
ConvertDefaultLocale.KERNEL32(?), ref: 00174BA3
ConvertDefaultLocale.KERNEL32(?), ref: 00174BB2
GetSystemDefaultUILanguage.KERNEL32 ref: 00174BBB
ConvertDefaultLocale.KERNEL32(?), ref: 00174BD7
ConvertDefaultLocale.KERNEL32(?), ref: 00174BE6
GetModuleFileNameW.KERNEL32(00170000,?,00000105), ref: 00174C1E

Strings

KERNEL32.DLL, xrefs: 00174AB6
GetThreadPreferredUILanguages, xrefs: 00174AD1
e, xrefs: 00174B22

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Default$ConvertLocale$Language$ActivateAddressFileModuleNameProcSystemUser__getptd_noexit_memset_wcslen_wcstoulwcstoxl
String ID: GetThreadPreferredUILanguages$KERNEL32.DLL$e
API String ID: 2246399177-2285706205
Opcode ID: 194ab5c05d1059a03b76415a296d145249bf321a2a19eb9b300f0899fd41f365
Instruction ID: 06ea37a3324d1ca334ddea39e85624e569ec42a05915ed03802d5ccd3299ae47
Opcode Fuzzy Hash: 194ab5c05d1059a03b76415a296d145249bf321a2a19eb9b300f0899fd41f365
Instruction Fuzzy Hash: AB41B8759112289BCB22EFA4EC45BAE77BCAF48700F1144BAE90DE7140DB749E85CF50

Function 0017A721 Relevance: 24.2, APIs: 16, Instructions: 245windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0017A728
CreateCompatibleDC.GDI32(00000000), ref: 0017A783
CreateCompatibleDC.GDI32(00000000), ref: 0017A797
CreateCompatibleDC.GDI32(00000000), ref: 0017A7AB
GetObjectW.GDI32(00000004,00000018,?), ref: 0017A7C7
CreateBitmap.GDI32(?,?,?,?,00000000), ref: 0017A7F4
CreateBitmap.GDI32(00000008,00000008,00000001,00000001,0028E0EC), ref: 0017A814
CreatePatternBrush.GDI32(?), ref: 0017A822

Part of subcall function 0017A27D: DeleteObject.GDI32(00000000), ref: 0017A28C

CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0017A844

Part of subcall function 0017A2DA: SelectObject.GDI32(?,?), ref: 0017A2E5

GetPixel.GDI32(?,00000000,00000000), ref: 0017A884

Part of subcall function 001795F0: SetBkColor.GDI32(?,?), ref: 0017960E
Part of subcall function 001795F0: SetBkColor.GDI32(?,?), ref: 0017961B

BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0017A8B0
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00EE0086), ref: 0017A8D4
FillRect.USER32(?,?,?), ref: 0017A938
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0017A968
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 0017A97F
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0017A992

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Create$BitmapCompatibleObject$Color$BrushDeleteFillH_prolog3_PatternPixelRectSelect
String ID:
API String ID: 1818846147-0
Opcode ID: 62ce027d7b820a4623a212588c92b0d9cd78609224d8d19fd4a7fff545b3b79a
Instruction ID: 8c0cf6e00c234989dffbe55228f6ab5cf7f7336163ae290e8eef7680c3a143aa
Opcode Fuzzy Hash: 62ce027d7b820a4623a212588c92b0d9cd78609224d8d19fd4a7fff545b3b79a
Instruction Fuzzy Hash: E891F0B1D00208AEDF11AFE4DD819EEBFB9EF18344F608029F519B61A2DB315E55DB21

Function 001D2AEC Relevance: 24.2, APIs: 16, Instructions: 157windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D2AF3
CreateCompatibleDC.GDI32(00000000), ref: 001D2B29
GetObjectW.GDI32(?,00000018,?), ref: 001D2B40
SelectObject.GDI32(?,?), ref: 001D2B6C
CreateCompatibleBitmap.GDI32(?,?,?), ref: 001D2B8E
SelectObject.GDI32(?,00000000), ref: 001D2BA1
CreateCompatibleDC.GDI32(?), ref: 001D2BB4
SelectObject.GDI32(?,?), ref: 001D2BC5
SelectObject.GDI32(?,00000000), ref: 001D2BD6
DeleteObject.GDI32(?), ref: 001D2BDB
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 001D2C07
GetPixel.GDI32(?,?,?), ref: 001D2C26
SetPixel.GDI32(?,?,?,00000000), ref: 001D2C6D
SelectObject.GDI32(?,?), ref: 001D2C91
SelectObject.GDI32(?,00000000), ref: 001D2C99
DeleteObject.GDI32(?), ref: 001D2CA1

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Object$Select$CompatibleCreate$DeletePixel$BitmapH_prolog3
String ID:
API String ID: 3639146769-0
Opcode ID: 6783e72a655d9771f598610b9947bd4e9770fa24d4a704444a5da2f72108041f
Instruction ID: e1452ac59dd3a041bb4fb414a146bce3d78cf6a51ff889353db915691dcde9a3
Opcode Fuzzy Hash: 6783e72a655d9771f598610b9947bd4e9770fa24d4a704444a5da2f72108041f
Instruction Fuzzy Hash: CC510631801109EBCF16EFA4DD49AEEBF71FF24310F244126E525A22A1DB715E96EF60

Function 02AF9910 Relevance: 22.8, APIs: 15, Instructions: 254COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D), ref: 02AF9923
SetLastError.KERNEL32(000000C1), ref: 02AF9942

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ae4fc76c18c829a0a4a623cc6684ab1d53bbf671802947d4eeff7fd333967b45
Instruction ID: bbcd70d034835e988ff6c9721e7b7af73b6415e65cb0caa04bd015ec827fc40e
Opcode Fuzzy Hash: ae4fc76c18c829a0a4a623cc6684ab1d53bbf671802947d4eeff7fd333967b45
Instruction Fuzzy Hash: 0B81DF727402029BD760DFE5E884B6BB7E4FB48365F004669FA0AD7640EB79E450CBD0

Function 00198914 Relevance: 22.7, APIs: 15, Instructions: 232timeCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0019894A
InflateRect.USER32(?,00000000,00000000), ref: 00198979
SetRectEmpty.USER32(?), ref: 00198A17
SetRectEmpty.USER32(?), ref: 00198A20
GetSystemMetrics.USER32(00000002), ref: 00198A41
KillTimer.USER32(?,00000002), ref: 00198ADB
EqualRect.USER32(?,?), ref: 00198AFD
EqualRect.USER32(?,?), ref: 00198B0E
EqualRect.USER32(?,?), ref: 00198B5F
InvalidateRect.USER32(?,?,00000001), ref: 00198B78
InvalidateRect.USER32(?,?,00000001), ref: 00198B80
EqualRect.USER32(?,?), ref: 00198B94
InvalidateRect.USER32(?,?,00000001), ref: 00198BA7
InvalidateRect.USER32(?,?,00000001), ref: 00198BAF
UpdateWindow.USER32(?), ref: 00198BC2

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$EqualInvalidate$Empty$ClientInflateKillMetricsSystemTimerUpdateWindow
String ID:
API String ID: 2140115980-0
Opcode ID: 9cfa864c26cb78e4d94bc9009cad2962215cf1461b83c099410c03603b72da9a
Instruction ID: 2e27ee77397db184919f93e0dc8e0f48facba356b9f93597236179366ef91754
Opcode Fuzzy Hash: 9cfa864c26cb78e4d94bc9009cad2962215cf1461b83c099410c03603b72da9a
Instruction Fuzzy Hash: 0B91067190021ADFCF11CFA4D988AEE7BB9BF49300F1945BAEC05AB255DB70A941CF61

Function 001A093A Relevance: 22.7, APIs: 15, Instructions: 199windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 001A09A4
GetDlgItem.USER32(?,?), ref: 001A0A2E
ShowWindow.USER32(00000000,00000000), ref: 001A0A39
GetMenu.USER32(?), ref: 001A0A4B
InvalidateRect.USER32(?,00000000,00000001), ref: 001A0A66

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

GetDlgItem.USER32(?,0000E900), ref: 001A0AA3
SetWindowLongW.USER32(00000000,000000F4,0000EA21), ref: 001A0AC0
GetDlgItem.USER32(0000EA21,0000EA21), ref: 001A0AD9
GetDlgItem.USER32(0000E900,0000E900), ref: 001A0AEF
SetWindowLongW.USER32(00000000,000000F4,0000EA21), ref: 001A0B01
SetWindowLongW.USER32(?,000000F4,0000E900), ref: 001A0B0D
InvalidateRect.USER32(00000001,00000000,00000001), ref: 001A0B20
SetMenu.USER32(00000000,00000000), ref: 001A0B37
GetDlgItem.USER32(?,00000000), ref: 001A0B7E
ShowWindow.USER32(?,00000005), ref: 001A0B8C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ItemWindow$Long$InvalidateMenuRectShow$CtrlException@8Throw
String ID:
API String ID: 3179827820-0
Opcode ID: c6cff0fc6b488ea7171d0c61829af4e9cd6a53ef95d1d3eda2c59379bea933a8
Instruction ID: ef9a41dfa4f734ef22f8a850b30e68932a78da39a5e6e2c3a6318154603f8f5f
Opcode Fuzzy Hash: c6cff0fc6b488ea7171d0c61829af4e9cd6a53ef95d1d3eda2c59379bea933a8
Instruction Fuzzy Hash: D6816238600704EFDB229F24C888BAABBF5FF49711F248569F55ADB2A1D731A940CF50

Function 02AF8330 Relevance: 22.7, APIs: 15, Instructions: 176memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,CD663CB9,?,00000000,?), ref: 02AF836E
GlobalLock.KERNEL32(00000000), ref: 02AF837A
_memmove.LIBCMT ref: 02AF8386
GlobalUnlock.KERNEL32(00000000), ref: 02AF838F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 02AF83A5
EnterCriticalSection.KERNEL32(02B21D64), ref: 02AF83E3
LeaveCriticalSection.KERNEL32(02B21D64), ref: 02AF83F4

Part of subcall function 02AF6630: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 02AF6654
Part of subcall function 02AF6630: GdipDisposeImage.GDIPLUS(?), ref: 02AF6668

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 02AF841C

Part of subcall function 02AF6C90: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 02AF6CBD
Part of subcall function 02AF6C90: __alloca_probe_16.LIBCMT ref: 02AF6CEA
Part of subcall function 02AF6C90: _free.LIBCMT ref: 02AF6D33

GetHGlobalFromStream.OLE32(?,?), ref: 02AF843D
GlobalLock.KERNEL32(?), ref: 02AF8447
GlobalFree.KERNEL32(00000000), ref: 02AF845F

Part of subcall function 02AF6490: DeleteObject.GDI32(?), ref: 02AF64C2
Part of subcall function 02AF6490: EnterCriticalSection.KERNEL32(02B21D64,?,?,?,02AF646B), ref: 02AF64D3
Part of subcall function 02AF6490: EnterCriticalSection.KERNEL32(02B21D64,?,?,?,02AF646B), ref: 02AF64E8
Part of subcall function 02AF6490: GdiplusShutdown.GDIPLUS(00000000,?,?,?,02AF646B), ref: 02AF64F4
Part of subcall function 02AF6490: LeaveCriticalSection.KERNEL32(02B21D64,?,?,?,02AF646B), ref: 02AF6505
Part of subcall function 02AF6490: LeaveCriticalSection.KERNEL32(02B21D64,?,?,?,02AF646B), ref: 02AF650C

GlobalSize.KERNEL32(00000000), ref: 02AF8475
_memmove.LIBCMT ref: 02AF848F
GlobalUnlock.KERNEL32(?), ref: 02AF84E8
GlobalFree.KERNEL32(00000000), ref: 02AF8510

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock_memmove$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown__alloca_probe_16_free
String ID:
API String ID: 2067358633-0
Opcode ID: 6610da03f3250c36df9e6e99019c8adc757b55b4749505cc5b766259113210d8
Instruction ID: 2dadd22d26d09f8c56cbda8d42aa5ef72ab930e0d68e43d0796ccef058ec6303
Opcode Fuzzy Hash: 6610da03f3250c36df9e6e99019c8adc757b55b4749505cc5b766259113210d8
Instruction Fuzzy Hash: 0D616BB1D40208EFDB14EFE8D88499EBBB9FF48750F508569F915A7241DB34A941CF90

Function 001F2990 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 410windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 001F2A92
GetCursorPos.USER32(?), ref: 001F2AC1
GetParent.USER32(?), ref: 001F2B29
ReleaseCapture.USER32 ref: 001F2C6D
GetParent.USER32(?), ref: 001F2C7E
SendMessageW.USER32(?,00000363,00000000,00000000), ref: 001F2C94
GetWindowRect.USER32(?,?), ref: 001F2CD9
GetParent.USER32(?), ref: 001F2DB6
InvalidateRect.USER32(?,00000000,00000001,00000000), ref: 001F2DC5
GetParent.USER32(?), ref: 001F2DCE
UpdateWindow.USER32(?), ref: 001F2DD9

Strings

e*, xrefs: 001F2B36

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Parent$Rect$Window$CaptureCursorEmptyInvalidateMessageReleaseSendUpdate
String ID: e*
API String ID: 2800639987-654361256
Opcode ID: cbfdc3eeda0c7907f5cf4be8f98fdb4f7f5f15e5e6eb1972a4bb5f9c9774aa03
Instruction ID: c54feb5aa110260ecf0413b53c682bf9e74cf4fcbc9f9b2ba9fb050878013740
Opcode Fuzzy Hash: cbfdc3eeda0c7907f5cf4be8f98fdb4f7f5f15e5e6eb1972a4bb5f9c9774aa03
Instruction Fuzzy Hash: F1E13B35A01218AFCB15DFA4D888EBDBBB5BF49700F240069FA06EB292DB749D40CF51

Function 0019C733 Relevance: 21.2, APIs: 14, Instructions: 206timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00000001), ref: 0019C744
KillTimer.USER32(?,00000002), ref: 0019C74B
IsWindow.USER32(?), ref: 0019C79B
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0019C7B8
GetCursorPos.USER32(?), ref: 0019C7F5
ScreenToClient.USER32(?,?), ref: 0019C802
KillTimer.USER32(?,00000001), ref: 0019C817
PtInRect.USER32(?,?,?), ref: 0019C846
KillTimer.USER32(?,00000002), ref: 0019C8BB
GetParent.USER32(?), ref: 0019C8D0
PtInRect.USER32(?,?,?), ref: 0019C8FB
KillTimer.USER32(?,00000014), ref: 0019C949
GetClientRect.USER32(?,?), ref: 0019C962
PtInRect.USER32(?,?,?), ref: 0019C972

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: KillTimer$Rect$Client$CursorMessageParentPostScreenWindow
String ID:
API String ID: 2803392424-0
Opcode ID: 6fb6f034badbeffc582ca44498d798d5b904351843edabb748168bc14c35c178
Instruction ID: 04127ddc72fda5cb269c5441a649a311064806477f1f5d0d21e8c5dc27ee0388
Opcode Fuzzy Hash: 6fb6f034badbeffc582ca44498d798d5b904351843edabb748168bc14c35c178
Instruction Fuzzy Hash: F27182356006049FCF219FA8DC88E6EBBB9FF84704F20052AF58A97265DB31AD40DF61

Function 0018A3CB Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018A3D2

Part of subcall function 00174010: _DebugHeapAllocator.LIBCPMTD ref: 00174065

Part of subcall function 0017432D: _malloc.LIBCMT ref: 0017434B

Part of subcall function 001CF2E6: __EH_prolog3.LIBCMT ref: 001CF2ED

Strings

MFCEditBrowse, xrefs: 0018A45E
MFCColorButton, xrefs: 0018A427
MFCLink, xrefs: 0018A4CC
MFCMenuButton, xrefs: 0018A53A
MFCFontComboBox, xrefs: 0018A495
MFCShellList, xrefs: 0018A5A8
MFCButton, xrefs: 0018A3ED
MFCShellTree, xrefs: 0018A5D8
MFCVSListBox, xrefs: 0018A608
MFCPropertyGrid, xrefs: 0018A571
MFCMaskedEdit, xrefs: 0018A503

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$AllocatorDebugHeap_malloc
String ID: MFCButton$MFCColorButton$MFCEditBrowse$MFCFontComboBox$MFCLink$MFCMaskedEdit$MFCMenuButton$MFCPropertyGrid$MFCShellList$MFCShellTree$MFCVSListBox
API String ID: 1248039220-2110171958
Opcode ID: 455c683ae1d8b410b556c68198844e877970ed0853c3a5341ce48b17e513f6f0
Instruction ID: 44378549784bc39e3b7e00517b1e9801b7da5a1042c9601be595fb4788c4ede1
Opcode Fuzzy Hash: 455c683ae1d8b410b556c68198844e877970ed0853c3a5341ce48b17e513f6f0
Instruction Fuzzy Hash: 3951B42060925497EF18FAA8D912BAD77B06F34704FA8802FF51E961C1EB708B51DF97

Function 02AF88B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 164registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF890D
_memset.LIBCMT ref: 02AF891C
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,00000000), ref: 02AF893F

Part of subcall function 02AF8AEE: RegCloseKey.ADVAPI32(80000000,02AF8ACA), ref: 02AF8AFB
Part of subcall function 02AF8AEE: RegCloseKey.ADVAPI32(00000000), ref: 02AF8B04

Strings

%08X, xrefs: 02AF8AA5

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Close_memset$Open
String ID: %08X
API String ID: 4292648718-3773563069
Opcode ID: 15b3b40e2b9c24e260431b9ce79e4a31f45ed953981a85913a9b802e6816b487
Instruction ID: b800e87ecb954bb4f610831443c3c12db07a20e2a10bd85bc3716f4bf40597b8
Opcode Fuzzy Hash: 15b3b40e2b9c24e260431b9ce79e4a31f45ed953981a85913a9b802e6816b487
Instruction Fuzzy Hash: CB5133B1A50218AFEB24EF90CC85FEA7778EB44704F804599F705A7180EB786B54CFA4

Function 0017A4A1 Relevance: 19.7, APIs: 13, Instructions: 209windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017A4A8
GetSysColor.USER32(00000014), ref: 0017A4E5

Part of subcall function 0017A45E: __EH_prolog3.LIBCMT ref: 0017A465
Part of subcall function 0017A45E: CreateSolidBrush.GDI32(00000000), ref: 0017A480

GetSysColor.USER32(00000010), ref: 0017A4F6
CreateCompatibleDC.GDI32(00000000), ref: 0017A50C
CreateCompatibleDC.GDI32(00000000), ref: 0017A520
GetObjectW.GDI32(00000004,00000018,?), ref: 0017A53F
CreateBitmap.GDI32(?,?,?,?,00000000), ref: 0017A564
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0017A582

Part of subcall function 0017A2DA: SelectObject.GDI32(?,?), ref: 0017A2E5

GetPixel.GDI32(?,00000000,00000000), ref: 0017A5C7

Part of subcall function 001795F0: SetBkColor.GDI32(?,?), ref: 0017960E
Part of subcall function 001795F0: SetBkColor.GDI32(?,?), ref: 0017961B

BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0017A5F4
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,001100A6), ref: 0017A619
BitBlt.GDI32(?,00000001,00000001,?,?,?,00000000,00000000,00E20746), ref: 0017A679
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00E20746), ref: 0017A698

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Create$Color$BitmapCompatibleH_prolog3Object$BrushPixelSelectSolid
String ID:
API String ID: 758415642-0
Opcode ID: 9513a384e300cc1d23995023a989b08cb0a3ba53fd92ab3ece64386a3c271943
Instruction ID: 1bef9535744045e5a00ec3f07d847828dd21a355e76259a4bc0f0f1cb33d0121
Opcode Fuzzy Hash: 9513a384e300cc1d23995023a989b08cb0a3ba53fd92ab3ece64386a3c271943
Instruction Fuzzy Hash: 3581EEB1C0010DAEDF05AFE0DC859EEBF7AEF28340F548029F519A61A2DB325E55DB61

Function 02AF39A0 Relevance: 19.7, APIs: 13, Instructions: 169COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(CD663CB9,00000944,00000000,75BF73E0,00000000,02B1326B,000000FF,?,02AF3BAC,00000000), ref: 02AF39C8
OpenProcess.KERNEL32(00000400,00000000,00000000,?,02AF3BAC,00000000), ref: 02AF39D7
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,02AF3BAC,00000000), ref: 02AF39F0
CloseHandle.KERNEL32(00000000,?,02AF3BAC,00000000), ref: 02AF39FB
SysStringLen.OLEAUT32(00000000), ref: 02AF3A4D
SysStringLen.OLEAUT32(00000000), ref: 02AF3A5B
_memmove.LIBCMT ref: 02AF3AAB
CloseHandle.KERNEL32(?), ref: 02AF3ABD
CloseHandle.KERNEL32(?), ref: 02AF3AC3
InterlockedDecrement.KERNEL32(?), ref: 02AF3AED
SysFreeString.OLEAUT32(00000000), ref: 02AF3AFA
InterlockedDecrement.KERNEL32(?), ref: 02AF3B24
SysFreeString.OLEAUT32(00000000), ref: 02AF3B31

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: String$CloseHandleProcess$DecrementFreeInterlockedOpen$CurrentToken_memmove
String ID:
API String ID: 3425131211-0
Opcode ID: 35432ae50d449aa1b586f3fea015033ce8a2adb2712dc49c7b04f71929a03ca2
Instruction ID: 22fb71bb12013b15c4579894e3c4762693a2305e0642e59cde8811de81ee1b0f
Opcode Fuzzy Hash: 35432ae50d449aa1b586f3fea015033ce8a2adb2712dc49c7b04f71929a03ca2
Instruction Fuzzy Hash: 1851B6B2E002459FDF50EFE9D8C4B6EBBB8EB04754F0445A9EA15E7241EB35D910CBA0

Function 001860FA Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 334windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00186104
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 001862D3
_wcspbrk.LIBCMT ref: 0018631C
_wcsrchr.LIBCMT ref: 00186374
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00186448
InvalidateRect.USER32(?,00000000,00000001), ref: 00186463
UpdateWindow.USER32(?), ref: 0018647B
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00186501
InvalidateRect.USER32(?,00000000,00000001), ref: 0018651C
UpdateWindow.USER32(?), ref: 00186534

Strings

:/\, xrefs: 0018630D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$InvalidateRectUpdateWindow$H_prolog3__wcspbrk_wcsrchr
String ID: :/\
API String ID: 2137326823-2793184486
Opcode ID: 3bf5abdd977091f31e10c7ac9c88f03d2a85bdcde921954a7637489983b727ee
Instruction ID: d1721f1324df8e0e7eb956bff682a58819b204e31f6cdc81b32fb73dd719a42c
Opcode Fuzzy Hash: 3bf5abdd977091f31e10c7ac9c88f03d2a85bdcde921954a7637489983b727ee
Instruction Fuzzy Hash: FCD179719105199FCB24EB64CD99AADB7B5FF58300F1042D9F25AA72A2DB30AF84CF11

Function 001B2A7E Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B2A88
_memset.LIBCMT ref: 001B2AA8
_memset.LIBCMT ref: 001B2ABF

Part of subcall function 00174010: _DebugHeapAllocator.LIBCPMTD ref: 00174065

__wsplitpath_s.LIBCMT ref: 001B2B36
_wcslen.LIBCMT ref: 001B2B42

Part of subcall function 00184197: __wcsicoll.LIBCMT ref: 001841B2

Strings

metallic, xrefs: 001B2C30
homestead, xrefs: 001B2C17
normalcolor, xrefs: 001B2BFE
Aero, xrefs: 001B2B71
royale, xrefs: 001B2C6A
Luna, xrefs: 001B2B5D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: _memset$AllocatorDebugH_prolog3_Heap__wcsicoll__wsplitpath_s_wcslen
String ID: Aero$Luna$homestead$metallic$normalcolor$royale
API String ID: 3426151316-2881773410
Opcode ID: 1e6b319bade15c0b7e7a51a83296eca0f4ebbc74480ac3096d4361cd7dd632ad
Instruction ID: fa0d3c179014fe9c61c9c2c27bd919ff724fe674be73fe61f519445b80c99db2
Opcode Fuzzy Hash: 1e6b319bade15c0b7e7a51a83296eca0f4ebbc74480ac3096d4361cd7dd632ad
Instruction Fuzzy Hash: F651C17150012C9ACB24EA64CD81FEE7B79AF65310F0406D5F519A21C2DFB19FE48FA5

Function 02AF3520 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF3552
RegOpenKeyExW.ADVAPI32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 02AF3572
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 02AF35B4
_memset.LIBCMT ref: 02AF35F0
_memset.LIBCMT ref: 02AF361E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,000009A8,00000000,75BF73E0), ref: 02AF364A
lstrlenW.KERNEL32(?,?,?,?,000009A8,00000000,75BF73E0), ref: 02AF3653
lstrlenW.KERNEL32(?,?,?,?,000009A8,00000000,75BF73E0), ref: 02AF3665
RegCloseKey.ADVAPI32(?,000009A8,00000000,75BF73E0), ref: 02AF36B5
lstrlenW.KERNEL32(?), ref: 02AF36C5

Strings

Software\Tencent\Plugin\VAS, xrefs: 02AF3568

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: 91116f44c2606c712bd14366597c75e733870d3b2eee6195346309f0fba1efb5
Instruction ID: 50a82822e479ddb0e26265fa5aaa810ce7d63cb43284560d38c27811b1c56ac2
Opcode Fuzzy Hash: 91116f44c2606c712bd14366597c75e733870d3b2eee6195346309f0fba1efb5
Instruction Fuzzy Hash: D541A3F1E40218AADB60DB94DC85FEA777DEB44700F4044D9F709B7181EB70AA858FA8

Function 00202A14 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00202A1B
GetObjectW.GDI32(00000018,00000018,00298F40), ref: 00202A37
_memmove.LIBCMT ref: 00202A95

Strings

, xrefs: 00202A81

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3Object_memmove
String ID:
API String ID: 107514201-3916222277
Opcode ID: 2b831a3b0ac5498368fc64cdfa38f89dee2ef53c9afe42d27d55d294889ebf0b
Instruction ID: 3bdb3c4f98a8797089e6c44e23895d14287e3e74d34180ae5b1a5b1320e410fd
Opcode Fuzzy Hash: 2b831a3b0ac5498368fc64cdfa38f89dee2ef53c9afe42d27d55d294889ebf0b
Instruction Fuzzy Hash: B7416A71D2021AEFCF15DFA4DC859AEBB75FF14344B20802AE515B72A1DB305E68DBA0

Function 001C6AF0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 001C6B19
LoadCursorW.USER32(?,00007904), ref: 001C6B40
LoadCursorW.USER32(?,00007905), ref: 001C6B62
SendMessageW.USER32(?,0000120A,00000000,00000006), ref: 001C6BA9
SendMessageW.USER32(?,0000120A,00000001,00000006), ref: 001C6BCD
SendMessageW.USER32(?,00000401,00000001,00000000), ref: 001C6C07
SendMessageW.USER32(?,00000418,00000000,FFFFFFFF), ref: 001C6C21
GetParent.USER32(?), ref: 001C6C4B

Strings

Property, xrefs: 001C6B81
d, xrefs: 001C6BB6
Value, xrefs: 001C6BAF

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$CursorLoad$EmptyParentRect
String ID: Property$Value$d
API String ID: 2284761715-1409410049
Opcode ID: 242a89765043026f1f416616e2d4518b3b60ff2b2e0145912ed042d69bcffde8
Instruction ID: 905fab890c29d5191196c6c46bd629bdb165cdcb2973118fd5ad1f40f38a0767
Opcode Fuzzy Hash: 242a89765043026f1f416616e2d4518b3b60ff2b2e0145912ed042d69bcffde8
Instruction Fuzzy Hash: 44516E70A10204AFDB15EF64DD89FAEB7F9EF98304F100569F65AD72A1DB71A900CB50

Function 02AF3346 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 125stringregistryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF335E
wsprintfW.USER32 ref: 02AF33C6
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 02AF33EF
_memset.LIBCMT ref: 02AF3406
RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,?,?,?), ref: 02AF3442
lstrcatW.KERNEL32(02B23360,?), ref: 02AF345E
lstrcatW.KERNEL32(02B23360,02B1785C), ref: 02AF346A
RegCloseKey.ADVAPI32(00000000), ref: 02AF3473
lstrlenW.KERNEL32(02B23360,?,CD663CB9,00000000,000009A8,75BF73E0), ref: 02AF34B7
lstrcatW.KERNEL32(02B23360,02B17B94,?,CD663CB9,00000000,000009A8,75BF73E0), ref: 02AF34CB

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 02AF33C0

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}
API String ID: 1671694837-4035668053
Opcode ID: 223c1f6b786a72c075d7306049e619c91ae689b55c1382f18e6165488eb522fa
Instruction ID: e486211d0ee0d945f6bcfc48811948e9e443bd7ab6a2427eb34632cbdda1c6ae
Opcode Fuzzy Hash: 223c1f6b786a72c075d7306049e619c91ae689b55c1382f18e6165488eb522fa
Instruction Fuzzy Hash: 0C4196F1A00268AADB20DB95CC95FEAB7B8AB48705F4041C8F30D97181DB789B84CF64

Function 02AFEC80 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000030), ref: 02AFEC98
connect.WS2_32(?,?,-0000001D), ref: 02AFECC0
WSAGetLastError.WS2_32 ref: 02AFECD3
connect.WS2_32(?,?,-0000001D), ref: 02AFED07
WSAEventSelect.WS2_32(?,?,00000023), ref: 02AFED20
SetLastError.KERNEL32(00000000), ref: 02AFED3F
GetLastError.KERNEL32 ref: 02AFED56
WSASetLastError.WS2_32(00000000), ref: 02AFED66
send.WS2_32(?,00000000,00000000,00000000), ref: 02AFED7D
WSAGetLastError.WS2_32 ref: 02AFED88

Strings

<C-CNNID: %Iu> send 0 bytes (detect package), xrefs: 02AFED9E

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ErrorLast$EventSelectconnect$send
String ID: <C-CNNID: %Iu> send 0 bytes (detect package)
API String ID: 1826129850-4236689219
Opcode ID: d2a4f1278aabb54f6867a336f9d68d4ab83319498167c1d326865b81185e1854
Instruction ID: 0aea5ae71350c1a334e89bcb4c3fd89e1d4fc00a9822da4b2dd304491cf58e1d
Opcode Fuzzy Hash: d2a4f1278aabb54f6867a336f9d68d4ab83319498167c1d326865b81185e1854
Instruction Fuzzy Hash: 4E3116766007005BE3245BB9EC88A6BB7B9EB84724B104B1CF626C36D0EB78D8518760

Function 001A677B Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 111windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001A6782

Part of subcall function 001A46C9: GetObjectW.GDI32(?,00000054,?), ref: 001A46E8

Part of subcall function 00179FE9: __EH_prolog3.LIBCMT ref: 00179FF0
Part of subcall function 00179FE9: GetDC.USER32(00000000), ref: 0017A01C

CreateCompatibleDC.GDI32(?), ref: 001A67D2
SelectObject.GDI32(?,?), ref: 001A67ED
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000074), ref: 001A681C
GdipDisposeImage.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000074), ref: 001A682F
GdipCreateFromHDC.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 001A683E
GdipSetInterpolationMode.GDIPLUS(?,00000007,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A684F
GdipDeleteGraphics.GDIPLUS(?,?,00000007,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001A6889
GdipDisposeImage.GDIPLUS(?,?,?,00000007,?,?,?,?,?,?,?,?,?,?,?,?), ref: 001A6891
SelectObject.GDI32(?,?), ref: 001A68A1

Strings

,E0, xrefs: 001A67F2

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Gdip$CreateObject$DisposeFromH_prolog3ImageSelect$BitmapCompatibleDeleteGraphicsInterpolationMode
String ID: ,E0
API String ID: 3579439469-1707208058
Opcode ID: d683759647c6eca88007395ad30ae8e78ff41e4b88608c3b70d10d31c53b5ee8
Instruction ID: 18d02d18345e5088b0722e9ef0854af250ec53a9dc39761cdd2a2df60b7ec47f
Opcode Fuzzy Hash: d683759647c6eca88007395ad30ae8e78ff41e4b88608c3b70d10d31c53b5ee8
Instruction Fuzzy Hash: 67417B79C00218EFCF14EFA4C8819EDBBB8BF19300F19856AF905A3251CB749E54CBA0

Function 0019C41B Relevance: 18.3, APIs: 12, Instructions: 257timewindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0019C436
GetCursorPos.USER32(?), ref: 0019C455
ScreenToClient.USER32(?,?), ref: 0019C462
GetParent.USER32(?), ref: 0019C505
SetTimer.USER32(?,00000002,FFFFFFFE,00000000), ref: 0019C55E
InvalidateRect.USER32(?,000000AB,00000001), ref: 0019C56D
UpdateWindow.USER32(?), ref: 0019C576
KillTimer.USER32(00000002,00000002,00000000), ref: 0019C583
KillTimer.USER32(?,00000002), ref: 0019C639
GetParent.USER32(?), ref: 0019C654
GetParent.USER32(?), ref: 0019C6AA
SendMessageW.USER32(?,0000011F,00000000,?), ref: 0019C726

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ParentTimer$KillWindow$ClientCursorInvalidateMessageRectScreenSendUpdate
String ID:
API String ID: 2010726786-0
Opcode ID: 9a0bdc288441bfd910a6f1b62955aabdcead7dbc4482efba17b19557cbfc8b0b
Instruction ID: 92fc06294c4551ed8a18984f88a43819c7a047a0243348b13711828a6719decc
Opcode Fuzzy Hash: 9a0bdc288441bfd910a6f1b62955aabdcead7dbc4482efba17b19557cbfc8b0b
Instruction Fuzzy Hash: 88916D357003019FEF299FA4D858BAA7BB5BF44310F14456DE98A9B2A1DB30ED40DB91

Function 001BA815 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 286keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 001BA833
GetWindowRect.USER32(?,?), ref: 001BA89B
GetCursorPos.USER32(?), ref: 001BA8E5

Strings

|o*, xrefs: 001BA979

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CursorRectStateWindow
String ID: |o*
API String ID: 3412758350-2608133784
Opcode ID: 9e1366224bb3fe3857878dde6426bf5f8b4bea5067b28fd2b008b0941f2744a1
Instruction ID: 7fffae7328a2036681c79786b6a45d21fc1ecee587b6418cc1daf5f553c46fcc
Opcode Fuzzy Hash: 9e1366224bb3fe3857878dde6426bf5f8b4bea5067b28fd2b008b0941f2744a1
Instruction Fuzzy Hash: 98B13771A01209AFCF24EFA4D984AEDBBF6FF49310F64442EE556A7251DB309890CF21

Function 001CE9E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 234windowCOMMON

Download Yara Rule

APIs

RealizePalette.GDI32(?), ref: 001CEA28
InflateRect.USER32(?,000000FE,000000FE), ref: 001CEAFF
InflateRect.USER32(?,000000FF,000000FF), ref: 001CEB1B

Part of subcall function 001CE8AB: __EH_prolog3.LIBCMT ref: 001CE8B2
Part of subcall function 001CE8AB: GetSystemPaletteEntries.GDI32(?,00000000,00000100,00000004), ref: 001CE91A
Part of subcall function 001CE8AB: CreatePalette.GDI32(00000000), ref: 001CE965

InflateRect.USER32(?,000000FF,000000FF), ref: 001CEB37
GetNearestPaletteIndex.GDI32(?,000000FF), ref: 001CEB5A
FillRect.USER32(?,?,?), ref: 001CEB80
InflateRect.USER32(?,000000FE,000000FE), ref: 001CEBA7
FillRect.USER32(?,?), ref: 001CEBF9
InflateRect.USER32(?,000000FF,000000FF), ref: 001CEC40

Strings

iii, xrefs: 001CEB1D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Inflate$Palette$Fill$CreateEntriesH_prolog3IndexNearestRealizeSystem
String ID: iii
API String ID: 1028858568-940974255
Opcode ID: ab01ad5f62c7f83d34e2b76ac658a82f9cbc66a871742a1d62a69f889c403567
Instruction ID: e716a4f3c5de07e473741d41f3f6f93e712662ad285328c53e9ae5cd1df11050
Opcode Fuzzy Hash: ab01ad5f62c7f83d34e2b76ac658a82f9cbc66a871742a1d62a69f889c403567
Instruction Fuzzy Hash: 48912C71900609AFCF01DFA4DD88EAEB7BAFF59320F104269F925A7291CB75A905CF50

Function 001C099F Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001C09B4
SendMessageW.USER32(?,0000104B,00000000,?), ref: 001C09D6
SHGetDesktopFolder.SHELL32(?), ref: 001C0A15
CreatePopupMenu.USER32 ref: 001C0A89
GetMenuDefaultItem.USER32(00000000,00000000,00000000), ref: 001C0AB8
GetParent.USER32(?), ref: 001C0AE5
GetParent.USER32(?), ref: 001C0B2A
GetParent.USER32(?), ref: 001C0B39
SendMessageW.USER32(?,?,00000000,00000000), ref: 001C0B4E

Strings

$, xrefs: 001C0ADB

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Parent$MenuMessageSend$CreateDefaultDesktopFolderItemPopup_memset
String ID: $
API String ID: 2190390364-3993045852
Opcode ID: 44553b757f9854ac23dda14205e6e95a674db48d759de2f6c9efd2d3fba76f58
Instruction ID: 82ab9d3da10400f4bd455d0cdd5176dcc935598c738ee746e9ed332d792b8dc8
Opcode Fuzzy Hash: 44553b757f9854ac23dda14205e6e95a674db48d759de2f6c9efd2d3fba76f58
Instruction Fuzzy Hash: 23510774A00218EFCB11DFA5C888E9EBBB9AF49758F244599F909EB250D771D940CBA0

Function 02AFF570 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 154networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,CD663CB9), ref: 02AFF5B3
LeaveCriticalSection.KERNEL32(?), ref: 02AFF5FE
send.WS2_32(?,?,?,00000000), ref: 02AFF627
EnterCriticalSection.KERNEL32(?), ref: 02AFF63A
LeaveCriticalSection.KERNEL32(?), ref: 02AFF64D
SetLastError.KERNEL32(00000000), ref: 02AFF655
WSAGetLastError.WS2_32 ref: 02AFF6B2
EnterCriticalSection.KERNEL32(?), ref: 02AFF6C6
LeaveCriticalSection.KERNEL32(?), ref: 02AFF6FF

Strings

<C-CNNID: %Iu> OnSend() event should not return 'HR_ERROR' !!, xrefs: 02AFF675

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ErrorLast$send
String ID: <C-CNNID: %Iu> OnSend() event should not return 'HR_ERROR' !!
API String ID: 484515946-1981346945
Opcode ID: c157965f42a8beb56967420b1ff0653ddfbce2248b5a329c654938d98c7c45be
Instruction ID: 6220e4c8dcfd07a2a670be94431dace675a272f50496f5a40f38ff46c354b9d5
Opcode Fuzzy Hash: c157965f42a8beb56967420b1ff0653ddfbce2248b5a329c654938d98c7c45be
Instruction Fuzzy Hash: 30513AB1904604DFD360CFB8D984BAAF7F5FB48315F504A2EEA6AC3690EB34A554CB50

Function 02AF6C90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 02AF6CBD
__alloca_probe_16.LIBCMT ref: 02AF6CEA
_malloc.LIBCMT ref: 02AF6D01
_free.LIBCMT ref: 02AF6D33
GdipGetImageEncoders.GDIPLUS(?,?,00000008,80070216), ref: 02AF6D52
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 02AF6DC4
GdipDisposeImage.GDIPLUS(00000000), ref: 02AF6DCF
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 02AF6DF5
GdipDisposeImage.GDIPLUS(00000000), ref: 02AF6E0D

Strings

&, xrefs: 02AF6DA9

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream__alloca_probe_16_free_malloc
String ID: &
API String ID: 728874743-3042966939
Opcode ID: f9f4d84db091cc9ad37c0bee161f658d5b8d7d116c42df77c901b3e68b5a6e32
Instruction ID: c2c233d086be3dc65af11d82d4f692d08fcdb8cce587edf61102bb7e9c32a41f
Opcode Fuzzy Hash: f9f4d84db091cc9ad37c0bee161f658d5b8d7d116c42df77c901b3e68b5a6e32
Instruction Fuzzy Hash: BB5193B2D002199FDB40DFD4D885AEEB7BDEF48704F044519FA25A7240DB38A905CFA0

Function 001B073B Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 138windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B0742
IsWindowVisible.USER32(?), ref: 001B079B
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 001B07D1
CreateRectRgn.GDI32(00000000,00000000,00000005,00000005), ref: 001B07EC
CreateEllipticRgn.GDI32(00000000,00000000,0000000B,0000000B), ref: 001B0817
CreateRectRgn.GDI32(?,00000000,?,00000005), ref: 001B084B
CreateEllipticRgn.GDI32(?,00000000,?,0000000B), ref: 001B087E

Part of subcall function 0018BAD5: CombineRgn.GDI32(?,?,?,?), ref: 0018BAFA

SetWindowRgn.USER32(?,00000000,00000001), ref: 001B08B0

Strings

H(), xrefs: 001B0774
p.), xrefs: 001B075C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Create$Rect$EllipticWindow$CombineH_prolog3Visible
String ID: H()$p.)
API String ID: 2498130849-4289916727
Opcode ID: 24b10df2e6cf0db554121192c4fe85e0672e5f2f4a4799dcff4b7ba814bfd5a3
Instruction ID: 001bde80f9356bc5148f3e883ac027284673daa6449e6204eb79d0d3a6ecf365
Opcode Fuzzy Hash: 24b10df2e6cf0db554121192c4fe85e0672e5f2f4a4799dcff4b7ba814bfd5a3
Instruction Fuzzy Hash: 06513B72D00209ABCB15EBA0DD96EEFB778EF18300F508229B516B71D1DB346B05CBA1

Function 02AF3820 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02AF2220: InterlockedDecrement.KERNEL32(?), ref: 02AF226C
Part of subcall function 02AF2220: SysFreeString.OLEAUT32(00000000), ref: 02AF2281
Part of subcall function 02AF2220: SysAllocString.OLEAUT32(02B178F0), ref: 02AF22D2

GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,?,?,00000944,00000000), ref: 02AF388B
GetLastError.KERNEL32 ref: 02AF3891
GetProcessHeap.KERNEL32(00000008,?), ref: 02AF38A9
HeapAlloc.KERNEL32(00000000), ref: 02AF38B0
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 02AF38D2
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 02AF3900
GetLastError.KERNEL32 ref: 02AF390A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02AF3979
HeapFree.KERNEL32(00000000), ref: 02AF3980

Strings

NONE_MAPPED, xrefs: 02AF3917

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: 7e5b96c917c3db88eea975b09362c6d8f1ae43f5bba0e767d1e1b7f10eba6025
Instruction ID: 70fdc97e15ccaa81488f4abc7baa98f9699d6ad69a6864c3a7f9f48188b255dd
Opcode Fuzzy Hash: 7e5b96c917c3db88eea975b09362c6d8f1ae43f5bba0e767d1e1b7f10eba6025
Instruction Fuzzy Hash: A041BDB1A40208ABDB60DB94DDC4FEAB779AB84740F0084D9FB09A7240DF749E858F64

Function 02AF8B30 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,AppEvents,00000000,00000002,?), ref: 02AF8B59
RegDeleteValueW.ADVAPI32(?), ref: 02AF8B64
RegCloseKey.ADVAPI32(?), ref: 02AF8B74
RegCreateKeyW.ADVAPI32(80000001,AppEvents,?), ref: 02AF8B93
lstrlenW.KERNEL32(?), ref: 02AF8BA1
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 02AF8BB4
RegCloseKey.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 02AF8BC2
RegCloseKey.ADVAPI32(?), ref: 02AF8BD0

Strings

AppEvents, xrefs: 02AF8B3F, 02AF8B53, 02AF8B7D, 02AF8B8D
Network, xrefs: 02AF8B46, 02AF8B84

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Close$Value$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3935456190-3733486940
Opcode ID: 26b0c4b32771e9e8c44d4a8fa4db5692b360db42ca898b650e75373058ddabf8
Instruction ID: 89b04e92518f4e86dc7d7d123c20ddcbc97b9cba3abba8aad58b71ba5059febc
Opcode Fuzzy Hash: 26b0c4b32771e9e8c44d4a8fa4db5692b360db42ca898b650e75373058ddabf8
Instruction Fuzzy Hash: E91158B6A00204FFE720DBA5DC89FABB77CEB49791F504548FB0193240DA75AE109BA4

Function 001C81C1 Relevance: 16.9, APIs: 11, Instructions: 392COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001C81C8
IsRectEmpty.USER32(?), ref: 001C81DF
FillRect.USER32(?,?,?), ref: 001C82A8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyFillH_prolog3_
String ID:
API String ID: 3863378599-0
Opcode ID: 45599a7e6c257bee16a14daaaba348cddebc52071472b6e7c32b5825d5d05047
Instruction ID: ee06aff4710121a20065854310147e360199e19e3021da1ea42ab638b9bf94d8
Opcode Fuzzy Hash: 45599a7e6c257bee16a14daaaba348cddebc52071472b6e7c32b5825d5d05047
Instruction Fuzzy Hash: 55F1363190061ADFCF05DFA4C988AEEB7B6FF19301F154169E806BB251DB71AA46CF90

Function 001C863C Relevance: 16.7, APIs: 11, Instructions: 223windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001C8643
ClientToScreen.USER32(?,?), ref: 001C867A
GetWindowRect.USER32(?,?), ref: 001C8696
PtInRect.USER32(?,?,?), ref: 001C86A6
IsWindowVisible.USER32(?), ref: 001C86BC
IsWindowVisible.USER32(?), ref: 001C86CC
SetRectEmpty.USER32(?), ref: 001C86D6
GetCapture.USER32 ref: 001C86DF
ReleaseCapture.USER32 ref: 001C86E9
SendMessageW.USER32(?,00000030,?,00000001), ref: 001C88DB
SetCapture.USER32(?), ref: 001C88FF

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CaptureRectWindow$Visible$ClientEmptyH_prolog3_MessageReleaseScreenSend
String ID:
API String ID: 865670441-0
Opcode ID: c3263115e8fad713ea97d82f5e5a749f9e7eddb4993e5eca997644a520ae5183
Instruction ID: 299995c3c41e33154c11666da3c7d03e8d37fd6bc8a02d1b4f609b2f542d38a8
Opcode Fuzzy Hash: c3263115e8fad713ea97d82f5e5a749f9e7eddb4993e5eca997644a520ae5183
Instruction Fuzzy Hash: 27914771800608DFCF26DFA4D888BEDBBB5FF64304F14416EE805AB265DB70A945CB61

Function 0024A0B0 Relevance: 16.7, APIs: 11, Instructions: 168windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,00000000), ref: 0024A0FE
SetRectEmpty.USER32(?), ref: 0024A114
IsRectEmpty.USER32(?), ref: 0024A125
InvalidateRect.USER32(?,00000000,00000001), ref: 0024A242
UpdateWindow.USER32(?), ref: 0024A24B
GetParent.USER32(?), ref: 0024A254
SendMessageW.USER32(?,00000111,?,?), ref: 0024A27D

Part of subcall function 00249DF3: OffsetRect.USER32(?,00000000,?), ref: 00249E2D
Part of subcall function 00249DF3: InflateRect.USER32(?,00000002,00000002), ref: 00249E3B
Part of subcall function 00249DF3: InvalidateRect.USER32(?,?,00000001,?,?,?,0024A0D9,?), ref: 00249E4A
Part of subcall function 00249DF3: UpdateWindow.USER32(?), ref: 00249E53

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyInvalidateUpdateWindow$ClientInflateMessageOffsetParentSend
String ID:
API String ID: 53779109-0
Opcode ID: 3db4f7f19b7d905f59af460f4f44601b29ffa2e0fd3daf1743af07fa56cf5d4f
Instruction ID: b566ccea81ff036b659ba0877aa50feb85441cee0722c3b4c93acfa4e4b9d648
Opcode Fuzzy Hash: 3db4f7f19b7d905f59af460f4f44601b29ffa2e0fd3daf1743af07fa56cf5d4f
Instruction Fuzzy Hash: 18516E71A501199FCF15DFA4D8889EEBBF9FF58700F20012AE90AEB251D7B19941CF61

Function 00178A7B Relevance: 16.6, APIs: 11, Instructions: 149windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00178A85
GetMenuItemCount.USER32(?), ref: 00178AB7
GetSubMenu.USER32(?,?), ref: 00178AFB
GetMenuState.USER32(?,?,00000400), ref: 00178B14
GetSubMenu.USER32(?,?), ref: 00178B83
GetMenuStringW.USER32(?,?,?,00000100,00000400), ref: 00178BA8
_wcslen.LIBCMT ref: 00178BFF
AppendMenuW.USER32(00000000,00000010,00000000,?), ref: 00178C2D
GetMenuItemCount.USER32(00000000), ref: 00178C6C
GetMenuItemID.USER32(?,?), ref: 00178CA5
InsertMenuW.USER32(?,?,00000000,00000000), ref: 00178CBB

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$AppendH_prolog3_InsertStateString_wcslen
String ID:
API String ID: 881407318-0
Opcode ID: 0c7cc68704c830d90fa560a9d406156bb125ac105339b85bf54b805fdb918ad6
Instruction ID: a4c7c47211647286a6a2542896850958fff0fafab9ef18a4453791033932f575
Opcode Fuzzy Hash: 0c7cc68704c830d90fa560a9d406156bb125ac105339b85bf54b805fdb918ad6
Instruction Fuzzy Hash: 8171C375882229AFCB259F54DC8CBD9B7B4FB18311F2081E9E50DA6261DB309ED0CF60

Function 001783B9 Relevance: 16.6, APIs: 11, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 001783C0
FindResourceW.KERNEL32(?,?,00000005,00000024,001DE5BC,?,?,?), ref: 001783F6
LoadResource.KERNEL32(?,00000000,?,?), ref: 001783FE

Part of subcall function 0017EE40: UnhookWindowsHookEx.USER32(?), ref: 0017EE70

LockResource.KERNEL32(?,00000024,001DE5BC,?,?,?), ref: 0017840F
GetDesktopWindow.USER32 ref: 00178442
IsWindowEnabled.USER32(?), ref: 00178450
EnableWindow.USER32(?,00000000), ref: 0017845F

Part of subcall function 00182946: IsWindowEnabled.USER32(?), ref: 0018294F

Part of subcall function 00182961: EnableWindow.USER32(?,?), ref: 00182972

EnableWindow.USER32(?,00000001), ref: 00178544
GetActiveWindow.USER32 ref: 0017854F
SetActiveWindow.USER32(?,?,00000024,001DE5BC,?,?,?), ref: 0017855D
FreeResource.KERNEL32(?,?,00000024,001DE5BC,?,?,?), ref: 00178579

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 0af1b47c7f3510452db0acbe3c28a75c1ae01b86c5b5e0c7f952fbc65842037e
Instruction ID: 15f84543e4dab1359b5ab654231f068592d42f54075f42de6fa630ac46ce2042
Opcode Fuzzy Hash: 0af1b47c7f3510452db0acbe3c28a75c1ae01b86c5b5e0c7f952fbc65842037e
Instruction Fuzzy Hash: 2D517030A40605CFDF21AFB4D88D7AEBAF5BF58711F248029E50AB62A1DF754A41CF61

Function 001C6661 Relevance: 16.6, APIs: 11, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 001C669D
ReleaseCapture.USER32 ref: 001C66A7
GetClientRect.USER32(?,?), ref: 001C66C0
GetSystemMetrics.USER32(00000015), ref: 001C66E7
GetSystemMetrics.USER32(00000015), ref: 001C670B
SendMessageW.USER32(?,0000120C,00000000,00000001), ref: 001C6744
SendMessageW.USER32(?,0000120C,00000001,00000001), ref: 001C6766
GetCapture.USER32 ref: 001C678B
ReleaseCapture.USER32 ref: 001C6795
GetClientRect.USER32(?,?), ref: 001C67AE
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 001C67FC

Part of subcall function 001C59C1: __EH_prolog3_GS.LIBCMT ref: 001C59C8
Part of subcall function 001C59C1: IsRectEmpty.USER32(?), ref: 001C59E3
Part of subcall function 001C59C1: InvertRect.USER32(?,?), ref: 001C59F9
Part of subcall function 001C59C1: SetRectEmpty.USER32(?), ref: 001C5A07

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Capture$ClientEmptyMessageMetricsReleaseSendSystem$H_prolog3_InvertRedrawWindow
String ID:
API String ID: 174338775-0
Opcode ID: 73a0e55ce8c631573f3d1d801e44e1d60c576fa4c2d937286aff45d81081f789
Instruction ID: d04bd93c44f621f070097090bdece04a411c05f8f61ca6795433502f63ab5ee0
Opcode Fuzzy Hash: 73a0e55ce8c631573f3d1d801e44e1d60c576fa4c2d937286aff45d81081f789
Instruction Fuzzy Hash: F4512C75A00609DFCB11DFA8DD88AAEBBB5FF98304F21452DE456A7251D770A940CF50

Function 001E6193 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 239windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 001E61C2
IsWindowVisible.USER32(?), ref: 001E61D1
GetWindowRect.USER32(?,?), ref: 001E6223
IsZoomed.USER32(?), ref: 001E6232
SetWindowRgn.USER32(?,00000000,00000001), ref: 001E629F
_memset.LIBCMT ref: 001E62BF
GetSystemMetrics.USER32(00000004), ref: 001E6309
_memset.LIBCMT ref: 001E63DA

Strings

C:\Windows\System32\GDI32.dll, xrefs: 001E6261, 001E6276, 001E6373, 001E6389

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Visible_memset$MetricsRectSystemZoomed
String ID: C:\Windows\System32\GDI32.dll
API String ID: 3274878110-3238924417
Opcode ID: a00c6554141df8b56583b693bd6507b45065d3620f0375cb287b9d6036004cf7
Instruction ID: aa2de03db183732059973840f50c0d6603038f753c8471f1c060f8cda85ed892
Opcode Fuzzy Hash: a00c6554141df8b56583b693bd6507b45065d3620f0375cb287b9d6036004cf7
Instruction Fuzzy Hash: E4917BB0E00258DFCF15DFA9C884AAEBBB9FF58740F540169F909AB256C730A901CF61

Function 02AF72F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

%s_bin, xrefs: 02AF73E5

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID:
String ID: %s_bin
API String ID: 0-2665034546
Opcode ID: fdf0d45f23c1616e28e9d84bf5a618a3bc7e6edec2dbad9315a3518db5e83f27
Instruction ID: e943bb8e156574adf0975c46d7e96e2ef342a4620c6dd181e92d7185c1342b13
Opcode Fuzzy Hash: fdf0d45f23c1616e28e9d84bf5a618a3bc7e6edec2dbad9315a3518db5e83f27
Instruction Fuzzy Hash: 4C8168B1A003009FE754EF64DC81B26B7E6EF94710F0544A9FA1A9B2C1EB74E904CB92

Function 001A23F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001A23F7

Part of subcall function 001827C8: GetWindowLongW.USER32(?,000000F0), ref: 001827D3

swprintf.LIBCMT ref: 001A2441
_wcslen.LIBCMT ref: 001A244A

Part of subcall function 001750CC: _wcsnlen.LIBCMT ref: 00175100
Part of subcall function 001750CC: _wmemcpy_s.LIBCPMTD ref: 00175134

_wcslen.LIBCMT ref: 001A2465
_wcslen.LIBCMT ref: 001A249C
swprintf.LIBCMT ref: 001A24C8
_wcslen.LIBCMT ref: 001A24D1

Part of subcall function 0017538E: _wcslen.LIBCMT ref: 001753A0

Strings

- , xrefs: 001A245F, 001A2464, 001A246C, 001A2496, 001A249B, 001A24A3
:%d, xrefs: 001A2436, 001A24BD

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: _wcslen$swprintf$H_prolog3_LongWindow_wcsnlen_wmemcpy_s
String ID: - $:%d
API String ID: 472068148-2359489159
Opcode ID: 59d4ce4e4997667736317951bd3f6993c1bc9f8f581449a2807e128afce2528c
Instruction ID: 40ab355ab5f40383826903f8b084919921f5b74444470b76d6094bdba249f060
Opcode Fuzzy Hash: 59d4ce4e4997667736317951bd3f6993c1bc9f8f581449a2807e128afce2528c
Instruction Fuzzy Hash: 353175B2910605ABDB15FBE0CC86EEEB37CBF25300F048515F506AB056DF74AE188BA0

Function 02AF8BE0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 02AF8BED
_memmove.LIBCMT ref: 02AF8C1F
_wcsrchr.LIBCMT ref: 02AF8C27

Part of subcall function 02AF4B80: LoadLibraryW.KERNEL32(wininet.dll), ref: 02AF4BC3
Part of subcall function 02AF4B80: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 02AF4BD7
Part of subcall function 02AF4B80: FreeLibrary.KERNEL32(00000000), ref: 02AF4BF7

GetFileAttributesW.KERNEL32(-00000002), ref: 02AF8C46
GetLastError.KERNEL32 ref: 02AF8C51
_memset.LIBCMT ref: 02AF8C64
CreateProcessW.KERNEL32(00000000,-00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 02AF8C91

Strings

WinSta0\Default, xrefs: 02AF8C8A
D, xrefs: 02AF8C83

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Library$AddressAttributesCreateErrorFileFreeLastLoadProcProcess_memmove_memset_wcsrchrlstrlen
String ID: D$WinSta0\Default
API String ID: 4287160851-1101385590
Opcode ID: 8f1ad062e0cbd17f2651f8143898a05e234845dac25e24473f47a2abab4f5172
Instruction ID: bf9b004e2f2ef4193c5a5a6438fe4a3c18fd115129909fd7ef80e44b1e80f7a7
Opcode Fuzzy Hash: 8f1ad062e0cbd17f2651f8143898a05e234845dac25e24473f47a2abab4f5172
Instruction Fuzzy Hash: 2B115BB3D411042BD321A7E5AC89FBF7B7DAB51354F000165FA06EA1C0EA3D981686E1

Function 02AFA8E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AFA901
GetForegroundWindow.USER32(?,74DEE010,74DF23A0), ref: 02AFA909
GetWindowTextW.USER32(00000000,02B22B48,00000800), ref: 02AFA91F
_memset.LIBCMT ref: 02AFA93D
lstrlenW.KERNEL32(02B22B48,?,?,?,?,74DEE010,74DF23A0), ref: 02AFA95C
GetLocalTime.KERNEL32(?,?,?,?,?,74DEE010,74DF23A0), ref: 02AFA96D
wsprintfW.USER32 ref: 02AFA9B4

Part of subcall function 02AFA860: WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?,02AFA9C5,?,?,?,?,74DEE010,74DF23A0), ref: 02AFA86D
Part of subcall function 02AFA860: CreateFileW.KERNEL32(02B221E8,40000000,00000002,00000000,00000004,00000080,00000000,?,?,02AFA9C5,?,?,?,?,74DEE010,74DF23A0), ref: 02AFA88A
Part of subcall function 02AFA860: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 02AFA8A0
Part of subcall function 02AFA860: lstrlenW.KERNEL32(?,00000000,00000000), ref: 02AFA8AD
Part of subcall function 02AFA860: WriteFile.KERNEL32(00000000,?,00000000), ref: 02AFA8B8
Part of subcall function 02AFA860: CloseHandle.KERNEL32(00000000), ref: 02AFA8BF
Part of subcall function 02AFA860: ReleaseMutex.KERNEL32(?), ref: 02AFA8CC

_memset.LIBCMT ref: 02AFA9D0

Strings

[, xrefs: 02AFA9AE

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: File_memset$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 2192163267-4056885943
Opcode ID: 2873177f7135a95906bd7a0064e6e6fc87ed9ee58655e1cd71ddccbe47a549a6
Instruction ID: d67393d0d7a2382b2f0b57066953079360a54f8b140a6db75256c74429498356
Opcode Fuzzy Hash: 2873177f7135a95906bd7a0064e6e6fc87ed9ee58655e1cd71ddccbe47a549a6
Instruction Fuzzy Hash: B821E771D80228A6EB649F649C99BAAB7F8FF04700F4084E5BC89D3150EF7459A9CFD0

Function 001F80E2 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51sleepthreadCOMMON

Download Yara Rule

APIs

PlaySoundW.WINMM(MenuCommand,00000000,00012002), ref: 001F8112
Sleep.KERNEL32(00000005), ref: 001F811C
PlaySoundW.WINMM(00000000,00000000,00000040), ref: 001F8131
__getptd_noexit.LIBCMT ref: 0026CDE4
CloseHandle.KERNEL32(?), ref: 0026CDF8
__freeptd.LIBCMT ref: 0026CDFF
ExitThread.KERNEL32 ref: 0026CE07

Strings

MenuCommand, xrefs: 001F810D
MenuPopup, xrefs: 001F8104

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: PlaySound$CloseExitHandleSleepThread__freeptd__getptd_noexit
String ID: MenuCommand$MenuPopup
API String ID: 3964878549-2036262055
Opcode ID: 29747da82f2ed85090aef2187b998b67e0857cc9761f99acabe0e0a6ed8e7a78
Instruction ID: 38f495a4f17bc1c9f201a004981b20758f49ff82cfaaa7aa8c712dc93fde8fef
Opcode Fuzzy Hash: 29747da82f2ed85090aef2187b998b67e0857cc9761f99acabe0e0a6ed8e7a78
Instruction Fuzzy Hash: F101FD716165297ED6202B78BCCAE3B2A5DDB45774B31031AF225D31E0CB708C928BB0

Function 0024AB90 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 36windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0024AB97
DestroyIcon.USER32(?,00000004,001DE358,00000004,001DE5D7,?,?,?), ref: 0024ABBA
DestroyIcon.USER32(?,?,?), ref: 0024ABC2
DestroyIcon.USER32(?,?,?), ref: 0024ABCA
DestroyIcon.USER32(?,?,?), ref: 0024ABD2
DestroyIcon.USER32(?,?,?), ref: 0024ABDA
DestroyIcon.USER32(?,?,?), ref: 0024ABE2

Part of subcall function 00179FD0: DeleteDC.GDI32(00000000), ref: 00179FE2

~_Task_impl.LIBCPMT ref: 0024AC1C

Part of subcall function 002001CC: __EH_prolog3.LIBCMT ref: 002001D3

Strings

(, xrefs: 0024ABEA

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: DestroyIcon$H_prolog3$DeleteTask_impl
String ID: (
API String ID: 3077829688-1334834377
Opcode ID: 62a52fda30cc37bfa8d1f97073eeeb17b745415ffcfd33db7f6ae22c67f1209c
Instruction ID: 64e5c0f8de207956e7bbfee0f8e8e8ede348ccfbbf879d8e221ce8e023e2d136
Opcode Fuzzy Hash: 62a52fda30cc37bfa8d1f97073eeeb17b745415ffcfd33db7f6ae22c67f1209c
Instruction Fuzzy Hash: 47017C74022784DBCB21BF30CC05B9EBEB2AF81300F11855CE0AA032A1CF712A55EF12

Function 001F67C4 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 325windowstringCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001F67CE
GetMenuItemCount.USER32(0000000D), ref: 001F6817
GetMenuItemID.USER32(0000000D,?), ref: 001F683A

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Part of subcall function 001DA2FA: __EH_prolog3.LIBCMT ref: 001DA301

Part of subcall function 00174010: _DebugHeapAllocator.LIBCPMTD ref: 00174065

Part of subcall function 001832B4: __EH_prolog3.LIBCMT ref: 001832BB

lstrlenW.KERNEL32(00000000,?), ref: 001F695C
CharUpperBuffW.USER32(00000002,00000001), ref: 001F6971
lstrlenW.KERNEL32(00000000), ref: 001F6979
GetSubMenu.USER32(00000000,?), ref: 001F6AAB

Strings

H(), xrefs: 001F6C55

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Menu$H_prolog3Itemlstrlen$AllocatorBuffCharCountDebugException@8H_prolog3_HeapThrowUpper
String ID: H()
API String ID: 3129970023-2653369260
Opcode ID: b2b2e7b0ecbc3bee052fe6f025d8f680903dc7572a9b00dbf9cfae193640fe01
Instruction ID: 589123ef52161e0c2f9dc13efbbc7717d297e193b38476d20ed4ede3aed5ddb1
Opcode Fuzzy Hash: b2b2e7b0ecbc3bee052fe6f025d8f680903dc7572a9b00dbf9cfae193640fe01
Instruction Fuzzy Hash: 8ED16431900228ABCF25EB64CC55BEDB774AF29324F5482D9E269A32D1DB305F84DF51

Function 00200A63 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00200ADD
IsWindow.USER32(?), ref: 00200B16
GetWindowPlacement.USER32(?,?), ref: 00200B54
ShowWindow.USER32(?,00000009), ref: 00200B63
PostMessageW.USER32(?,00000111,0000FF00,00000000), ref: 00200B7B
SendMessageW.USER32(?,00000111,0000FF00,00000000), ref: 00200B83

Strings

H(), xrefs: 00200B33
,, xrefs: 00200B4D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Message$ParentPlacementPostSendShow
String ID: ,$H()
API String ID: 3417538037-2351294415
Opcode ID: 4155e74b2a55c930d1196220767cf2cc1fd6f9d251cbcaf5eae61da7b61f1aed
Instruction ID: 3e8ae5d780573995c5b5b7b4b1d5cb3406e88cb0f48c886db40b77c651a8c429
Opcode Fuzzy Hash: 4155e74b2a55c930d1196220767cf2cc1fd6f9d251cbcaf5eae61da7b61f1aed
Instruction Fuzzy Hash: C7416370A20705DFEB319F64D8C8A6EBBF9FF94714F24092AE152925A2DB719C50CB50

Function 02AF7DF0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

_memset.LIBCMT ref: 02AF7E11
GetLastInputInfo.USER32(?), ref: 02AF7E26
GetTickCount.KERNEL32 ref: 02AF7E2C
wsprintfW.USER32 ref: 02AF7E55
GetForegroundWindow.USER32 ref: 02AF7E5E
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 02AF7E72
_memmove.LIBCMT ref: 02AF7EF0

Strings

%d min, xrefs: 02AF7E4F

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memmove_memsetwsprintf
String ID: %d min
API String ID: 2941202404-1947832151
Opcode ID: ae06796348c401769d09a7ee47bd0902f0dd438ef5e9a699a6e7ec5753a68df0
Instruction ID: 4dc6820d47f3ffa41ea3c1d5028d67898477201982499d1bfb277075b0561f78
Opcode Fuzzy Hash: ae06796348c401769d09a7ee47bd0902f0dd438ef5e9a699a6e7ec5753a68df0
Instruction Fuzzy Hash: 8B31A2B5D40209AFD704DFA4DCC8DAFBBB9EF58300F448569E90997340EA30A951CBE1

Function 02AF8540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF857D
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 02AF859B
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02AF85D8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 02AF85E3
lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 02AF85F0
wsprintfW.USER32 ref: 02AF8614

Strings

%s %s, xrefs: 02AF860E

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: File$CloseCreateHandleWrite_memsetlstrlenwsprintf
String ID: %s %s
API String ID: 1326869720-2939940506
Opcode ID: d337e57c954cfbb19f6b0371b6ca8b1ee4e45d9e8b30db3fef47ae2277c95279
Instruction ID: 0d4d097c4f47853538281381267e9ae05b15568df8bfa05a05233e793fd0647b
Opcode Fuzzy Hash: d337e57c954cfbb19f6b0371b6ca8b1ee4e45d9e8b30db3fef47ae2277c95279
Instruction Fuzzy Hash: 9B310172A402186FDB60DBA4EC84FEA7779AB04701F40059AB605A71C0EB786E94CFA1

Function 0018097D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 001809CB
SetActiveWindow.USER32(?), ref: 001809DD
SendMessageW.USER32(?,00000112,?,?), ref: 001809F3
IsWindow.USER32(?), ref: 00180A00
SetActiveWindow.USER32(?), ref: 00180A07
IsWindow.USER32(?), ref: 00180A0C
SetFocus.USER32(?), ref: 00180A16

Strings

u, xrefs: 00180A1E

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$ActiveFocus$MessageSend
String ID: u
API String ID: 1556911595-4067256894
Opcode ID: a8da7e143b1621eaac5f6ed01a9c048ebae6fce84ed61654ccb9c067a6868ad1
Instruction ID: 51cbcce055a6131b19f2dbbbd78da2cbc4e24c4db063926e34c645802b7b255c
Opcode Fuzzy Hash: a8da7e143b1621eaac5f6ed01a9c048ebae6fce84ed61654ccb9c067a6868ad1
Instruction Fuzzy Hash: 5811033290131DABDB6A7BB8CC08A6E7BA8EF4C310F124025E806931A5DB74CF04DF90

Function 0024CBA9 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0024CBB0

Part of subcall function 0018872C: EnterCriticalSection.KERNEL32(00300170,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188766
Part of subcall function 0018872C: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188778
Part of subcall function 0018872C: LeaveCriticalSection.KERNEL32(00300170,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188785
Part of subcall function 0018872C: EnterCriticalSection.KERNEL32(?,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188795

GetProfileIntW.KERNEL32(windows,DragScrollInset,0000000B), ref: 0024CC00
GetProfileIntW.KERNEL32(windows,DragScrollDelay,00000032), ref: 0024CC0F
GetProfileIntW.KERNEL32(windows,DragScrollInterval,00000032), ref: 0024CC1E

Strings

windows, xrefs: 0024CBFA, 0024CBFF, 0024CC09, 0024CC18
DragScrollInterval, xrefs: 0024CC13
DragScrollDelay, xrefs: 0024CC04
DragScrollInset, xrefs: 0024CBF5

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CriticalSection$Profile$Enter$H_prolog3InitializeLeave
String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$windows
API String ID: 4229786687-1024936294
Opcode ID: 59fb5e9ad6ccc0050b09179e2dfff98af42ed38479e7b0d952718032773b2f34
Instruction ID: fbfdea5cec153efc01369bdfb3db8245a468a19167210f208169af1d8edf56d2
Opcode Fuzzy Hash: 59fb5e9ad6ccc0050b09179e2dfff98af42ed38479e7b0d952718032773b2f34
Instruction Fuzzy Hash: 8901A2B19923009BD721EF66DC4670AB6E8BFA5B00F90061BF2889B2E1CBF54560CF15

Function 001A68D0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001A68DA
GetWindowRect.USER32(?,?), ref: 001A6929
OffsetRect.USER32(?,?,?), ref: 001A693F

Part of subcall function 00179FE9: __EH_prolog3.LIBCMT ref: 00179FF0
Part of subcall function 00179FE9: GetDC.USER32(00000000), ref: 0017A01C

CreateCompatibleDC.GDI32(?), ref: 001A69B0
SelectObject.GDI32(?,?), ref: 001A69D0
SelectObject.GDI32(?,?), ref: 001A6A12
CreateCompatibleDC.GDI32(?), ref: 001A6B2B
SelectObject.GDI32(?,?), ref: 001A6B4B
SelectObject.GDI32(?,00000000), ref: 001A6B7B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ObjectSelect$CompatibleCreateRect$H_prolog3H_prolog3_OffsetWindow
String ID:
API String ID: 2818906880-0
Opcode ID: 313d516da3138a4d00a8899ae5f6db0d552bafd11f999056ce6d5f60fd75330b
Instruction ID: 8768b63fbec164195f050a7613c7dc6a27f1bd65508a8ea7ddfc4fb4a9260944
Opcode Fuzzy Hash: 313d516da3138a4d00a8899ae5f6db0d552bafd11f999056ce6d5f60fd75330b
Instruction Fuzzy Hash: A4A1F175D0021AEFCF15EFA4C985AEDBBB5BF19300F2481AAE909B7251DB305E45CB60

Function 02B009B0 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,CD663CB9), ref: 02B009E6
EnterCriticalSection.KERNEL32(?,CD663CB9), ref: 02B00A0D
SetLastError.KERNEL32(0000139F), ref: 02B00A21
LeaveCriticalSection.KERNEL32(?), ref: 02B00A28

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 2d955730a591579d1953e7cec96d98119aaa111659fefc68ca2f036e13a5d9d5
Instruction ID: 0573f247552f575d7532a86c57b68fb465a173604ab7ced791cdadcec9a79bf9
Opcode Fuzzy Hash: 2d955730a591579d1953e7cec96d98119aaa111659fefc68ca2f036e13a5d9d5
Instruction Fuzzy Hash: 9851D072A442009FC724EFA9D885B6AFBF5FB48701F00496EE50AD7780EB34A910CB90

Function 0017AAA9 Relevance: 13.7, APIs: 9, Instructions: 158windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0017AAD7

Part of subcall function 00198BDB: GetClientRect.USER32(?,?), ref: 00198C0C
Part of subcall function 00198BDB: PtInRect.USER32(?,?,?), ref: 00198C26

ScreenToClient.USER32(?,?), ref: 0017AB49
PtInRect.USER32(?,?,?), ref: 0017AB59
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0017AB85
GetParent.USER32(?), ref: 0017ABA4
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0017AC0D
GetFocus.USER32 ref: 0017AC13
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0017AC50
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0017AC74

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Rect$Client$FocusParentScreenWindow
String ID:
API String ID: 4216724418-0
Opcode ID: df4b6425f979246c9cbadd8287e658023dcdcbfe03894b2014e2c1e058d4b747
Instruction ID: 4fcd9b867cd362cf49fbe14564ae82d117e0e5225fd8d08eb809387984dbb6f5
Opcode Fuzzy Hash: df4b6425f979246c9cbadd8287e658023dcdcbfe03894b2014e2c1e058d4b747
Instruction Fuzzy Hash: 36516B76641208AFDB26DF64D989A6D77F9EF88300F548166F909DB261EB30ED00CB52

Function 001A042D Relevance: 13.6, APIs: 9, Instructions: 150windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00183661: GetFocus.USER32 ref: 00183667
Part of subcall function 00183661: GetParent.USER32(00000000), ref: 0018368F
Part of subcall function 00183661: GetWindowLongW.USER32(?,000000F0), ref: 001836AA
Part of subcall function 00183661: GetParent.USER32(?), ref: 001836B8
Part of subcall function 00183661: GetDesktopWindow.USER32 ref: 001836BC
Part of subcall function 00183661: SendMessageW.USER32(00000000,0000014F,00000000,00000000), ref: 001836D0

GetMenu.USER32(?), ref: 001A04A7
GetMenuItemCount.USER32(?), ref: 001A04D7
GetSubMenu.USER32(?,00000000), ref: 001A04E8
GetMenuItemCount.USER32(?), ref: 001A050A
GetMenuItemID.USER32(?,00000000), ref: 001A052B
GetSubMenu.USER32(?,00000000), ref: 001A0543
GetMenuItemID.USER32(?,00000000), ref: 001A055B
GetMenuItemCount.USER32(?), ref: 001A0592
GetMenuItemID.USER32(?,00000000), ref: 001A05AD

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$ParentWindow$DesktopFocusLongMessageSend
String ID:
API String ID: 4186786570-0
Opcode ID: 8a0b7a14bf9451328f11db69c9c36cf0fb9d1f2ed5f145ee3964f84ccc4debc3
Instruction ID: 5c4b2608b3f5713a4cdab804c76ae7ce8d6eb85d4dae20f432e26e83babe969b
Opcode Fuzzy Hash: 8a0b7a14bf9451328f11db69c9c36cf0fb9d1f2ed5f145ee3964f84ccc4debc3
Instruction Fuzzy Hash: 5B514939D00609EFCB12EFA4C984AAEBBB5FF4E310F244569E516A6151D731EE40DF20

Function 02B00080 Relevance: 13.6, APIs: 9, Instructions: 134networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 02B00123
GetLastError.KERNEL32 ref: 02B0018D

Part of subcall function 02AFEC80: WSAEventSelect.WS2_32(?,?,00000030), ref: 02AFEC98
Part of subcall function 02AFEC80: connect.WS2_32(?,?,-0000001D), ref: 02AFECC0
Part of subcall function 02AFEC80: WSAGetLastError.WS2_32 ref: 02AFECD3

ResetEvent.KERNEL32(?), ref: 02B0015F
WSAGetLastError.WS2_32 ref: 02B0017E
WSAGetLastError.WS2_32 ref: 02B001A5
WSAGetLastError.WS2_32 ref: 02B001B4
SetLastError.KERNEL32(00000000), ref: 02B001C8
GetLastError.KERNEL32 ref: 02B001DE
SetLastError.KERNEL32(00000000), ref: 02B001F0

Part of subcall function 02AFEBA0: bind.WS2_32(?,?,-0000001D), ref: 02AFEBD8

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ErrorLast$Event$ResetSelectbindconnect
String ID:
API String ID: 1052395590-0
Opcode ID: 9337abc37b1408b70bdcd556fd15800fe755fd2d784fae7e27f2291d27880c9c
Instruction ID: d42d94ba88c48b9bdaeac5e6498e6cc16f669067e43c04e3113df62a1280f146
Opcode Fuzzy Hash: 9337abc37b1408b70bdcd556fd15800fe755fd2d784fae7e27f2291d27880c9c
Instruction Fuzzy Hash: 154192716007049FD721EFA9D880B6BB7F9EF88300F10895EEA46C3290DB74E945CBA1

Function 001C4552 Relevance: 13.6, APIs: 9, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001C4559
_memset.LIBCMT ref: 001C4579
SendMessageW.USER32 ref: 001C45A1
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 001C45C1
SHGetDesktopFolder.SHELL32(?), ref: 001C45E9
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 001C4612
SendMessageW.USER32(?,00001115,00000000,?), ref: 001C4649
SendMessageW.USER32(001C3AD4,0000000B,00000001,00000000), ref: 001C4653
RedrawWindow.USER32(001C3AD4,00000000,00000000,00000105), ref: 001C465F

Part of subcall function 00181C89: __EH_prolog3_catch_GS.LIBCMT ref: 00181C93

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$DesktopFolderH_prolog3H_prolog3_catch_RedrawWindow_memset
String ID:
API String ID: 3540180273-0
Opcode ID: 4372563f0f1cd2155e8a62bde5f1e645dd93b63735760fdd90cbd3f963d7eb7a
Instruction ID: 2fa857cb3dd45661f35ba5e2aa84aa86a6af6d4fba9d44d8282a478f793d1a4e
Opcode Fuzzy Hash: 4372563f0f1cd2155e8a62bde5f1e645dd93b63735760fdd90cbd3f963d7eb7a
Instruction Fuzzy Hash: 0B415EB0900209AFDB14EFA0CC95EAEBBB9FF58344F104528F556AA2A0EB71DD51CF50

Function 02AF1BD0 Relevance: 13.6, APIs: 9, Instructions: 101synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 02AF1BE2
ResetEvent.KERNEL32(?), ref: 02AF1BE8
timeGetTime.WINMM ref: 02AF1BEA
InterlockedExchange.KERNEL32(?,00000000), ref: 02AF1BF9
WaitForSingleObject.KERNEL32(?,00001770), ref: 02AF1C5B
ResetEvent.KERNEL32(?), ref: 02AF1C75
ResetEvent.KERNEL32(?), ref: 02AF1C84

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: EventReset$ExchangeInterlockedObjectSingleTimeWaittime
String ID:
API String ID: 3684151993-0
Opcode ID: 87b53ef2dab2ccc25bc2288d4711975846ec5403387e5757affcbf8f696f7323
Instruction ID: b6b5e364e8baf119ea56a62c0bee22ff6b9f087d237023c95014d5e6be5e032a
Opcode Fuzzy Hash: 87b53ef2dab2ccc25bc2288d4711975846ec5403387e5757affcbf8f696f7323
Instruction Fuzzy Hash: 8F316C76640704AFD364EBA9DC80F5AB7E8FF88324F10891AF64AD7680D6B5F441CB50

Function 02B00470 Relevance: 13.6, APIs: 9, Instructions: 96COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?,?,?,?,?,?,?,02B130C0,000000FF), ref: 02B004A5
TryEnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,02B130C0,000000FF), ref: 02B004CE
TryEnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,02B130C0,000000FF), ref: 02B004E5
SetLastError.KERNEL32(0000139F,?,?,?,?,?,?,?,02B130C0,000000FF), ref: 02B00503
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,02B130C0,000000FF), ref: 02B0050C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,02B130C0,000000FF), ref: 02B00512

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: d4c27ab46be532bf580fe29d827b459a9204206c1b0062ca5c1f58e83e67c52d
Instruction ID: 4b9400f9d4ea82dc72d1054b9c667dce11a8c1398e0d829b76343c3c09f651a6
Opcode Fuzzy Hash: d4c27ab46be532bf580fe29d827b459a9204206c1b0062ca5c1f58e83e67c52d
Instruction Fuzzy Hash: B631E272E402089FD720DFA9D981BAEFBF8FB58710F00496AE905D3280E775A510CBA1

Function 02AFF3A0 Relevance: 13.6, APIs: 9, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,CD663CB9,?,?,?,?,?,02B12FB8,000000FF), ref: 02AFF3D2
_free.LIBCMT ref: 02AFF3E5

Part of subcall function 02B01DA4: HeapFree.KERNEL32(00000000,00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01DBA
Part of subcall function 02B01DA4: GetLastError.KERNEL32(00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000), ref: 02B01DCC

ResetEvent.KERNEL32(?,?,?,?,?,?,02B12FB8,000000FF), ref: 02AFF403
ResetEvent.KERNEL32(?,?,?,?,?,?,02B12FB8,000000FF), ref: 02AFF40C
ResetEvent.KERNEL32(?,?,?,?,?,?,02B12FB8,000000FF), ref: 02AFF415
HeapDestroy.KERNEL32(?,?,?,?,?,?,02B12FB8,000000FF), ref: 02AFF435
HeapCreate.KERNEL32(?,?,?,?,?,?,?,?,02B12FB8,000000FF), ref: 02AFF447
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AFF47B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AFF485

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Event$HeapReset$CriticalSection$CreateDestroyEnterErrorFreeLastLeave_free
String ID:
API String ID: 465610239-0
Opcode ID: e07e6a3801d14c80910271e4ffeba2cb33204022509b6befae8e97c390f737d0
Instruction ID: c5a7d9f7833897ad0f2e069b8ab8ce387eea0bfd6395476d807c4075d9ef3f9f
Opcode Fuzzy Hash: e07e6a3801d14c80910271e4ffeba2cb33204022509b6befae8e97c390f737d0
Instruction Fuzzy Hash: D531F6B5940B049FD724DFA5D884AABF7F8FB58310F508E2EE5AAC3650DB74A940CB50

Function 001D0627 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001D062E

Part of subcall function 00180693: GetWindowTextLengthW.USER32(?), ref: 001806A4
Part of subcall function 00180693: GetWindowTextW.USER32(?,00000000,00000001), ref: 001806BB

InflateRect.USER32(?,?,?), ref: 001D074B
SetRectEmpty.USER32(?), ref: 001D0757
InflateRect.USER32(?,00000000,00000000), ref: 001D07E8
OffsetRect.USER32(?,00000001,00000001), ref: 001D0875
IsRectEmpty.USER32(?), ref: 001D0902

Strings

mmm, xrefs: 001D0896

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyInflateTextWindow$H_prolog3_LengthOffset
String ID: mmm
API String ID: 2648887860-1545505134
Opcode ID: 36aa188e066b77f438f3847cc032f996d077729e94715f176771102c863e5d77
Instruction ID: 939f7232a64a2845c29279543d5bd93e5f8bb4d8fa017bcf591f8467b9521bf2
Opcode Fuzzy Hash: 36aa188e066b77f438f3847cc032f996d077729e94715f176771102c863e5d77
Instruction Fuzzy Hash: E3E12C71900609DFCF16CFA8C894AEEB7B5FF88310F18417AE909AB255DB31A945CF60

Function 02AFD4D0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 308COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02AFD706

Part of subcall function 02AFCAF0: __vswprintf.LIBCMT ref: 02AFCB2A

_malloc.LIBCMT ref: 02AFD6C0

Part of subcall function 02B01DDE: __FF_MSGBANNER.LIBCMT ref: 02B01DF7
Part of subcall function 02B01DDE: __NMSG_WRITE.LIBCMT ref: 02B01DFE
Part of subcall function 02B01DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01E23

Strings

input wins: %lu, xrefs: 02AFD75F
input psh: sn=%lu ts=%lu, xrefs: 02AFD673
[RI] %d bytes, xrefs: 02AFD4FE
input probe, xrefs: 02AFD732
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 02AFD63E

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc_memmove
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 1438150933-868042568
Opcode ID: 2f4cf8d69659aed738c3235fa2db747ca07bb2a27fe09a133ef58f797c16edfb
Instruction ID: af16770fdef5ba6ffc2ec25804a9a0f6f9035e4f9aa694ac8d506b867fbcc7ad
Opcode Fuzzy Hash: 2f4cf8d69659aed738c3235fa2db747ca07bb2a27fe09a133ef58f797c16edfb
Instruction Fuzzy Hash: 55B1D775A006049FCB59DFA8C9C0AAE77B5BF44714F0445AEFE099B346DB39D904CB90

Function 001B256E Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B2578
CreatePolygonRgn.GDI32(?,00000008,00000002), ref: 001B2772
FillRect.USER32(00000002,?,?), ref: 001B27E4
FillRect.USER32(00000002,?,1A100E49), ref: 001B2814
Polyline.GDI32(00000002,?,00000008), ref: 001B282B

Strings

(, xrefs: 001B285D
(, xrefs: 001B2661

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: FillRect$CreateH_prolog3_PolygonPolyline
String ID: ($(
API String ID: 3866795319-174109489
Opcode ID: d9df7c19c1b8213198a9896a37cdc16ebfe80657f9a855e96b0270ac9386eaf4
Instruction ID: 2bbbf64db34316792539f87726e025004918ec6e1e233e8966ac5a5e69a5205d
Opcode Fuzzy Hash: d9df7c19c1b8213198a9896a37cdc16ebfe80657f9a855e96b0270ac9386eaf4
Instruction Fuzzy Hash: 18A13B70D00219DFCF25DFA4C994AEDBBB5FF58300F24816AE919AB251DB709A49CF50

Function 02AF9BF0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 02AF9C12
SetLastError.KERNEL32(0000007F), ref: 02AF9D15

Strings

Main, xrefs: 02AF9BFF, 02AF9C3C

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: 724c9818c8f794ca4cd7370fcea8ba61272c216cd5c72e1c07fa283a613addf9
Instruction ID: 3e3eaa02922e98a634712f2c3ccc628683410df4c251896703273ded6cb24622
Opcode Fuzzy Hash: 724c9818c8f794ca4cd7370fcea8ba61272c216cd5c72e1c07fa283a613addf9
Instruction Fuzzy Hash: 6141E332A40306DFE720DF99D881BA6B7F4FF84314F1446A9E9099B341EB74E991CB90

Function 02B00700 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02B00728

Part of subcall function 02B01DA4: HeapFree.KERNEL32(00000000,00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01DBA
Part of subcall function 02B01DA4: GetLastError.KERNEL32(00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000), ref: 02B01DCC

_malloc.LIBCMT ref: 02B00776
_free.LIBCMT ref: 02B00791
std::exception::exception.LIBCMT ref: 02B007BD
__CxxThrowException@8.LIBCMT ref: 02B007D2
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,FFFFD8F0,000000FF), ref: 02B00820

Strings

bad allocation, xrefs: 02B007B6

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _free$ErrorException@8FreeHeapLastThrowTimerWaitable_mallocstd::exception::exception
String ID: bad allocation
API String ID: 2829241915-2104205924
Opcode ID: f796f06abd84916b926073e3e0d85d21af43ba4979ef24ea6fcfb4a36d0863ea
Instruction ID: d07893890af8c7463aa70f01690f6c464be84b3af326e75f2bbaede3c07444ba
Opcode Fuzzy Hash: f796f06abd84916b926073e3e0d85d21af43ba4979ef24ea6fcfb4a36d0863ea
Instruction Fuzzy Hash: 07316EB1A417019FE725EF7988C0BDABAE9AF88300F5009ADD55AD7280EB71B9048F51

Function 001C40F7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100windowmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001C40FE
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?,00000078,001C43E4,?,001C4462), ref: 001C4121

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

SHGetDesktopFolder.SHELL32(?,?,001C4462), ref: 001C4136
GlobalAlloc.KERNEL32(00000040,0000000C,?,001C4462), ref: 001C414B
SendMessageW.USER32(?,00001132,00000000,?), ref: 001C41F4
SendMessageW.USER32(?,00001102,00000002,00000000), ref: 001C4201

Strings

g, xrefs: 001C4144

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: FolderMessageSend$AllocDesktopException@8GlobalH_prolog3LocationSpecialThrow
String ID: g
API String ID: 4142625628-30677878
Opcode ID: 9b5cfc118c3ee9f955fbc59da0b6f507d885f0ef08c658ec25bfb594026878ed
Instruction ID: 1d9cbd52ecae4097aa139cddf67400285d04a1aea522570687284dc5ba829408
Opcode Fuzzy Hash: 9b5cfc118c3ee9f955fbc59da0b6f507d885f0ef08c658ec25bfb594026878ed
Instruction Fuzzy Hash: 0A318B71A002199FDB10DFA4CC99EAEBBB9FF48300F114569F519EB291DB309940CF20

Function 001C493D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,?), ref: 001C4984
_memset.LIBCMT ref: 001C4991
SendMessageW.USER32(?,00001102,00008001,?), ref: 001C49FA

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001C49C3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 001C49CE
SendMessageW.USER32(?,0000110B,00000009,?), ref: 001C49E8

Strings

@, xrefs: 001C49A2

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Exception@8Throw_memset
String ID: @
API String ID: 3355562902-2766056989
Opcode ID: b6ab7ac1bb2aa0b8666aa03cf4f829b89091765160c841a8bbdf3f876a7cbaf2
Instruction ID: 826b7da624c9f33db502f009218946ee2aaa955da85ea6218bf0686248a9d6e5
Opcode Fuzzy Hash: b6ab7ac1bb2aa0b8666aa03cf4f829b89091765160c841a8bbdf3f876a7cbaf2
Instruction Fuzzy Hash: 0221D472604309BBEB21AB55CC91FDB7BBCFB6C364F104129F645AA0A0E7B1DC408B60

Function 001B04F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B04F7
GetSysColorBrush.USER32(00000018), ref: 001B0510
FillRect.USER32(00000000,?,00000000), ref: 001B051C
GetSysColor.USER32(00000017), ref: 001B0544
GetSysColor.USER32(00000017), ref: 001B056E
GetSysColor.USER32(00000017), ref: 001B0573

Strings

mmm, xrefs: 001B053B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Color$BrushFillH_prolog3Rect
String ID: mmm
API String ID: 24942539-1545505134
Opcode ID: 867bb8bcf660802ecaadbb1db3fd1640273db0e187eba43abf38f87ed860a7f7
Instruction ID: c750917fcad02486dd671144f8d393b14e58de67dff552131980fc70da9d7580
Opcode Fuzzy Hash: 867bb8bcf660802ecaadbb1db3fd1640273db0e187eba43abf38f87ed860a7f7
Instruction Fuzzy Hash: 87114975200249AFCB10EFA4CC88EAE77A9FF8C710B154118FA468B291CB30E950CFA1

Function 001D4C1A Relevance: 12.2, APIs: 8, Instructions: 240windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001D1C6E: GdipGetImagePixelFormat.GDIPLUS(?,00301A6C,00000000,00000000,?,001D4C44,00000000,00000000,00301A6C), ref: 001D1C7E

_free.LIBCMT ref: 001D4D4D
_free.LIBCMT ref: 001D4D99
GdipBitmapLockBits.GDIPLUS(?,00000000,00000001,00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00301A6C), ref: 001D4E62
_free.LIBCMT ref: 001D4E92

Part of subcall function 001D1C90: GdipGetImagePaletteSize.GDIPLUS(?,00000000,00000000,00000000,?,001D4CFE,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 001D1CA4

GdipBitmapUnlockBits.GDIPLUS(00000005,?,?,00000000,00000001,00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00301A6C), ref: 001D4F0E
_free.LIBCMT ref: 001D4F89

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Gdip_free$BitmapBitsImage$FormatLockPalettePixelSizeUnlock
String ID:
API String ID: 4092590016-0
Opcode ID: ae461f2ef6c70b18af97e1498b17c7243e90870b98307c902dfab6d2e25ee6da
Instruction ID: 1a162f0f703ef2c6b7d8bcc2b85922812ec34015f4576e6d4c9fbb4dfc044014
Opcode Fuzzy Hash: ae461f2ef6c70b18af97e1498b17c7243e90870b98307c902dfab6d2e25ee6da
Instruction Fuzzy Hash: 9CA169B19006289BCF21DF18CD81BA9B7B5AF54314F1085EAE708A7351CB74AEC5CF68

Function 001D41A5 Relevance: 12.2, APIs: 8, Instructions: 204windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D41AC
EnterCriticalSection.KERNEL32(00301A6C,00000014,001B3845,?,?,00000000,00000000,00000000,00000000), ref: 001D41D1
SelectObject.GDI32(?,00000014), ref: 001D42C0
LeaveCriticalSection.KERNEL32(00301A6C,00000020,?,00000014,001B3845,?,?,00000000,00000000,00000000,00000000), ref: 001D42DF
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 001D4302
SelectObject.GDI32(00000000), ref: 001D4311
CreateCompatibleDC.GDI32(00000000), ref: 001D439B
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 001D43BB

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Create$BitmapCompatibleCriticalObjectSectionSelect$EnterH_prolog3Leave
String ID:
API String ID: 4255533662-0
Opcode ID: be8a2b395925cef347adac551c28a96c71112073fab3671fc67d3024f3b423fa
Instruction ID: b8d5cfbc060a576cacc7411f2cbb03f492771e6ed23cf3ca6ff956134e19810c
Opcode Fuzzy Hash: be8a2b395925cef347adac551c28a96c71112073fab3671fc67d3024f3b423fa
Instruction Fuzzy Hash: E2717930600B01DFCB35DF68E881A6AB7E5FF94740B248A2AF09687B55E770A881CB11

Function 001C2B87 Relevance: 12.1, APIs: 8, Instructions: 146windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 001C2BD0
ScreenToClient.USER32(00000000,?), ref: 001C2C15
SendMessageW.USER32(?,0000102C,00000000,00000003), ref: 001C2C53
SetCapture.USER32(?), ref: 001C2C79
ReleaseCapture.USER32 ref: 001C2CB4
ScreenToClient.USER32(?,?), ref: 001C2CD3
GetSystemMetrics.USER32(00000044), ref: 001C2D0E
GetSystemMetrics.USER32(00000045), ref: 001C2D2A

Part of subcall function 001C2141: SendMessageW.USER32(001C2BB7,00001018,00000000,00000000), ref: 001C214D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CaptureClientMessageMetricsScreenSendSystem$FocusRelease
String ID:
API String ID: 3871486171-0
Opcode ID: a38e7551c7d2f99e299bd1fda73791d14df2838adbbfc9bc427aff138b1360bd
Instruction ID: 525c5b8ff80e55b5be794c3ea2b1243a486f5c2fa264fd4c6ec153e51e504257
Opcode Fuzzy Hash: a38e7551c7d2f99e299bd1fda73791d14df2838adbbfc9bc427aff138b1360bd
Instruction Fuzzy Hash: FA514D75A00605AFDB20DFB8C984BAABBF5BF24310F10852DF59AD7251DBB0E9808B50

Function 002569DF Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002569E6
EqualRect.USER32(?,?), ref: 00256A05
EqualRect.USER32(?,?), ref: 00256A16
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00256A66
CreateRectRgn.GDI32(?,00000000,?,?), ref: 00256A99
CreateRectRgnIndirect.GDI32(?), ref: 00256AA5
SetWindowRgn.USER32(?,?,00000000), ref: 00256ACC
RedrawWindow.USER32(?,00000000,00000000,00000105,002FFAF0,?,?,?,00000001,00000058), ref: 00256B44

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Create$EqualWindow$H_prolog3IndirectRedraw
String ID:
API String ID: 1234839666-0
Opcode ID: 4c0bdcff66bb3bfe98aa10c7eea4552df051a520b7e7408b9cabe51eb0b93d2d
Instruction ID: 8efb7e1084376e8ed01d30d7bb0955f62cd94256720395ebde0421ce0f73a961
Opcode Fuzzy Hash: 4c0bdcff66bb3bfe98aa10c7eea4552df051a520b7e7408b9cabe51eb0b93d2d
Instruction Fuzzy Hash: 6751297291110AAFCF05DFA4C989AEF7B79EF04300F108119BC19AB255DB71AA55CBA0

Function 001A65D6 Relevance: 12.1, APIs: 8, Instructions: 124windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001A65DD
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 001A6613
GetParent.USER32(?), ref: 001A6638
GetTopWindow.USER32(?), ref: 001A66F2
GetWindow.USER32(?,00000002), ref: 001A6710
IsWindow.USER32(?), ref: 001A6730
GetParent.USER32(?), ref: 001A673D
DestroyWindow.USER32(?), ref: 001A674B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Parent$DestroyH_prolog3MessageSend
String ID:
API String ID: 3234442123-0
Opcode ID: 17d36eb5ff46aac5422703505f8d1619107c5e40b7f2798acdfbd6cc441fcd37
Instruction ID: 38e647649d074748194d0330bf18a1c020049ebc83afaba9624812cabe8de547
Opcode Fuzzy Hash: 17d36eb5ff46aac5422703505f8d1619107c5e40b7f2798acdfbd6cc441fcd37
Instruction Fuzzy Hash: 674193B9600705DFCB20AFB5C8859ADB7B5BF59304F58086DF25AA7251DB30AD50CF50

Function 02AFB930 Relevance: 12.1, APIs: 8, Instructions: 121synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000009,000000FF,CD663CB9), ref: 02AFB97D
SetLastError.KERNEL32(00000000), ref: 02AFB98B
CloseHandle.KERNEL32(?), ref: 02AFB9A8
CloseHandle.KERNEL32(?), ref: 02AFB9CB
CloseHandle.KERNEL32(?), ref: 02AFB9EE
DeleteCriticalSection.KERNEL32(?), ref: 02AFBA18
_free.LIBCMT ref: 02AFBA55
CloseHandle.KERNEL32(00000002), ref: 02AFBA71

Part of subcall function 02AFF2F0: GetCurrentThreadId.KERNEL32 ref: 02AFF2F4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CloseHandle$CriticalCurrentDeleteErrorLastObjectSectionSingleThreadWait_free
String ID:
API String ID: 3924219484-0
Opcode ID: e71eb264104e5e0375e065ecd0654591f439ae6cb6153bfe3bd12a0434a502ce
Instruction ID: b655ff79f2c10dfecaeb59e197bcf1ee79660a0da2b43c97706db0c183bce7e9
Opcode Fuzzy Hash: e71eb264104e5e0375e065ecd0654591f439ae6cb6153bfe3bd12a0434a502ce
Instruction Fuzzy Hash: C5419271940745DBDB60EFF8C984B5ABBF8EB18318F508E5DEA55D7280DB38A904CB60

Function 0018E78F Relevance: 12.1, APIs: 8, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 001DC309: ReleaseCapture.USER32 ref: 001DC337
Part of subcall function 001DC309: IsWindow.USER32(?), ref: 001DC35B
Part of subcall function 001DC309: DestroyWindow.USER32(?), ref: 001DC36B

SetRectEmpty.USER32(?), ref: 0018E7C2
ReleaseCapture.USER32 ref: 0018E7C8
SetCapture.USER32(?), ref: 0018E7D7
GetCapture.USER32 ref: 0018E819
ReleaseCapture.USER32 ref: 0018E829
SetCapture.USER32(?), ref: 0018E838
RedrawWindow.USER32(?,?,?,00000505), ref: 0018E8A3
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 0018E8E2

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Capture$Window$Release$Redraw$DestroyEmptyRect
String ID:
API String ID: 2209428161-0
Opcode ID: 77449808c4b37cb1258d05a0077ee7e8879464c1c0c2277fe646bb829bbd6894
Instruction ID: b8b7b08a511858d101041351c532616d5a38b3926a1713464695676dfe60c0e7
Opcode Fuzzy Hash: 77449808c4b37cb1258d05a0077ee7e8879464c1c0c2277fe646bb829bbd6894
Instruction Fuzzy Hash: FF4168356006009FDB24AB34D84DA5A7BE5FF89721F25066CF46A972A0DB30EA008F60

Function 001D02E2 Relevance: 12.1, APIs: 8, Instructions: 102windowtimeCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 001D037C
SendMessageW.USER32(?,00000111,?,?), ref: 001D03AA
IsWindow.USER32(?), ref: 001D03B9
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,001C9F92,?,?,?), ref: 001D03C9
IsWindow.USER32(?), ref: 001D03D9
ReleaseCapture.USER32 ref: 001D03E7
KillTimer.USER32(?,00000001,?,?,?,?,?,001C9F92,?,?,?), ref: 001D0400
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 001D041F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$MessageSend$CaptureKillParentRedrawReleaseTimer
String ID:
API String ID: 3014619129-0
Opcode ID: 0e82803d42667d0a223b8ac8c6bce42821904632017626c28301752f3cbdd228
Instruction ID: 222ac6fc8103d605de30d5d746214a62aed9596b44b2c7c364bc440e840bb88e
Opcode Fuzzy Hash: 0e82803d42667d0a223b8ac8c6bce42821904632017626c28301752f3cbdd228
Instruction Fuzzy Hash: 10313B31A01B10EFDB329F35DC48BABFAE5FB89701F64092FA19A51250E771A840CB21

Function 0019CA6F Relevance: 12.1, APIs: 8, Instructions: 100COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 0019CA8C
GetParent.USER32(?), ref: 0019CAA3
GetClientRect.USER32(?,?), ref: 0019CB31
MapWindowPoints.USER32(?,?,?,00000002), ref: 0019CB44
PtInRect.USER32(?,?,?), ref: 0019CB54

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ClientRect$ParentPointsScreenWindow
String ID:
API String ID: 1402249346-0
Opcode ID: a94005a789b6cb7f3e40feba56a7255b75ecb5313d1ccf4cb01ebdad1342be42
Instruction ID: 264ecdb4e136dc19f4acbb5fd2f5599f962f81293c98f4f5cc36eb7e905858e9
Opcode Fuzzy Hash: a94005a789b6cb7f3e40feba56a7255b75ecb5313d1ccf4cb01ebdad1342be42
Instruction Fuzzy Hash: 32314D76600109AFCF119FA4DD49CBEBBB9FF88750B250129F946D7261EB30DE009B60

Function 001A843A Relevance: 12.1, APIs: 8, Instructions: 80windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001A8441
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 001A845A
DestroyAcceleratorTable.USER32(?), ref: 001A849B
GetTopWindow.USER32(?), ref: 001A84D0
GetWindow.USER32(?,00000002), ref: 001A84E9
IsWindow.USER32(?), ref: 001A8508
GetParent.USER32(?), ref: 001A8513
DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,0000001C), ref: 001A851F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Destroy$AcceleratorH_prolog3MessageParentSendTable
String ID:
API String ID: 271420684-0
Opcode ID: 45ab4766d03bc99cfe47ba676eb78543789269db525e12d4c41326299e40925a
Instruction ID: 2584b80819e9d136fa87dad58fd92ccf41b3f121912b04bf6abe8fe5e5b91bae
Opcode Fuzzy Hash: 45ab4766d03bc99cfe47ba676eb78543789269db525e12d4c41326299e40925a
Instruction Fuzzy Hash: 19317C799016069FCB15AFA5D889A9DFBB4FF0D310F540629E446B3291DF306D50CFA0

Function 00178717 Relevance: 12.1, APIs: 8, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 00178729
GetMenuItemCount.USER32(?), ref: 00178731
GetSubMenu.USER32(?,-00000001), ref: 0017874E
GetMenuItemCount.USER32(00000000), ref: 0017875E
GetSubMenu.USER32(00000000,00000000), ref: 0017876F
RemoveMenu.USER32(00000000,00000000,00000400), ref: 0017878C
GetSubMenu.USER32(?,?), ref: 001787A6
RemoveMenu.USER32(?,?,00000400), ref: 001787C4

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Menu$CountItem$Remove
String ID:
API String ID: 3494307843-0
Opcode ID: 6ddb6022ac4e05a5ea98d96bbcb7a3bf929f1fa9ccd779faa5beb4f40944cbe2
Instruction ID: 155f299378411caff56cff242918eceda360d6841aa9effe2ff454af8faaf95a
Opcode Fuzzy Hash: 6ddb6022ac4e05a5ea98d96bbcb7a3bf929f1fa9ccd779faa5beb4f40944cbe2
Instruction Fuzzy Hash: 50214975940209FBDF059FB5DC889ADBBB9FB04342F308862E90AA2110DB309A50EF50

Function 001747AC Relevance: 12.1, APIs: 8, Instructions: 66memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 001747CB
lstrcmpW.KERNEL32(00000000,?), ref: 001747D8
OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 001747EA
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0017480A
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00174812
GlobalLock.KERNEL32(00000000), ref: 0017481C
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 00174829
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00174841

Part of subcall function 001833CB: GlobalFlags.KERNEL32(?), ref: 001833DA
Part of subcall function 001833CB: GlobalUnlock.KERNEL32(?), ref: 001833EB
Part of subcall function 001833CB: GlobalFree.KERNEL32(?), ref: 001833F5

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 307581e7199334d0ba16e15f81953349f79a5c99caa53eded347de7c4626e29b
Instruction ID: 755fd811016b5a45b63db71e38e2a49494e1bf7c5a08e239dd10d009ee613654
Opcode Fuzzy Hash: 307581e7199334d0ba16e15f81953349f79a5c99caa53eded347de7c4626e29b
Instruction Fuzzy Hash: 59118C72500508BBDF22AFA6DD89C6F7AFDEB89B40B104429F618D2021DB31DA51DB31

Function 0018687A Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000031), ref: 00186890
GetSystemMetrics.USER32(00000032), ref: 0018689A
SetRectEmpty.USER32(002FFF04), ref: 001868A9
EnumDisplayMonitors.USER32(00000000,00000000,001867F5,002FFF04,?,?,?,00177A3A,?), ref: 001868B9
SystemParametersInfoW.USER32(00000030,00000000,002FFF04,00000000), ref: 001868D4
SystemParametersInfoW.USER32(00001002,00000000,002FFF30,00000000), ref: 001868F4
SystemParametersInfoW.USER32(00001012,00000000,002FFF34,00000000), ref: 0018690C
SystemParametersInfoW.USER32 ref: 0018692C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: System$InfoParameters$Metrics$DisplayEmptyEnumMonitorsRect
String ID:
API String ID: 2614369430-0
Opcode ID: fe15ba344a71de7f79763e6ad83616816ba3cb79769fdb41cffae69cdea13282
Instruction ID: ebdf207edeeec5f5863c1010cc2cf2c8e7b70572998a7f605e4246df8ecd69da
Opcode Fuzzy Hash: fe15ba344a71de7f79763e6ad83616816ba3cb79769fdb41cffae69cdea13282
Instruction Fuzzy Hash: BF110AB5501744AFE3319B669C49ED3BAECEFCAB00F10092EE59A86140D7B06541CB21

Function 00178945 Relevance: 12.1, APIs: 8, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GlobalSize.KERNEL32(?), ref: 00178956
GlobalAlloc.KERNEL32(00002002,00000000), ref: 00178968
GlobalSize.KERNEL32(?), ref: 00178979
GlobalLock.KERNEL32(?), ref: 0017898A
GlobalLock.KERNEL32(?), ref: 00178990
GlobalSize.KERNEL32(?), ref: 0017899B
GlobalUnlock.KERNEL32(?), ref: 001789AE
GlobalUnlock.KERNEL32(?), ref: 001789B3

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Global$Size$LockUnlock$Alloc
String ID:
API String ID: 2344174106-0
Opcode ID: 2bcb09c87b801ae3c7287fd827e6686fca16627e5ea0c39b0d66db95ddb04e87
Instruction ID: a5f4a1151273e28dec5e855482fc3a079ad91719bd64c2169113be713b278967
Opcode Fuzzy Hash: 2bcb09c87b801ae3c7287fd827e6686fca16627e5ea0c39b0d66db95ddb04e87
Instruction Fuzzy Hash: 1C017C75940218BBDB116F65EC8886EBFACEF942A47108026FD08A3211DB70DD119BA1

Function 00188809 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 00188818
GetSystemMetrics.USER32(0000000C), ref: 0018881F
GetSystemMetrics.USER32(00000002), ref: 00188826
GetSystemMetrics.USER32(00000003), ref: 00188830
GetDC.USER32(00000000), ref: 0018883A
GetDeviceCaps.GDI32(00000000,00000058), ref: 0018884B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00188853
ReleaseDC.USER32(00000000,00000000), ref: 0018885B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: ca08a06d0ad4764c9ac423fe0ddfb6e3a2107aa214b91f29e783fadcacaf6569
Instruction ID: e28ddf3e423ec357377b1de487f9354b2b65d2e86cc258be46d07f8700b9211b
Opcode Fuzzy Hash: ca08a06d0ad4764c9ac423fe0ddfb6e3a2107aa214b91f29e783fadcacaf6569
Instruction Fuzzy Hash: 2DF06DB5E41714ABE7105F72AC4DF167F68FB44761F104527E6049B280DBB598018FE0

Function 0019A6F8 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 367stringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0019A702
IsMenu.USER32(?), ref: 0019A726

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0019A86E
lstrlenW.KERNEL32(?), ref: 0019A87B

Part of subcall function 001DFDA0: __EH_prolog3.LIBCMT ref: 001DFDA7

Part of subcall function 001DEB15: __EH_prolog3.LIBCMT ref: 001DEB1C

Strings

&%d %s, xrefs: 0019A913
Recent File, xrefs: 0019A81C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$CurrentDirectoryException@8H_prolog3_MenuThrowlstrlen
String ID: &%d %s$Recent File
API String ID: 2040550558-3015484766
Opcode ID: 8e1b0060c63eb1c3bbb55ee5d74f313231c0732fbf8df4b5e4bb8ae0139eef71
Instruction ID: 2362d7342007bdcb17c55bc35400cec3424037f83cdeee34dab7df701844927a
Opcode Fuzzy Hash: 8e1b0060c63eb1c3bbb55ee5d74f313231c0732fbf8df4b5e4bb8ae0139eef71
Instruction Fuzzy Hash: 29E1E3306012159FDF2ADF64CC95BE9B7B8BF18304F5441A9E50A97292DB70AF84CF82

Function 0020E250 Relevance: 10.8, APIs: 7, Instructions: 348COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0020E257
GetWindow.USER32(?,00000005), ref: 0020E2BB

Part of subcall function 0020D940: __EH_prolog3.LIBCMT ref: 0020D947
Part of subcall function 0020D940: GetWindow.USER32(?,00000005), ref: 0020D967
Part of subcall function 0020D940: GetWindow.USER32(?,00000002), ref: 0020D99D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$H_prolog3
String ID:
API String ID: 1351209170-0
Opcode ID: 9b9599dbc2702c92167661439a358824712073add70d31a5a73df9b417383504
Instruction ID: 2650281c2fff4b1aa86dab277413bd96390e5b7878dfd9320c7d0ea9d855084e
Opcode Fuzzy Hash: 9b9599dbc2702c92167661439a358824712073add70d31a5a73df9b417383504
Instruction Fuzzy Hash: 84D18E70A103069FDF14EFB4C899BAEBBB5BF18300F050968E516A72D2DB749D90CB51

Function 00182331 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 243COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00182361

Strings

AfxMDIFrame100su, xrefs: 00182402
(, xrefs: 001823DD
@, xrefs: 00182506
@, xrefs: 0018246D
AfxFrameOrView100su, xrefs: 00182427

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: _memset
String ID: ($@$@$AfxFrameOrView100su$AfxMDIFrame100su
API String ID: 2102423945-4220493551
Opcode ID: 668a893375dc613983281914437c99ac28fd3846ce51ae6677f22600e57b7d33
Instruction ID: 9d0720918ecb9e7dc595d99e1efe3164e8cda59e0a0f0fb55195b93199da8c14
Opcode Fuzzy Hash: 668a893375dc613983281914437c99ac28fd3846ce51ae6677f22600e57b7d33
Instruction Fuzzy Hash: DA912071D00219BADB51EFA8C485BDEBBF8AF04344F258169FD08F6181E7748B45CBA1

Function 001DC7D7 Relevance: 10.7, APIs: 7, Instructions: 233COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001DC83F
GetWindowRect.USER32(?,?), ref: 001DC84C
GetWindowRect.USER32(?,?), ref: 001DC897
IntersectRect.USER32(?,?,?), ref: 001DC8A9

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

PtInRect.USER32(?,?,?), ref: 001DC92C
GetWindowRect.USER32(?,?), ref: 001DC963
PtInRect.USER32(?,?,?), ref: 001DC973

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$CursorException@8IntersectThrow
String ID:
API String ID: 3420418273-0
Opcode ID: db7b608d8b37b19099b7066adfa9add54987953dd897b8e6b14fb3e45828a302
Instruction ID: 859f1818100e285c033bdb41e194fa527cfeaa5ba0223df2c39e7d40674c2c3e
Opcode Fuzzy Hash: db7b608d8b37b19099b7066adfa9add54987953dd897b8e6b14fb3e45828a302
Instruction Fuzzy Hash: C391E271E1021A9FCF19DFE9DA948EDBBB9FF18740B25855AE401E3214EB309941DF90

Function 02B00DB0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

bad allocation, xrefs: 02B00EB8

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID:
String ID: bad allocation
API String ID: 0-2104205924
Opcode ID: c4fb521c7810ad9f0d1fef5136d79ab4e2afa0135ca9712119e849ebc0482b32
Instruction ID: 2162bff77f4fb632308a98b40cb7a366af504008b642fc5907b0800492118624
Opcode Fuzzy Hash: c4fb521c7810ad9f0d1fef5136d79ab4e2afa0135ca9712119e849ebc0482b32
Instruction Fuzzy Hash: 8451B272E146159BCB19EF58D8C1BAEFBB5FB44720F1086BEE915E7380D731A9108B90

Function 02AFCD10 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02AFCD58
_free.LIBCMT ref: 02AFCD96
_free.LIBCMT ref: 02AFCDD5
_free.LIBCMT ref: 02AFCE15
_free.LIBCMT ref: 02AFCE3D
_free.LIBCMT ref: 02AFCE61
_free.LIBCMT ref: 02AFCE99

Part of subcall function 02B01DA4: HeapFree.KERNEL32(00000000,00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01DBA
Part of subcall function 02B01DA4: GetLastError.KERNEL32(00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000), ref: 02B01DCC

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ddd3d502be18eb2104c5a414d436fe645309eb58910b38729825d07b29982114
Instruction ID: 807049ad18f18878936a0d75fc5af032b25ed054a40c6dfaf73c02d69dfe7ce4
Opcode Fuzzy Hash: ddd3d502be18eb2104c5a414d436fe645309eb58910b38729825d07b29982114
Instruction Fuzzy Hash: C9514F76A112148FC754DF89C1C0959BBB6FF8836871A80AAD6099B321DB36BD12CF91

Function 02B00B90 Relevance: 10.6, APIs: 7, Instructions: 150networktimeCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,CD663CB9), ref: 02B00BE8
EnterCriticalSection.KERNEL32(?,CD663CB9), ref: 02B00C0E
WSASetLastError.WS2_32(00002746), ref: 02B00C27
LeaveCriticalSection.KERNEL32(?), ref: 02B00C2E
timeGetTime.WINMM ref: 02B00C98
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,02B13118,000000FF), ref: 02B00CDF
LeaveCriticalSection.KERNEL32(?), ref: 02B00D07

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLast$EnterTimetime
String ID:
API String ID: 3731243816-0
Opcode ID: e0d8739ece9bf8d3341afad1c89b4026241dcefc2f864d79040c02ebc0111dd3
Instruction ID: 1bd9f56f9ec80b930236aa0a9a2018b4ca7b6731aec5297c22c416f7d0ddf34b
Opcode Fuzzy Hash: e0d8739ece9bf8d3341afad1c89b4026241dcefc2f864d79040c02ebc0111dd3
Instruction Fuzzy Hash: 8051C272A447049FD731EF68D981B6ABBF5FB48364F104AAAE856C3780E735E844CB50

Function 001CA8AB Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 001CA8B2

Part of subcall function 0018A349: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 0018A369

Part of subcall function 001C1ADD: __EH_prolog3.LIBCMT ref: 001C1AE4

Part of subcall function 0018A2D8: __EH_prolog3.LIBCMT ref: 0018A2DF

Strings

MFCMaskedEdit_SelectByGroup, xrefs: 001CA8EF
MFCMaskedEdit_Mask, xrefs: 001CA924
MFCMaskedEdit_ValidChars, xrefs: 001CAA16
MFCMaskedEdit_DefaultChar, xrefs: 001CA996
MFCMaskedEdit_InputTemplate, xrefs: 001CA95B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$ByteCharH_prolog3_catchMultiWide
String ID: MFCMaskedEdit_DefaultChar$MFCMaskedEdit_InputTemplate$MFCMaskedEdit_Mask$MFCMaskedEdit_SelectByGroup$MFCMaskedEdit_ValidChars
API String ID: 207285973-975932772
Opcode ID: 2961b0643ba64d9ce39291d917fabb4315ab676abb1964342151a974650150bf
Instruction ID: a7ec5914951ac636aa49251a3b08ec9521da2c2e7bc2b5127a6125d3b4fb60cb
Opcode Fuzzy Hash: 2961b0643ba64d9ce39291d917fabb4315ab676abb1964342151a974650150bf
Instruction Fuzzy Hash: 10515B71901109AADB05EBB4C942FEEB7B9AF34318F50815DF525B3282DB30EE04DB62

Function 0018EAD5 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 001D9249: __EH_prolog3_catch.LIBCMT ref: 001D9250

UpdateWindow.USER32(?), ref: 0018EB69
EqualRect.USER32(?,?), ref: 0018EB9F
InflateRect.USER32(?,00000002,00000002), ref: 0018EBB7
InvalidateRect.USER32(?,?,00000001), ref: 0018EBC6
InflateRect.USER32(?,00000002,00000002), ref: 0018EBDB
InvalidateRect.USER32(?,?,00000001), ref: 0018EBED
UpdateWindow.USER32(?), ref: 0018EBF6

Part of subcall function 0018E6A3: InvalidateRect.USER32(?,?,00000001), ref: 0018E718
Part of subcall function 0018E6A3: InflateRect.USER32(?,?,?), ref: 0018E75E
Part of subcall function 0018E6A3: RedrawWindow.USER32(?,?,00000000,00000401,?,?), ref: 0018E771

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$InflateInvalidateWindow$Update$EqualH_prolog3_catchRedraw
String ID:
API String ID: 1041772997-0
Opcode ID: 2b94c6cdf2882f61b293c9316d60244743592ebad2995ae65abced63827fb65c
Instruction ID: 41a77056dba343a48eaae7ecb97371c3bef4097c3c43e0b2889e885442785e43
Opcode Fuzzy Hash: 2b94c6cdf2882f61b293c9316d60244743592ebad2995ae65abced63827fb65c
Instruction Fuzzy Hash: F6416A766002059FCB11DF68D888BAA77B9FF48314F140279ED0AEB296DB709A05CF60

Function 002061F4 Relevance: 10.6, APIs: 7, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017E5BF: __EH_prolog3_catch.LIBCMT ref: 0017E5C6

SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00206251
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00206275

Part of subcall function 001B3C58: __EH_prolog3_catch.LIBCMT ref: 001B3C62
Part of subcall function 001B3C58: CloseHandle.KERNEL32(X ,?,X ,00000080,002058E5,?,00000000,?,00000000), ref: 001B3C9B
Part of subcall function 001B3C58: GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,X ,00000080,002058E5,?,00000000,?,00000000), ref: 001B3CC2
Part of subcall function 001B3C58: GetTempFileNameW.KERNEL32(00000000,AFX,00000000,00000000,00000104,00000000,?,00000000), ref: 001B3CF9
Part of subcall function 001B3C58: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,04000100,00000000,?,00000000), ref: 001B3D1B

SendMessageW.USER32(?,00000150,00000000,00000000), ref: 0020629A
LoadIconW.USER32(?,?), ref: 002062CB
LoadIconW.USER32(00000000,00007F00), ref: 002062DE
GetClassLongW.USER32(?,000000F2), ref: 00206323
SendMessageW.USER32(?,00000170,?,00000000), ref: 0020635F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$FileH_prolog3_catchIconLoadTemp$ClassCloseCreateHandleLongNamePath
String ID:
API String ID: 308549110-0
Opcode ID: f28e3c071a41df4ca33537ef0246dfe0f6fa4138f137174092712e2f5d7c83ca
Instruction ID: 52a6edfd61dcdb4d9bf76fd955de8de2753d5699e00878c83557ed2e1896f1c1
Opcode Fuzzy Hash: f28e3c071a41df4ca33537ef0246dfe0f6fa4138f137174092712e2f5d7c83ca
Instruction Fuzzy Hash: 7A41D274210B01AFC721AB74CD59FABB7F9AF88715F240168B519972D1EB30A910CF10

Function 001EC7C7 Relevance: 10.6, APIs: 7, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001EC7CE

Part of subcall function 001F48D9: __EH_prolog3.LIBCMT ref: 001F48E0

Part of subcall function 001CF2E6: __EH_prolog3.LIBCMT ref: 001CF2ED

SetRectEmpty.USER32(?), ref: 001EC964
SetRectEmpty.USER32(?), ref: 001EC96D
SetRectEmpty.USER32(?), ref: 001EC99A
SetRectEmpty.USER32(?), ref: 001ECA00
SetRectEmpty.USER32(?), ref: 001ECA09
SetRectEmpty.USER32(?), ref: 001ECA12

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect$H_prolog3
String ID:
API String ID: 3752103406-0
Opcode ID: fafac61fe7c5fc40a2407f0f448dae1f76f4ef2c0e0bfc1c5456944e7ebd7944
Instruction ID: 486a64183046e86a7a2ecff3ff8c2bc313e47a732891a3b7595ede1d575df255
Opcode Fuzzy Hash: fafac61fe7c5fc40a2407f0f448dae1f76f4ef2c0e0bfc1c5456944e7ebd7944
Instruction Fuzzy Hash: 166158B0806B458FC761DF7A8588BDAFBE8BFA4300F104A1F91AE82261DBB46145CF15

Function 001D042C Relevance: 10.6, APIs: 7, Instructions: 119windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000407,00000000,?), ref: 001D046F
GetParent.USER32(?), ref: 001D049F
SendMessageW.USER32(?,00000111,?), ref: 001D04C4
GetParent.USER32(?), ref: 001D04E7
RedrawWindow.USER32(?,00000000,00000000,00000105,00000000), ref: 001D054F
GetParent.USER32(?), ref: 001D0558
GetWindowLongW.USER32(?,000000F4), ref: 001D0572

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Parent$MessageSendWindow$LongRedraw
String ID:
API String ID: 4271267155-0
Opcode ID: 411e1a2cde95bf0fa65da026c3a7934f2c6abeaf005d06ac1e15268181c5c265
Instruction ID: fee8fc0fc4374c090661d9debba833fdf3d41b045acace64e52b9ca90d90d87c
Opcode Fuzzy Hash: 411e1a2cde95bf0fa65da026c3a7934f2c6abeaf005d06ac1e15268181c5c265
Instruction Fuzzy Hash: 4C41C671101314EBEF265B20EC88F7A76A9FB8C341F14452AFA4A96291D770DC80CB61

Function 0017E845 Relevance: 10.6, APIs: 7, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0017E878
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0017E89C
UpdateWindow.USER32(?), ref: 0017E8B7
SendMessageW.USER32(?,00000121,00000000,?), ref: 0017E8D8
SendMessageW.USER32(?,0000036A,00000000,00000002), ref: 0017E8F0
UpdateWindow.USER32(?), ref: 0017E933
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0017E964

Part of subcall function 001827C8: GetWindowLongW.USER32(?,000000F0), ref: 001827D3

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 3a2468191150afe875b2adfcbd2da282231b758ccdee32e2e6cd1c3ab12e0ce2
Instruction ID: 960bd7a06048af0b52cb9ec0d5c84e87eebe43610836af1979fe86ec969aee33
Opcode Fuzzy Hash: 3a2468191150afe875b2adfcbd2da282231b758ccdee32e2e6cd1c3ab12e0ce2
Instruction Fuzzy Hash: 4141B471D00649EBDF219F66CC48EAEBFF4FF99704F2085ADE559A21A1D7318A40CB21

Function 02AFC920 Relevance: 10.6, APIs: 7, Instructions: 116networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000000,00000C00,?), ref: 02AFC9C7
_free.LIBCMT ref: 02AFC9E0

Part of subcall function 02B01DA4: HeapFree.KERNEL32(00000000,00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01DBA
Part of subcall function 02B01DA4: GetLastError.KERNEL32(00000000,?,02B045D5,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000), ref: 02B01DCC

WSASetLastError.WS2_32(00000000), ref: 02AFC9ED
_memmove.LIBCMT ref: 02AFCA33
freeaddrinfo.WS2_32(?), ref: 02AFCA41
htons.WS2_32(?), ref: 02AFCA50
WSASetLastError.WS2_32(00002AF9), ref: 02AFCA71

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ErrorLast$FreeHeap_free_memmovefreeaddrinfogetaddrinfohtons
String ID:
API String ID: 189201043-0
Opcode ID: bacce10516f2fd5cd82954153d6a89402cf4e91ed3bbc296ce71016f402e249e
Instruction ID: 264add6e7e61f742e3da244725f3c14b2eeb13f82b801a7ee9474c9ceac73798
Opcode Fuzzy Hash: bacce10516f2fd5cd82954153d6a89402cf4e91ed3bbc296ce71016f402e249e
Instruction Fuzzy Hash: 8A413071A003189FDB64DF69D881BAAB7F6EF48310F4085EAE54ED7240EB349E848F51

Function 001CC78D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001CC794

Part of subcall function 0018A349: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 0018A369

Part of subcall function 001C1ADD: __EH_prolog3.LIBCMT ref: 001C1AE4

Part of subcall function 001C1B1A: __EH_prolog3.LIBCMT ref: 001C1B21

Strings

MFCLink_Tooltip, xrefs: 001CC895
MFCLink_UrlPrefix, xrefs: 001CC811
TRUE, xrefs: 001CC868
MFCLink_Url, xrefs: 001CC7DF
MFCLink_FullTextTooltip, xrefs: 001CC843

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCLink_FullTextTooltip$MFCLink_Tooltip$MFCLink_Url$MFCLink_UrlPrefix$TRUE
API String ID: 2949695960-3373932565
Opcode ID: 362eb0aa52dd5f96b0b330c3f27e76c09db3b87fc6bd26ab9cf2e2ecebf59fa6
Instruction ID: 1f7436bee722129b564ba5eb042f41f4164ae584569060016993b53414676eb9
Opcode Fuzzy Hash: 362eb0aa52dd5f96b0b330c3f27e76c09db3b87fc6bd26ab9cf2e2ecebf59fa6
Instruction Fuzzy Hash: 71414B7195014AAADF05FBF4C852EFEB7B8AF35314F044218F526722D2DB349A189A62

Function 001A6445 Relevance: 10.6, APIs: 7, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A63B2: _malloc.LIBCMT ref: 001A63C5

_free.LIBCMT ref: 001A646E
_memset.LIBCMT ref: 001A6487
_memset.LIBCMT ref: 001A64C1
_memcpy_s.LIBCMT ref: 001A64DB
CreateDIBSection.GDI32(00000000,00000000,00000000,00000008,00000000,00000000), ref: 001A64F4
_free.LIBCMT ref: 001A6506
_free.LIBCMT ref: 001A6539

Part of subcall function 00267BF1: HeapFree.KERNEL32(00000000,00000000,?,0026E1C9,00000000,?,00000000,00268FB5,00267D05,00000000,?,00174350,8007000E,00000000,?,001788A7), ref: 00267C07
Part of subcall function 00267BF1: GetLastError.KERNEL32(00000000,?,0026E1C9,00000000,?,00000000,00268FB5,00267D05,00000000,?,00174350,8007000E,00000000,?,001788A7,0000000C), ref: 00267C19

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: _free$_memset$CreateErrorFreeHeapLastSection_malloc_memcpy_s
String ID:
API String ID: 2204576675-0
Opcode ID: 135156af38ed1976eeb8e5d0ed161d9b3a4cd725b0af22e605b9c10ae5fab450
Instruction ID: ebf233bbfc03b4ce6d72258f4f20f23c97953da846e98ab39e45469f586210af
Opcode Fuzzy Hash: 135156af38ed1976eeb8e5d0ed161d9b3a4cd725b0af22e605b9c10ae5fab450
Instruction Fuzzy Hash: 813127BAD10615ABDB20DF24CC46BAB73ACEF06764F194919F845E7241DB70EE408BA0

Function 02AFC2F0 Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000001,00000004), ref: 02AFC325
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 02AFC337
setsockopt.WS2_32(00000001,0000FFFF,000000FB,00000000,00000004), ref: 02AFC35E
setsockopt.WS2_32(00000001,0000FFFF,00000004,00000000,00000004), ref: 02AFC370

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 872a7b87cf89f4ca470cfb30df5bd5a8e7cec2be23ef788d4ee400098749c3fd
Instruction ID: 2a408765969e4f2bfff8518f2e100b33904b44e8b50dcf363c53adb607c487f6
Opcode Fuzzy Hash: 872a7b87cf89f4ca470cfb30df5bd5a8e7cec2be23ef788d4ee400098749c3fd
Instruction Fuzzy Hash: F721D8727442097EEA10D684AC81FBDB338DF46B74F600775FB14EB2C0DA7199049394

Function 02AFEF50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 02AFEF72
SetLastError.KERNEL32(00000000), ref: 02AFEF9A
GetLastError.KERNEL32 ref: 02AFEFC7
WSAGetLastError.WS2_32(?,00000001,02AFFBD3), ref: 02AFEFF6

Strings

<C-CNNID: %Iu> recv 0 bytes (detect package), xrefs: 02AFF01B
<C-CNNID: %Iu> OnReceive() event return 'HR_ERROR', connection will be closed !, xrefs: 02AFEFBA

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ErrorLast$recv
String ID: <C-CNNID: %Iu> OnReceive() event return 'HR_ERROR', connection will be closed !$<C-CNNID: %Iu> recv 0 bytes (detect package)
API String ID: 316788870-281152440
Opcode ID: a3eedb3f09c55472036e2a149adb52cc5dc50b8610367107f20bbceba740aeb5
Instruction ID: b034fa77da33f260cc55852c557a1622a74df93538bd4bdfa2d06d20d061cfb2
Opcode Fuzzy Hash: a3eedb3f09c55472036e2a149adb52cc5dc50b8610367107f20bbceba740aeb5
Instruction Fuzzy Hash: 1E31A7B16007005FD7709FA9E8C4A57B7F5EB98314F104D2EF64AC3A50EB79E5458B50

Function 001EE943 Relevance: 10.6, APIs: 7, Instructions: 90windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 001EE973
GetCursorPos.USER32(?), ref: 001EE995
GetSystemMetrics.USER32(00000044), ref: 001EE9B5
GetCapture.USER32 ref: 001EE9BD
ReleaseCapture.USER32 ref: 001EE9EF
GetParent.USER32(?), ref: 001EEA0C
SendMessageW.USER32(?,?,?,00000000), ref: 001EEA30

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Capture$Release$CursorMessageMetricsParentSendSystem
String ID:
API String ID: 237134002-0
Opcode ID: 3e0e251fdeb7f58f15312331ae18a15f45e5aa47ff7f1f1afe1b14ae2d11c2f8
Instruction ID: abeb5d0d9ea7ec893395eb419b6a19cc3ac48a1a72fe5d206708cb58db787e09
Opcode Fuzzy Hash: 3e0e251fdeb7f58f15312331ae18a15f45e5aa47ff7f1f1afe1b14ae2d11c2f8
Instruction Fuzzy Hash: B631AB75500A54EFCF25AFA5DC8C9AE7BF9FF88311F20492EF41A92261DB309940DB20

Function 001765A3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 001765DE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00176609
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00176634
RegCloseKey.ADVAPI32(?), ref: 00176648
RegCloseKey.ADVAPI32(?), ref: 00176652

Part of subcall function 001764C8: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 001764DA
Part of subcall function 001764C8: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 001764EA

Strings

software, xrefs: 001765C0

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CloseCreate$AddressHandleModuleOpenProc
String ID: software
API String ID: 550756860-2010147023
Opcode ID: 36d8f0a57eba37e315cfb16ad6afd56a2655c28f5200ea097ada470383fca34d
Instruction ID: a46ab2293278521d49f84551b4a7b00a2dbeabec9ecfbfafcc61d921d60dd319
Opcode Fuzzy Hash: 36d8f0a57eba37e315cfb16ad6afd56a2655c28f5200ea097ada470383fca34d
Instruction Fuzzy Hash: 64215872900448FB8F229B86DC88CAFBFBEEFC5754B64805AF509A2014D7309A44EB60

Function 0024AA8B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0024AA92
SetRectEmpty.USER32(?), ref: 0024AB47
CreateCompatibleDC.GDI32(00000000), ref: 0024AB4A
SetRectEmpty.USER32(?), ref: 0024AB69
CreatePen.GDI32(00000000,00000001,?), ref: 0024AB74

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Strings

(, xrefs: 0024AADD

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CreateEmptyRect$CompatibleException@8H_prolog3Throw
String ID: (
API String ID: 3214640438-1334834377
Opcode ID: 52d73cf4f94e63f8e25ff82df288ec9ec401ec245bfdf0366b6b8c109f673ba1
Instruction ID: 5d869b9d707a8ba391a59be78f6da31aa8925954f233413a4a42cdec9ec262b0
Opcode Fuzzy Hash: 52d73cf4f94e63f8e25ff82df288ec9ec401ec245bfdf0366b6b8c109f673ba1
Instruction Fuzzy Hash: 9A21A9B0811B04CBD721DF6AD981B9AFAF8BFA4340F10890FE19E97251CBB06545CF61

Function 0017E135 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017E13C
GetProcAddress.KERNEL32(00000000,RegisterTouchWindow), ref: 0017E199
GetProcAddress.KERNEL32(UnregisterTouchWindow,00000000), ref: 0017E1BB

Part of subcall function 001748E0: ActivateActCtx.KERNEL32(?,?,002BDF70,00000010,00174AC8,KERNEL32.DLL), ref: 00174900

Strings

RegisterTouchWindow, xrefs: 0017E193
UnregisterTouchWindow, xrefs: 0017E1B0
user32.dll, xrefs: 0017E15B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AddressProc$ActivateH_prolog3
String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
API String ID: 1001276555-2470269259
Opcode ID: c3800a2b7ad0d6e4a34d2af4c7da420bae8601376a43a64c97c2e77d5d0970f4
Instruction ID: a8a0dc34e31cb422e2453342017df4124b6ff6585c9228ece5b78fb0cd85cf82
Opcode Fuzzy Hash: c3800a2b7ad0d6e4a34d2af4c7da420bae8601376a43a64c97c2e77d5d0970f4
Instruction Fuzzy Hash: 7C1154315112699BDB54DB38FE4A72D3BF0BF183A4F60807AE81AC22A0CB709550CB50

Function 00174630 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00174642
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryInProgress), ref: 0017465F
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryFinished), ref: 00174669

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Strings

KERNEL32.DLL, xrefs: 0017463A
ApplicationRecoveryFinished, xrefs: 00174661
ApplicationRecoveryInProgress, xrefs: 00174659

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AddressProc$Exception@8HandleModuleThrow
String ID: ApplicationRecoveryFinished$ApplicationRecoveryInProgress$KERNEL32.DLL
API String ID: 2144170044-4287352451
Opcode ID: 43df900be7fefc7483705cdb2a307aa920303cfc15b2c1625ed1cee7bced3e96
Instruction ID: 36a891000f76733b1fff4c08b3b80f2c19bca06ef404e3b9e41f6098433fe95b
Opcode Fuzzy Hash: 43df900be7fefc7483705cdb2a307aa920303cfc15b2c1625ed1cee7bced3e96
Instruction Fuzzy Hash: C001B13AA10619AFD710ABB28848A6E77B8DF86760F214069F905A3240EF70DD4587A0

Function 001745C4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 001745D1
GetProcAddress.KERNEL32(00000000,RegisterApplicationRestart), ref: 001745EE
GetProcAddress.KERNEL32(00000000,RegisterApplicationRecoveryCallback), ref: 001745F8

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Strings

KERNEL32.DLL, xrefs: 001745CC
RegisterApplicationRestart, xrefs: 001745E8
RegisterApplicationRecoveryCallback, xrefs: 001745F0

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AddressProc$Exception@8HandleModuleThrow
String ID: KERNEL32.DLL$RegisterApplicationRecoveryCallback$RegisterApplicationRestart
API String ID: 2144170044-723216104
Opcode ID: f48afb047acc8045eb99d62f13b24a0e7a1621806c99cd8ee1fc2221fe53c3e6
Instruction ID: 550c64183f295b94f12b0bc485c73b6ae502412e643294d0e3119c53d3cc3021
Opcode Fuzzy Hash: f48afb047acc8045eb99d62f13b24a0e7a1621806c99cd8ee1fc2221fe53c3e6
Instruction Fuzzy Hash: A2F0683661521AB74F212EA59C04C6B3FB9DF967A2F048026FD0892151EB71CC259BB1

Function 02AFA860 Relevance: 10.5, APIs: 7, Instructions: 42filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?,02AFA9C5,?,?,?,?,74DEE010,74DF23A0), ref: 02AFA86D
CreateFileW.KERNEL32(02B221E8,40000000,00000002,00000000,00000004,00000080,00000000,?,?,02AFA9C5,?,?,?,?,74DEE010,74DF23A0), ref: 02AFA88A
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 02AFA8A0
lstrlenW.KERNEL32(?,00000000,00000000), ref: 02AFA8AD
WriteFile.KERNEL32(00000000,?,00000000), ref: 02AFA8B8
CloseHandle.KERNEL32(00000000), ref: 02AFA8BF
ReleaseMutex.KERNEL32(?), ref: 02AFA8CC

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: 8664941c55634cba67e45c656e7c15ae9863fdbc621627902318aa2a9ca9a357
Instruction ID: bda53475b96f75980ca3dd16029687a65da1f8d024c28eb28d9ec6c69373520c
Opcode Fuzzy Hash: 8664941c55634cba67e45c656e7c15ae9863fdbc621627902318aa2a9ca9a357
Instruction Fuzzy Hash: 3FF044B1AC1310BBE7205B94AC0EF6A3F7CEB45B51F514604F711E71C0C6B0196487A5

Function 02B044B7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,02B19218,00000008,02B045BF,00000000,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C), ref: 02B044C8
__lock.LIBCMT ref: 02B044FC

Part of subcall function 02B0B9EB: __mtinitlocknum.LIBCMT ref: 02B0BA01
Part of subcall function 02B0B9EB: __amsg_exit.LIBCMT ref: 02B0BA0D
Part of subcall function 02B0B9EB: EnterCriticalSection.KERNEL32(00000000,00000000,?,02B0468F,0000000D,02B19240,00000008,02B04786,00000000,?,02B02A68,00000000,02B191B8,00000008,02B02ACD,?), ref: 02B0BA15

InterlockedIncrement.KERNEL32(?), ref: 02B04509
__lock.LIBCMT ref: 02B0451D
___addlocaleref.LIBCMT ref: 02B0453B

Strings

KERNEL32.DLL, xrefs: 02B044C3

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 004253e2fa0936e7da2572c0045c274b4406a685064b9e407ac3977fe015906e
Instruction ID: 78d8e3d2736153ca26238dd4336e3ca2f51102b9a7cbf755a3e09676890ef9cc
Opcode Fuzzy Hash: 004253e2fa0936e7da2572c0045c274b4406a685064b9e407ac3977fe015906e
Instruction Fuzzy Hash: 92018E718807009BE721AF65D484309BFF1AF40710F50498EE1A6972E0CBB4AA408F11

Function 001887C3 Relevance: 10.5, APIs: 7, Instructions: 30COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 001887D1
GetSysColor.USER32(00000010), ref: 001887D8
GetSysColor.USER32(00000014), ref: 001887DF
GetSysColor.USER32(00000012), ref: 001887E6
GetSysColor.USER32(00000006), ref: 001887ED
GetSysColorBrush.USER32(0000000F), ref: 001887FA
GetSysColorBrush.USER32(00000006), ref: 00188801

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 75e7e66ab5eb1aeb8a5b5f3682bb7b68e322e2081e13e287b23cc1f3455f48d8
Instruction ID: fdc6dbc473b1d1bccd9e054ed0de9b8bc7d7e2b015c429dc94c2a433851a6520
Opcode Fuzzy Hash: 75e7e66ab5eb1aeb8a5b5f3682bb7b68e322e2081e13e287b23cc1f3455f48d8
Instruction Fuzzy Hash: 55F0FE719417485BD730BB729D09B47BAD5FFC4710F12092EE2458B990D7B6E441DF50

Function 02B0806F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02B08090

Part of subcall function 02B045E4: __getptd_noexit.LIBCMT ref: 02B045E7
Part of subcall function 02B045E4: __amsg_exit.LIBCMT ref: 02B045F4

__getptd.LIBCMT ref: 02B080A1
__getptd.LIBCMT ref: 02B080AF

Strings

RCC, xrefs: 02B0807B
csm, xrefs: 02B08089
MOC, xrefs: 02B08082

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 7e3bf4b765b8d53e2a5d32d05a4cce22e9951bf9490a18b9bfdbb2a344a06d31
Instruction ID: 10309cb2045b4fbbe5f092c88e2c05a47263f71f333b4c74b3d2ad1c67dab254
Opcode Fuzzy Hash: 7e3bf4b765b8d53e2a5d32d05a4cce22e9951bf9490a18b9bfdbb2a344a06d31
Instruction Fuzzy Hash: 9EE012341001148FC7259769C1C9B6C3AA6FF45318F1501E2D50DC72A2D724D6908A43

Function 001D4603 Relevance: 9.5, APIs: 6, Instructions: 469COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D460D
GetObjectW.GDI32(?,00000018,?), ref: 001D46C0
DeleteObject.GDI32(?), ref: 001D478C
_memset.LIBCMT ref: 001D497B
_memset.LIBCMT ref: 001D49BF
DeleteObject.GDI32(?), ref: 001D4B75

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Object$Delete_memset$H_prolog3
String ID:
API String ID: 1235337548-0
Opcode ID: b7899c9ea374a28812a4f0117bb1b4c288779b521819ebc1cd254db672159988
Instruction ID: 39c25ae954c6270348c350aa50c855f68755786931585721a2e04ea50d0f6017
Opcode Fuzzy Hash: b7899c9ea374a28812a4f0117bb1b4c288779b521819ebc1cd254db672159988
Instruction Fuzzy Hash: 5D1216B0D00229DBCF25DFA4D984AEDBBB5FF09700F20819AE559A7351DB309A94CF94

Function 001907E8 Relevance: 9.3, APIs: 6, Instructions: 299COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00190862
GetClientRect.USER32(?,?), ref: 00190875
GetWindowRect.USER32(?,?), ref: 001908C3
GetParent.USER32(?), ref: 001908CC
GetParent.USER32(?), ref: 00190AE9
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 00190B0D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Parent$RectWindow$ClientRedraw
String ID:
API String ID: 443302174-0
Opcode ID: 97ecb809f099b545eda2debafb17ab9ec1531e44c2066aba8e4c97d93fc990c7
Instruction ID: 0d59ec10b91eb28a69a35cf0a2b0bd0192fc58d6ffc0da1c53d800d772caa6f4
Opcode Fuzzy Hash: 97ecb809f099b545eda2debafb17ab9ec1531e44c2066aba8e4c97d93fc990c7
Instruction Fuzzy Hash: A0B11831A012199FCF16DFA8C898AEEBBB5FF4D710F1441A9E416EB255DB309940CFA1

Function 001BA2AE Relevance: 9.2, APIs: 6, Instructions: 221COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001BA2E0

Part of subcall function 001827E2: GetWindowLongW.USER32(?,000000EC), ref: 001827ED

GetWindowRect.USER32(?,?), ref: 001BA3DB
GetParent.USER32(?), ref: 001BA3E8
GetParent.USER32(?), ref: 001BA402
OffsetRect.USER32(?,?,?), ref: 001BA4CF
OffsetRect.USER32(?,?,?), ref: 001BA4DB

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$OffsetParent$Long
String ID:
API String ID: 2171155602-0
Opcode ID: ec8e5c2f9545ff6e374bb81415d2454fef29c6b062a36c50bfea333ae9ed9620
Instruction ID: b8ac1ae286676a95eba0d32307e60d0627cfb2aafec4b59b376520322913eef1
Opcode Fuzzy Hash: ec8e5c2f9545ff6e374bb81415d2454fef29c6b062a36c50bfea333ae9ed9620
Instruction Fuzzy Hash: D591FD75D00209EFCF15DFA8D988AEEBBB5FF48300F64406AE905A7211DB74AA40CF61

Function 001FC579 Relevance: 9.2, APIs: 6, Instructions: 208windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001FC580

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Part of subcall function 0018065B: GetParent.USER32(?), ref: 00180665

SendMessageW.USER32(?,?,00000000,00000000), ref: 001FC6AF

Part of subcall function 001B3C58: __EH_prolog3_catch.LIBCMT ref: 001B3C62
Part of subcall function 001B3C58: CloseHandle.KERNEL32(X ,?,X ,00000080,002058E5,?,00000000,?,00000000), ref: 001B3C9B
Part of subcall function 001B3C58: GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,X ,00000080,002058E5,?,00000000,?,00000000), ref: 001B3CC2
Part of subcall function 001B3C58: GetTempFileNameW.KERNEL32(00000000,AFX,00000000,00000000,00000104,00000000,?,00000000), ref: 001B3CF9
Part of subcall function 001B3C58: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,04000100,00000000,?,00000000), ref: 001B3D1B

SendMessageW.USER32(?,00000366,00000000,00000000), ref: 001FC762
SendMessageW.USER32(?,0000C124,?,00000000), ref: 001FC780
InvalidateRect.USER32(?,00000000,00000001), ref: 001FC7F5
UpdateWindow.USER32(?), ref: 001FC7FE

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$FileTemp$CloseCreateException@8H_prolog3H_prolog3_catchHandleInvalidateNameParentPathRectThrowUpdateWindow
String ID:
API String ID: 3282921405-0
Opcode ID: da048df6961e7e0598334c1cab0bf2b9d06e25ee79b7b0ed9140bebe976ea6e1
Instruction ID: 2d7a60b30b48513d8cf6ed79e7c9526d4667573a35583f8088e01208b9a59973
Opcode Fuzzy Hash: da048df6961e7e0598334c1cab0bf2b9d06e25ee79b7b0ed9140bebe976ea6e1
Instruction Fuzzy Hash: CB71C0746006089BCF26AF74C954DAE7BB6FF88710F14462AFA4A9B361DF319940DF90

Function 001C2223 Relevance: 9.2, APIs: 6, Instructions: 177windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001C222A
GetClientRect.USER32(?,?), ref: 001C2270

Part of subcall function 00179FE9: __EH_prolog3.LIBCMT ref: 00179FF0
Part of subcall function 00179FE9: GetDC.USER32(00000000), ref: 0017A01C

Part of subcall function 0017A336: SelectObject.GDI32(?,00000000), ref: 0017A35C
Part of subcall function 0017A336: SelectObject.GDI32(?,?), ref: 0017A372

SendMessageW.USER32(?,00000030,?,00000000), ref: 001C22C1
GetTextMetricsW.GDI32(?,?), ref: 001C22CE
GetParent.USER32(?), ref: 001C23B3
SendMessageW.USER32(?,00000030,?,00000000), ref: 001C23DE

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageObjectSelectSend$ClientH_prolog3H_prolog3_MetricsParentRectText
String ID:
API String ID: 1207058154-0
Opcode ID: 10eddb33bcb164687f0658a9e9736cf5f44a98a9a3c5cb8d7e6980d435743fbc
Instruction ID: 76497557b0436bc7eced28de78ec587904e78bacba95e0c5d1e363cb64966bdd
Opcode Fuzzy Hash: 10eddb33bcb164687f0658a9e9736cf5f44a98a9a3c5cb8d7e6980d435743fbc
Instruction Fuzzy Hash: B85190729002159FDF25DFA8C885FAE77BABF98700F158129ED09AB255DB30AD41CB60

Function 0019226D Relevance: 9.2, APIs: 6, Instructions: 155windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 001922E6
SendMessageW.USER32(00000000,0000040C,00000000,00000000), ref: 00192325
SendMessageW.USER32(00000000,0000041C,00000000,?), ref: 00192354
SetRectEmpty.USER32(?), ref: 001923AE
SendMessageW.USER32(00000000,0000040B,00000000,?), ref: 00192414
RedrawWindow.USER32(00000000,00000000,00000000,00000505), ref: 0019243A

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$EmptyParentRectRedrawWindow
String ID:
API String ID: 3879113052-0
Opcode ID: f536135a10f50803a6e71b50019f56e2024017a4d8eda0868b78665a6e853e6d
Instruction ID: 5802f783185a07ab63b5656d7fa0b490f2e2eea374c102e1808d8e5ac4d9fac4
Opcode Fuzzy Hash: f536135a10f50803a6e71b50019f56e2024017a4d8eda0868b78665a6e853e6d
Instruction Fuzzy Hash: 2E514771A00619AFDF25DFA8C884BADBBF5FF48700F20416AE546E7291EB70A940CF50

Function 001781F5 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 001781FC
GlobalLock.KERNEL32(?), ref: 001782E2
CreateDialogIndirectParamW.USER32(?,?,?,00177BD4,00000000), ref: 00178311
DestroyWindow.USER32(00000000), ref: 0017838B
GlobalUnlock.KERNEL32(?), ref: 0017839B
GlobalFree.KERNEL32(?), ref: 001783A4

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Global$CreateDestroyDialogFreeH_prolog3_catchIndirectLockParamUnlockWindow
String ID:
API String ID: 3003189058-0
Opcode ID: dc7eab0576ef5158abc61c3407b133cb9dad8d659d463db57722b11faf94c159
Instruction ID: 8d6d2eeb4c0d0e3e3d0f0acdb18629adb7502c7467dab4669f025130465250d4
Opcode Fuzzy Hash: dc7eab0576ef5158abc61c3407b133cb9dad8d659d463db57722b11faf94c159
Instruction Fuzzy Hash: 1351BF31940209DFCF14EFA4C8899EEBBB5BF58315F24856DF50AA7292CF348A41CB61

Function 002126D7 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

__EH_prolog3.LIBCMT ref: 00212733
GetTopWindow.USER32(?), ref: 0021279E
GetWindow.USER32(?,00000002), ref: 002127BC
IsWindow.USER32(?), ref: 002127DB
GetParent.USER32(?), ref: 002127E6
DestroyWindow.USER32(?,?,?,001A7718), ref: 002127F2

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$DestroyException@8H_prolog3ParentThrow
String ID:
API String ID: 3731540811-0
Opcode ID: 93231cddf73f2969c446f4483b7ce1420de5f9736742b50d50ad4af2da5591a1
Instruction ID: a16c135e9041c590f292a0f8ff992f661e6f2b507fe059d85bd0e15b9927f468
Opcode Fuzzy Hash: 93231cddf73f2969c446f4483b7ce1420de5f9736742b50d50ad4af2da5591a1
Instruction Fuzzy Hash: 51412F34920221DBCF21EF64D885AEEF7F0BF64710F250159F855BB290DB709DA58BA0

Function 001C6166 Relevance: 9.1, APIs: 6, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001C61C5
SendMessageW.USER32(?,0000120C,00000000,00000001), ref: 001C6207
SendMessageW.USER32(?,0000120C,00000001,00000001), ref: 001C6229
SendMessageW.USER32(?,00000201,00000000,00000000), ref: 001C62A3
SendMessageW.USER32(?,00000202,00000000,00000000), ref: 001C62BB
PtInRect.USER32(?,?,?), ref: 001C62D7

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Rect$Client
String ID:
API String ID: 4194289498-0
Opcode ID: d56162911102de06db04eca0fd78e76eef60b69db3e592458a461e25df8ad509
Instruction ID: ea05c80ad2bda80193b2cf9815accd1a19c661e5ac42aeb716d5d6700e531722
Opcode Fuzzy Hash: d56162911102de06db04eca0fd78e76eef60b69db3e592458a461e25df8ad509
Instruction Fuzzy Hash: AB513971901229DFCB11DFA8C888E9E7BB9FF59700F1501B9E809AB255CB71ED41CBA1

Function 001F4767 Relevance: 9.1, APIs: 6, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 001F4829
GetCursorPos.USER32(00000000), ref: 001F4849
ScreenToClient.USER32(00000000,00000000), ref: 001F4856
PtInRect.USER32(?,00000000,00000000), ref: 001F4869
SendMessageW.USER32(?,00000000,00301DC4), ref: 001F489F
SendMessageW.USER32(00000000,00000000,00301DC4), ref: 001F48B8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$ClientCursorParentRectScreen
String ID:
API String ID: 4164469669-0
Opcode ID: 949275d00158bc96f31fbad4d0db3ea6ef5fc46c5e3a60ae519e395286382969
Instruction ID: ccb80766b6abfb989bef8cc9e63c04b73c3727002f9c113bb0365c21a15f87bb
Opcode Fuzzy Hash: 949275d00158bc96f31fbad4d0db3ea6ef5fc46c5e3a60ae519e395286382969
Instruction Fuzzy Hash: 2941B131A01209AFDB11AFA5EC94BBB77FDBF54344F044169F609D71A0EB709900CB60

Function 02AF6520 Relevance: 9.1, APIs: 6, Instructions: 107COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02AF652F

Part of subcall function 02B01DDE: __FF_MSGBANNER.LIBCMT ref: 02B01DF7
Part of subcall function 02B01DDE: __NMSG_WRITE.LIBCMT ref: 02B01DFE
Part of subcall function 02B01DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01E23

_free.LIBCMT ref: 02AF6553
_memset.LIBCMT ref: 02AF65AB

Part of subcall function 02AF6EB0: GetObjectW.GDI32(?,00000054,?), ref: 02AF6ECD

CreateDIBSection.GDI32(00000000,00000008,00000000,00000000,00000000,00000000), ref: 02AF65C3
_free.LIBCMT ref: 02AF65D4
_free.LIBCMT ref: 02AF6613

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _free$AllocateCreateHeapObjectSection_malloc_memset
String ID:
API String ID: 1756752955-0
Opcode ID: 7565f05c7492df0a9e3f1686e47385eb9c31a02207613e02148648f55418e40d
Instruction ID: 5c4b1629550a3ed5ff005f90d02b83f0500e592bb399bb45fc24bfbf417e92d1
Opcode Fuzzy Hash: 7565f05c7492df0a9e3f1686e47385eb9c31a02207613e02148648f55418e40d
Instruction Fuzzy Hash: 4D31C0B26003056BE750DFA9D8C0B56B7E8BF48714F04453AEB19DB281FBB5E554CB90

Function 02AFC6E0 Relevance: 9.1, APIs: 6, Instructions: 99networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 02AFC6FD
WSAAddressToStringW.WS2_32(?,-0000001D,00000000,?,?), ref: 02AFC721
htons.WS2_32(?), ref: 02AFC73E
StrPBrkW.SHLWAPI(?,02B14AF8), ref: 02AFC763
StrChrW.SHLWAPI(?,00000025), ref: 02AFC76E
_memmove.LIBCMT ref: 02AFC79D

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: htons$AddressString_memmove
String ID:
API String ID: 2092185379-0
Opcode ID: 62119fed8f25795d8d5351a45f1482a46a5c5a929129fdc92bdadfd344f54610
Instruction ID: 9dd73bd8e5d223c7a21a322796f29ccb50033dec4cae5ae882866fa776572d75
Opcode Fuzzy Hash: 62119fed8f25795d8d5351a45f1482a46a5c5a929129fdc92bdadfd344f54610
Instruction Fuzzy Hash: 5A212276600219DBD714CF79EC80AAA73BEEF88724B14842AF909D7280EB34D840C6A0

Function 00196AD4 Relevance: 9.1, APIs: 6, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00196B05
OffsetRect.USER32(?,?,?), ref: 00196B23
SendMessageW.USER32(00000000,0000000B,00000000,00000000), ref: 00196B30
IsWindowVisible.USER32(?), ref: 00196B39
SendMessageW.USER32(00000014,0000000B,00000001,00000000), ref: 00196BAC
RedrawWindow.USER32(00000105,00000000,00000000,00000105), ref: 00196BBC

Part of subcall function 001829B1: SetWindowPos.USER32(?,000000FF,000000FF,?,?,00000000,0017E834,?,0017E834,00000000,?,?,000000FF,000000FF,00000015), ref: 001829D9

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$MessageRectSend$OffsetRedrawVisible
String ID:
API String ID: 2707749077-0
Opcode ID: aa42a27ce9762116c73bb798fc651ea0d3b86dd63e1d19594014a592bbed4c58
Instruction ID: a117b3323c36e568c00e3d03a001f2711baf16885957bca8622e31416ff0258f
Opcode Fuzzy Hash: aa42a27ce9762116c73bb798fc651ea0d3b86dd63e1d19594014a592bbed4c58
Instruction Fuzzy Hash: B6310F76A00219BFEB11DFA4DD89EBFBBBDFB48304F100528F556A2290D770AD109B20

Function 02AF30E0 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF310C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 02AF3118
Process32FirstW.KERNEL32(00000000,00000000), ref: 02AF3149
Process32NextW.KERNEL32(00000000,0000022C), ref: 02AF319F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 02AF31A6

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 0a003faf3406656d2a35f1dcd2154314916e02a5decdfe828d653b422dfdd7c3
Instruction ID: 73ac6ad923ae1bc03fe5529e0d27218f04db415cb050b978e636fc70e3bbaa79
Opcode Fuzzy Hash: 0a003faf3406656d2a35f1dcd2154314916e02a5decdfe828d653b422dfdd7c3
Instruction Fuzzy Hash: 3621E731A11115ABDF20EFA4EC99BEAB3B5EF14364F4006D9ED0A931C0EB359A58CA54

Function 001D213D Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

PatBlt.GDI32(00000000,00000000,001B3862,000000C6,00FF0062,00000000), ref: 001D2164
SetBkColor.GDI32(00F0F0F0), ref: 001D2187
BitBlt.GDI32(00000000,00000000,001B3864,000000C8,00000000,00000000,00CC0020), ref: 001D21B5
SetBkColor.GDI32 ref: 001D21C8
BitBlt.GDI32(00000000,00000000,001B3864,000000C8,00000000,00000000,00EE0086), ref: 001D21F0
BitBlt.GDI32(00010E69,00000001,00000001,001B3865,000000C9,00010E69,00000000,00000000,008800C6), ref: 001D2213

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Color
String ID:
API String ID: 2811717613-0
Opcode ID: 5d8e0701b67f1e45d9e4dd50c0de729889a2ac7fd1bb31c7c093746173c4f542
Instruction ID: e34d6b56a7d21bf41f41abfa31c685365d2d4503d1ed544514fa5134609c786b
Opcode Fuzzy Hash: 5d8e0701b67f1e45d9e4dd50c0de729889a2ac7fd1bb31c7c093746173c4f542
Instruction Fuzzy Hash: 8C215076212308FFD7259F94ED99D7777ADFB48398B10452AF60282670C7B1AC50DB20

Function 02AFBEC0 Relevance: 9.1, APIs: 6, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,CD663CB9), ref: 02AFBF16
SetLastError.KERNEL32(00000000), ref: 02AFBF24
DeleteCriticalSection.KERNEL32(?), ref: 02AFBF4E
DeleteCriticalSection.KERNEL32(?), ref: 02AFBF54
CloseHandle.KERNEL32(?), ref: 02AFBF67
_free.LIBCMT ref: 02AFBF8A

Part of subcall function 02AFF2F0: GetCurrentThreadId.KERNEL32 ref: 02AFF2F4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalDeleteSection$CloseCurrentErrorHandleLastObjectSingleThreadWait_free
String ID:
API String ID: 2652704522-0
Opcode ID: 350eecff2e90a5d86193bb988b607bb8776f4dd6dc85568451b172db7a7ad04b
Instruction ID: bde0bc55e3dd7ba20a4ce4f2c3a3e3dbf345e81e79653d82dbcc5313f7eab1e5
Opcode Fuzzy Hash: 350eecff2e90a5d86193bb988b607bb8776f4dd6dc85568451b172db7a7ad04b
Instruction Fuzzy Hash: 3F3193B19443459BCB10DFA8C980A9AFBF8FB19714F500D6EE556D3340DB78A554CF60

Function 001CC613 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001CC61A

Part of subcall function 00182946: IsWindowEnabled.USER32(?), ref: 0018294F

InvalidateRect.USER32(?,00000000,00000001,0000000C,001CC72F), ref: 001CC646
UpdateWindow.USER32(?), ref: 001CC64F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$EnabledH_prolog3InvalidateRectUpdate
String ID:
API String ID: 262192325-0
Opcode ID: 4e4be71a5ee86d562cbb41b3e4fa4bd68cf5dddd8065e3b8cec0a8c45d62759c
Instruction ID: 922cb672b4d135f6efe621c3f8e851f99807dd27ac018290c0c22642f8e926af
Opcode Fuzzy Hash: 4e4be71a5ee86d562cbb41b3e4fa4bd68cf5dddd8065e3b8cec0a8c45d62759c
Instruction Fuzzy Hash: 8D217F75800644AFC711EBB4DD89EAFBBB8FF98314F20461DF15A92291DB30AA01DF61

Function 02AFEA50 Relevance: 9.1, APIs: 6, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000023), ref: 02AFEA6B
WSAGetLastError.WS2_32 ref: 02AFEA76
SetLastError.KERNEL32(00000000), ref: 02AFEAA6
send.WS2_32(?,00000000,00000000,00000000), ref: 02AFEAC7
WSAGetLastError.WS2_32 ref: 02AFEAD2
GetLastError.KERNEL32 ref: 02AFEAF5

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: fda97f66fee226f24ace6176aa60430f751b9e3e359420946dcf8e89599709da
Instruction ID: 439c0d91900e5c9c9c9997e225e0842f969176e9d3a49c2a5beb903353b3622c
Opcode Fuzzy Hash: fda97f66fee226f24ace6176aa60430f751b9e3e359420946dcf8e89599709da
Instruction Fuzzy Hash: 042150716407008FD330DFAAE848B17BBF5FB94765F108A29F656C7690D775E4148B90

Function 001767B0 Relevance: 9.1, APIs: 6, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(00000000,?), ref: 001767D8
RegDeleteValueW.ADVAPI32(00000000,?), ref: 001767F7
RegCloseKey.ADVAPI32(00000000), ref: 00176824

Part of subcall function 001765A3: RegCloseKey.ADVAPI32(?), ref: 00176648
Part of subcall function 001765A3: RegCloseKey.ADVAPI32(?), ref: 00176652

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0017683F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Close$Delete$PrivateProfileStringValueWrite
String ID:
API String ID: 1330817964-0
Opcode ID: a26fd8bc2baa2e201093d5257f690501358ab04bd3d19f6b138d49ec7136fbc7
Instruction ID: ecdb99b3223fb892c260de3a2f8f399ea46325782339382852c7f2a3d5aae684
Opcode Fuzzy Hash: a26fd8bc2baa2e201093d5257f690501358ab04bd3d19f6b138d49ec7136fbc7
Instruction Fuzzy Hash: 80115137401655FFCF252FA0EC888AE7B79FF08399B25C439FA1995020D7328951EBA1

Function 02B08321 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 02B08349

Part of subcall function 02B02F2B: __getptd.LIBCMT ref: 02B02F39
Part of subcall function 02B02F2B: __getptd.LIBCMT ref: 02B02F47

__getptd.LIBCMT ref: 02B08353

Part of subcall function 02B045E4: __getptd_noexit.LIBCMT ref: 02B045E7
Part of subcall function 02B045E4: __amsg_exit.LIBCMT ref: 02B045F4

__getptd.LIBCMT ref: 02B08361
__getptd.LIBCMT ref: 02B0836F
__getptd.LIBCMT ref: 02B0837A
_CallCatchBlock2.LIBCMT ref: 02B083A0

Part of subcall function 02B02FD0: __CallSettingFrame@12.LIBCMT ref: 02B0301C

Part of subcall function 02B08447: __getptd.LIBCMT ref: 02B08456
Part of subcall function 02B08447: __getptd.LIBCMT ref: 02B08464

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: fd36c95ad77e40d81914a053e419d17ad7d7f942a983fd82479e98e26923600c
Instruction ID: 8e941921790e160790585f47c06f7bed04c1ee913c315ad5c950b637875acba6
Opcode Fuzzy Hash: fd36c95ad77e40d81914a053e419d17ad7d7f942a983fd82479e98e26923600c
Instruction Fuzzy Hash: 3011D775C00249DFDF02EFA4D584BAD7BB1FF04314F1081AAE915AB291DB389A15DF50

Function 02B06E26 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02B06E32

Part of subcall function 02B045E4: __getptd_noexit.LIBCMT ref: 02B045E7
Part of subcall function 02B045E4: __amsg_exit.LIBCMT ref: 02B045F4

__amsg_exit.LIBCMT ref: 02B06E52
__lock.LIBCMT ref: 02B06E62
InterlockedDecrement.KERNEL32(?), ref: 02B06E7F
_free.LIBCMT ref: 02B06E92
InterlockedIncrement.KERNEL32(03481658), ref: 02B06EAA

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 7e5b672883d603a184a37c589e73da16d1982371fc97257b3cba89f0c669ec03
Instruction ID: 8bb38b2697bcadb81b11e01cdce7dbfe49eb9749011fc219bffed0a6b168c0d1
Opcode Fuzzy Hash: 7e5b672883d603a184a37c589e73da16d1982371fc97257b3cba89f0c669ec03
Instruction Fuzzy Hash: B0016932D81721ABDB23AB68D18479E7FA5FF01B60F440586E914A72D0CB64E961CFD2

Function 0019A343 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 001827E2: GetWindowLongW.USER32(?,000000EC), ref: 001827ED

GetClientRect.USER32(?,?), ref: 0019A46E
GetAsyncKeyState.USER32(00000011), ref: 0019A514

Strings

', xrefs: 0019A3BF

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AsyncClientLongRectStateWindow
String ID: '
API String ID: 304971295-1997036262
Opcode ID: dd47fbaa51e8b63b85fd5d5e33200c5979af39d5af06f3ab024b5d9c9d2b30d5
Instruction ID: 767bad9e1ea0f845eed3698af8770b8ff861c317efa9813eecb458a1d6912ec6
Opcode Fuzzy Hash: dd47fbaa51e8b63b85fd5d5e33200c5979af39d5af06f3ab024b5d9c9d2b30d5
Instruction Fuzzy Hash: DCB14D30B006069BDF299F64C499BBDB7E5BF54300FA9012DE546DB290DB70AD88CBD2

Function 02AF6490 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 02AF64C2
EnterCriticalSection.KERNEL32(02B21D64,?,?,?,02AF646B), ref: 02AF64D3
EnterCriticalSection.KERNEL32(02B21D64,?,?,?,02AF646B), ref: 02AF64E8
GdiplusShutdown.GDIPLUS(00000000,?,?,?,02AF646B), ref: 02AF64F4
LeaveCriticalSection.KERNEL32(02B21D64,?,?,?,02AF646B), ref: 02AF6505
LeaveCriticalSection.KERNEL32(02B21D64,?,?,?,02AF646B), ref: 02AF650C

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 0e7b20ec340284fcbb634d4383a224289013b16e671004f5c548e871bb9d19d5
Instruction ID: 1d77d355e386c6dc77c329cb632781cf166a0bdbdf882b54b2f6bd696d16296b
Opcode Fuzzy Hash: 0e7b20ec340284fcbb634d4383a224289013b16e671004f5c548e871bb9d19d5
Instruction Fuzzy Hash: E0015EB1950340DF97249FAAE880405BFB4FF4C39536085AEE11DD7216C772D4178F90

Function 02AF1EC0 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 02AF1ED0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02AF1ED8
CloseHandle.KERNEL32(?), ref: 02AF1EE4
Sleep.KERNEL32(000003E8), ref: 02AF1EEB
CloseHandle.KERNEL32(?), ref: 02AF1F16
CloseHandle.KERNEL32(?), ref: 02AF1F1C

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CloseHandle$ObjectSingleWait$Sleep
String ID:
API String ID: 349258274-0
Opcode ID: d854b1694ffe9e524e63f3f8590bffc5b6f7cd0e48aceed31ce4c55fa49764b2
Instruction ID: 405066691c6990ab75038952f1e09074c52a2dfaa4cb4b0c7df76e3665625e61
Opcode Fuzzy Hash: d854b1694ffe9e524e63f3f8590bffc5b6f7cd0e48aceed31ce4c55fa49764b2
Instruction Fuzzy Hash: 7AF0EC756047149BC328EBAADD84C16F7E9EFC93243268A1DE556937A0CA74FC41CF50

Function 001B0594 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B059B
InflateRect.USER32(?,000000FF,00000000), ref: 001B05C2
InflateRect.USER32(?,000000FF,000000FE), ref: 001B05E0
FillRect.USER32(?,?,000000FF), ref: 001B05FD

Strings

(, xrefs: 001B06F8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Inflate$FillH_prolog3_
String ID: (
API String ID: 3515757206-1334834377
Opcode ID: 235e476ca4cc37afcf303e6065ead9d36b297638883a86369c89a1736aae2e94
Instruction ID: 54ff1cb795e2d2447a587b20d952e73ce23f515996f5fb223f56f19aece54cb6
Opcode Fuzzy Hash: 235e476ca4cc37afcf303e6065ead9d36b297638883a86369c89a1736aae2e94
Instruction Fuzzy Hash: 3551267190010EEFCF12EFA4CD81CEE7BBAEF58354B114229F815A2291DB319D69DB60

Function 001C4220 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143memorywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001C422A
_memset.LIBCMT ref: 001C4292
GlobalAlloc.KERNEL32(00000040,0000000C), ref: 001C42AB
SendMessageW.USER32 ref: 001C4394

Strings

g, xrefs: 001C429D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AllocGlobalH_prolog3MessageSend_memset
String ID: g
API String ID: 653267268-30677878
Opcode ID: d4c17395e3cfb436f73d5f133e8ecaa1f8d6b42aeba819ddc4dd31e538b7f475
Instruction ID: 2cbfbac621821dc51068791609f452d1ac8636d96ad23cf1de6050ab91845b60
Opcode Fuzzy Hash: d4c17395e3cfb436f73d5f133e8ecaa1f8d6b42aeba819ddc4dd31e538b7f475
Instruction Fuzzy Hash: 95511871A002199FDB04DFA4C899FEEBBB4BF48300F148569F615EB291DB74A945CF60

Function 02AF3720 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02AF372B
CoCreateInstance.OLE32(02B16F9C,00000000,00000001,02B16FDC,?,?,?,?,?,?,?,?,?,?,02AF27A0,00000000), ref: 02AF3742
SysFreeString.OLEAUT32(?), ref: 02AF37DC
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,02AF27A0,00000000,00000000,?), ref: 02AF380D

Strings

FriendlyName, xrefs: 02AF37CB

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: 5ac1c50bcf592eb2987d93323a01ef56b6858432f59074938742c5964d56aaec
Instruction ID: 2ddc3eb7633575fee5c3fc93d42d4adc9c09db14050ed1a797f5f02e6c677490
Opcode Fuzzy Hash: 5ac1c50bcf592eb2987d93323a01ef56b6858432f59074938742c5964d56aaec
Instruction Fuzzy Hash: A2310A75B40209AFEB10DB99DC81EAEB7B9EFC8704F148598F605EB250DB71E901CB60

Function 02AF6000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF6016

Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B12857
Part of subcall function 02B12842: __CxxThrowException@8.LIBCMT ref: 02B1286C
Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B1287D

std::_Xinvalid_argument.LIBCPMT ref: 02AF604D

Part of subcall function 02B127F5: std::exception::exception.LIBCMT ref: 02B1280A
Part of subcall function 02B127F5: __CxxThrowException@8.LIBCMT ref: 02B1281F
Part of subcall function 02B127F5: std::exception::exception.LIBCMT ref: 02B12830

_memmove.LIBCMT ref: 02AF60AB

Strings

invalid string position, xrefs: 02AF6011
string too long, xrefs: 02AF6048

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 9852e8edd5a3a3601fd9c1ca091a60ff3d963db353e41963ae7d1d3ebe7da1d6
Instruction ID: e236f24a9d0c32445e6d49a1b9d269077106d6c3c628870ba9cf01703bcdad13
Opcode Fuzzy Hash: 9852e8edd5a3a3601fd9c1ca091a60ff3d963db353e41963ae7d1d3ebe7da1d6
Instruction Fuzzy Hash: 8A21F8323002504BD720DAACE840A66F7EEDF91A61B20497EF262CB640CF76D840C7A4

Function 001B2296 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B229D
InflateRect.USER32(?,00000005,00000005), ref: 001B22D3
Ellipse.GDI32(?,?,?,?,?), ref: 001B237E

Strings

mmm, xrefs: 001B2335, 001B233C
Gu,, xrefs: 001B230F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EllipseH_prolog3_InflateRect
String ID: Gu,$mmm
API String ID: 3279685039-3474039531
Opcode ID: 5a8cb4316a9a2418119d7a934eff8b836156531a465c34bf0db69a616cb41148
Instruction ID: 5ef8732d54766899982dc1bf4d2c7b9f21bb5a9dec4fe9dd08ee0964628f41f2
Opcode Fuzzy Hash: 5a8cb4316a9a2418119d7a934eff8b836156531a465c34bf0db69a616cb41148
Instruction Fuzzy Hash: 1A31A970910208DFCF05DFA8DD8A9EEBBB5FF58310F10422AE102A32A1DB349A55CF61

Function 02B00860 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02B008B8
std::exception::exception.LIBCMT ref: 02B008DA
__CxxThrowException@8.LIBCMT ref: 02B008EF
_memmove.LIBCMT ref: 02B00914

Strings

bad allocation, xrefs: 02B008D3

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Exception@8Throw_free_memmovestd::exception::exception
String ID: bad allocation
API String ID: 3887469428-2104205924
Opcode ID: 037459259911ff98dec049bbe01c6fb51524a73c7c75be6026f693b41b372827
Instruction ID: f29d397f102f633391e7a138da2ba2e3c5587adb76a3b4de20ac80805df91d80
Opcode Fuzzy Hash: 037459259911ff98dec049bbe01c6fb51524a73c7c75be6026f693b41b372827
Instruction Fuzzy Hash: 512186B6A003055FD725EF68D8C0AAABBE9FF8474470488BDE959C7280EB30F544CB95

Function 02AF50B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF50C8

Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B12857
Part of subcall function 02B12842: __CxxThrowException@8.LIBCMT ref: 02B1286C
Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B1287D

std::_Xinvalid_argument.LIBCPMT ref: 02AF50E6
_memmove.LIBCMT ref: 02AF512A

Strings

invalid string position, xrefs: 02AF50C3
string too long, xrefs: 02AF50E1

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 4d7f39796d27f48070fb2c5f0445cdcc4a3ecc29de67c945e8ab5a46f3c47004
Instruction ID: 0a8fad74f32893ba99957c8e643bb8e355459c903ce86ad585e52b4f1e5ff894
Opcode Fuzzy Hash: 4d7f39796d27f48070fb2c5f0445cdcc4a3ecc29de67c945e8ab5a46f3c47004
Instruction Fuzzy Hash: 8311E131B003059FCB54EFA8E8C0959B3AABF883147904269FA06CB650EF30F918CBD4

Function 001A6BD8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(DWMAPI), ref: 001A6C02
GetProcAddress.KERNEL32(00000000,DwmSetIconicThumbnail), ref: 001A6C12
DeleteObject.GDI32(00000000), ref: 001A6C4C

Strings

DWMAPI, xrefs: 001A6BF7
DwmSetIconicThumbnail, xrefs: 001A6C0C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AddressDeleteHandleModuleObjectProc
String ID: DWMAPI$DwmSetIconicThumbnail
API String ID: 3128169092-3761315311
Opcode ID: c8b67e40d5a8bf73e0fc790e761c69748fd60f74c33e5dd77a23e31f29abf5fe
Instruction ID: ea6f474a342259025518bbcc0f59105e7d422ffe04f8485e3bc1c71d5d3cc81a
Opcode Fuzzy Hash: c8b67e40d5a8bf73e0fc790e761c69748fd60f74c33e5dd77a23e31f29abf5fe
Instruction Fuzzy Hash: 9C018C79600305BBDB119B758C88AAE77ECEF5A720F14802AF94597241DBB4DD50CBB0

Function 02B086CE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02B086E1

Part of subcall function 02B0863C: ___BuildCatchObjectHelper.LIBCMT ref: 02B08672

_UnwindNestedFrames.LIBCMT ref: 02B086F8
___FrameUnwindToState.LIBCMT ref: 02B08706

Strings

csm, xrefs: 02B086DD, 02B086F2, 02B08705, 02B08723, 02B08733
csm, xrefs: 02B086D0

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 70e7f1e7e7417e29130667b7bc4e10bd42c5920515d92642e36db963afaa9a6f
Instruction ID: f163c7c86135d0c3c160f7d126df04f5eb1f47c6d29eb0121cec4bf009a7e9a3
Opcode Fuzzy Hash: 70e7f1e7e7417e29130667b7bc4e10bd42c5920515d92642e36db963afaa9a6f
Instruction Fuzzy Hash: 3401E87100110ABBDF136E91CD88EAA7E6AFF08394F018050BD19151A0D772DA61DBA5

Function 001E89DA Relevance: 7.8, APIs: 5, Instructions: 316COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001E8A41
GetWindowRect.USER32(?,?), ref: 001E8B19
InflateRect.USER32(?,00000000,?), ref: 001E8B3F
GetWindowRect.USER32(?,?), ref: 001E8BF4
GetWindowRect.USER32(?,?), ref: 001E8CFF

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$Inflate
String ID:
API String ID: 1123775244-0
Opcode ID: f524a677135f7852f8106365b0b89e57a60ece74447327815979b92670585907
Instruction ID: a54104a62a077691379c253234b9ccc3c559cecef16367b9baddd2afa559c0c3
Opcode Fuzzy Hash: f524a677135f7852f8106365b0b89e57a60ece74447327815979b92670585907
Instruction Fuzzy Hash: D9C10771E0064ADFCB14DFA9D9899EEBBB5FF48304F24456AE519A7250DB30AE40CB60

Function 0020445E Relevance: 7.7, APIs: 5, Instructions: 226windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00204465
CreateCompatibleDC.GDI32(?), ref: 00204543
CreateCompatibleBitmap.GDI32(00000001,?,?), ref: 00204577
SelectObject.GDI32(?,00000000), ref: 002045D4
DeleteObject.GDI32(?), ref: 002046DB

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreateObject$BitmapDeleteH_prolog3Select
String ID:
API String ID: 3587968642-0
Opcode ID: 789a830a5fff8427c076c96bbfd23f66e69d13d1cb090197933645093a009213
Instruction ID: 54c2137cc69b9006e10836fb9e231841ba1930b3c386f8935b44b9874269a547
Opcode Fuzzy Hash: 789a830a5fff8427c076c96bbfd23f66e69d13d1cb090197933645093a009213
Instruction Fuzzy Hash: 7CA14AB1D1121ADFCF04DFA8C9849EEBBB5BF54300F10822AE915B7292D735AA55CF90

Function 0019C0AC Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0019C0B3
IsWindow.USER32(?), ref: 0019C0D0
GetClientRect.USER32(?,?), ref: 0019C12F

Part of subcall function 0019342D: __EH_prolog3_GS.LIBCMT ref: 00193437
Part of subcall function 0019342D: GetClientRect.USER32(?,?), ref: 0019347E

Part of subcall function 001931B6: __EH_prolog3_GS.LIBCMT ref: 001931C0

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3_$ClientRect$Window
String ID:
API String ID: 3149087086-0
Opcode ID: 49fb435a151d9a9a799205eb8b82592b12f5238b6afeafeb0f67f1ed29109071
Instruction ID: 7933d294aefa9b48c0847354fdff34209c0c4fa663b15ea1b48099d914451b7e
Opcode Fuzzy Hash: 49fb435a151d9a9a799205eb8b82592b12f5238b6afeafeb0f67f1ed29109071
Instruction Fuzzy Hash: A5810871E00209CFCF15DFA8C994AEDBBB5FF58300F28416AE855AB256DB30A945CF94

Function 02AFCF10 Relevance: 7.7, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02AFCFB8
_memmove.LIBCMT ref: 02AFCFD4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 2251ac1d6839c75bcb489223c1c113bbebdb67915c40558a72411c5c2edebb1c
Instruction ID: 7a7bb5b96bb9e87948b2427f5e058bfaa33f35c0c2081193c5cbf51008835ae2
Opcode Fuzzy Hash: 2251ac1d6839c75bcb489223c1c113bbebdb67915c40558a72411c5c2edebb1c
Instruction Fuzzy Hash: 75619F71A0060A9FCB59DFA9C580B9AB7F5FF48310F10866EE95AC7740EB34E945CB80

Function 001E2823 Relevance: 7.7, APIs: 5, Instructions: 171windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001E282A
CreatePopupMenu.USER32 ref: 001E285C
AppendMenuW.USER32(00000001,00000800,00000000,00000000), ref: 001E28FF
AppendMenuW.USER32(00000001,00000000,?,00000010), ref: 001E29BC
__EH_prolog3.LIBCMT ref: 001E29ED

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Menu$AppendH_prolog3$CreatePopup
String ID:
API String ID: 2711618949-0
Opcode ID: 632e1892e146c71953da915c762f9a331fd691b0bfb5120adfdaa40c8ead057e
Instruction ID: bbcb881ee232e229b1fada8f0f984edca91185bd930f7afd97ebd551f0a9dd9c
Opcode Fuzzy Hash: 632e1892e146c71953da915c762f9a331fd691b0bfb5120adfdaa40c8ead057e
Instruction Fuzzy Hash: 0B61AF719006199BCF14EFA4C895BEEBBB8BF18314F148618F515A72D2DB70DA44CBA1

Function 001CC42D Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001CC434
GetClientRect.USER32(?,?), ref: 001CC4DA
InflateRect.USER32(?,00000003,00000003), ref: 001CC50C

Part of subcall function 001D0AD6: __EH_prolog3_GS.LIBCMT ref: 001D0ADD

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3_Rect$ClientInflate
String ID:
API String ID: 2789979914-0
Opcode ID: 386e05df9c366757d07d83d6a35bd3bf7586a6984ed6589e255daa5fc71fd91d
Instruction ID: 575c8ebf35714cc9e0a63acbf72eb88a06a0dc38ba3cc38713ecb865fd18913d
Opcode Fuzzy Hash: 386e05df9c366757d07d83d6a35bd3bf7586a6984ed6589e255daa5fc71fd91d
Instruction Fuzzy Hash: 0C517B71A10119AFCF05DFA8CD95EEEB7B5BF58310F148219F515A7291DB70AD00CBA0

Function 001E880C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001E8886
EqualRect.USER32(?,?), ref: 001E88B1
BeginDeferWindowPos.USER32(?), ref: 001E88BE
EndDeferWindowPos.USER32(?), ref: 001E88E3

Part of subcall function 001DC01A: GetWindowRect.USER32(?,?), ref: 001DC030
Part of subcall function 001DC01A: GetParent.USER32(?), ref: 001DC072
Part of subcall function 001DC01A: GetParent.USER32(?), ref: 001DC082

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

GetWindowRect.USER32(?,?), ref: 001E8998

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Rect$DeferParent$BeginEqualException@8Throw
String ID:
API String ID: 3220162355-0
Opcode ID: da7fb9e3740154f4165d24d3da0c6e0931676642d08d3e879b381a8488569667
Instruction ID: f0446e4a61ab4bcd2599447a7ef6f8948f0c9eaf874c4d1cace83c786a406393
Opcode Fuzzy Hash: da7fb9e3740154f4165d24d3da0c6e0931676642d08d3e879b381a8488569667
Instruction Fuzzy Hash: 4C512971D00649DFCB10DFAAD8849AEFBF8BF88314B65456AE509F7211DB30AE44CB61

Function 001FC9CF Relevance: 7.7, APIs: 5, Instructions: 166windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001FC9D6
GetMenuItemCount.USER32(?), ref: 001FCA5D
GetMenuItemID.USER32(?,?), ref: 001FCA77
GetSubMenu.USER32(?,?), ref: 001FCAD3

Part of subcall function 00182B23: __EH_prolog3_catch.LIBCMT ref: 00182B2A

Part of subcall function 0017432D: _malloc.LIBCMT ref: 0017434B

__EH_prolog3.LIBCMT ref: 001FCBB1

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Menu$H_prolog3Item$CountH_prolog3_catch_malloc
String ID:
API String ID: 2690492427-0
Opcode ID: c1d058c2088b2308cc35a12d83cb7ba39fb7c8855aa4ca4005ba6725edae753c
Instruction ID: 84e77d5a731a10d22690804693443c1f48f59138887aad364ee9088b055ee6a9
Opcode Fuzzy Hash: c1d058c2088b2308cc35a12d83cb7ba39fb7c8855aa4ca4005ba6725edae753c
Instruction Fuzzy Hash: 6E51F57190415DDFCF04EFB4C985AFDBAB0AF14314F24466AE615A72D1DB304E40EBA1

Function 001C0BA2 Relevance: 7.7, APIs: 5, Instructions: 162stringCOMMON

Download Yara Rule

APIs

SHGetPathFromIDListW.SHELL32(?,?), ref: 001C0C4B
SHGetPathFromIDListW.SHELL32(?,?), ref: 001C0C7B

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000408), ref: 001C0D2E
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000408), ref: 001C0D4F
lstrcmpiW.KERNEL32(?,?), ref: 001C0D63

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: FileFromInfoListPath$Exception@8Throwlstrcmpi
String ID:
API String ID: 438698530-0
Opcode ID: 6b783df3ed5e80c8e28658870ae8abc169fb877151daef74ffce0f5c7309644b
Instruction ID: 4b757d01ca3eed56896614a63d45f05d67392ba41b29cdc234ea045488c1097c
Opcode Fuzzy Hash: 6b783df3ed5e80c8e28658870ae8abc169fb877151daef74ffce0f5c7309644b
Instruction Fuzzy Hash: FF514F71911229DBCF268F94CD45FBDB7B9AFA8700F1041DAA54AA2151DB31EE90CFA0

Function 00224323 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 00224343
IsRectEmpty.USER32(?), ref: 00224372
IsRectEmpty.USER32(?), ref: 002243D9
IsRectEmpty.USER32(?), ref: 00224433
IsRectEmpty.USER32(?), ref: 00224479

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 93723db3dcaa89a6351c4a1f4a725f4a4d3aeac3e6d89a8fa3a56df5eff99494
Instruction ID: 8034691a15134092b516a1ea731ecd542d76f1cf214cc48f16cc73f692ee25fb
Opcode Fuzzy Hash: 93723db3dcaa89a6351c4a1f4a725f4a4d3aeac3e6d89a8fa3a56df5eff99494
Instruction Fuzzy Hash: 97514F31A11626ABCF10EFE9D885BAEB7B5BF04700F140669E905EB251D770EE50CFA0

Function 02AF7C20 Relevance: 7.6, APIs: 5, Instructions: 135processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,CD663CB9), ref: 02AF7C72
_memset.LIBCMT ref: 02AF7C97
_memset.LIBCMT ref: 02AF7D18
Process32FirstW.KERNEL32(00000000,?), ref: 02AF7D32
Process32NextW.KERNEL32(00000000,0000022C), ref: 02AF7D9A

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Process32_memset$CreateFirstNextSnapshotToolhelp32_malloc
String ID:
API String ID: 2416807333-0
Opcode ID: dd4bebc91acf3c4cd19b19d79f885c5648a4d9e583824b41985e1bf392240e1c
Instruction ID: b6e62d282f1b40b14eea6304b38908f672e6d55ca805055ae274fdd7da7cf7f4
Opcode Fuzzy Hash: dd4bebc91acf3c4cd19b19d79f885c5648a4d9e583824b41985e1bf392240e1c
Instruction Fuzzy Hash: E351B4719002499FDB24DBA4CC89FEEB7B5FF44714F008699E615A72C0EB74AA44CF94

Function 00198BDB Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00198C0C

Part of subcall function 00179DC5: ClientToScreen.USER32(?,00198C1D), ref: 00179DD6
Part of subcall function 00179DC5: ClientToScreen.USER32(?,00198C25), ref: 00179DE3

PtInRect.USER32(?,?,?), ref: 00198C26
PtInRect.USER32(?,?,?), ref: 00198C99

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ClientRect$Screen
String ID:
API String ID: 3187875807-0
Opcode ID: 9d047cb8d8c607a5b2649670dcbb20c348eadc2a92bc5a6ac2768b1ca5c50def
Instruction ID: bd99611e5bc2162803849518e3a7d7d79704449fd7402a6be0ebc8d322f053e2
Opcode Fuzzy Hash: 9d047cb8d8c607a5b2649670dcbb20c348eadc2a92bc5a6ac2768b1ca5c50def
Instruction Fuzzy Hash: 4C41FB71A0160AEFCF11DFA4D984AAEBBF9EB16344F114569E406FB244DB71AA01CB60

Function 001BC894 Relevance: 7.6, APIs: 5, Instructions: 113windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 001BC8D3
ShowWindow.USER32(00000000,00000004), ref: 001BC905
IsWindow.USER32(?), ref: 001BC94A
IsWindowVisible.USER32(?), ref: 001BC955
ShowWindow.USER32(?,00000000), ref: 001BC990

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Show$Visible
String ID:
API String ID: 2757229004-0
Opcode ID: 1cbcbf450d822471426f670ffd4a0e963d52b0b1679f3cbb93b50bf3e1c2ee98
Instruction ID: 2d5be09dc61fc0291878c63b4550075b061a1967b71c99cd2ecde79b43d9a56b
Opcode Fuzzy Hash: 1cbcbf450d822471426f670ffd4a0e963d52b0b1679f3cbb93b50bf3e1c2ee98
Instruction Fuzzy Hash: B1319276200201ABEB25AF65D889FEB77A8AF45754F144129E946DB281DB30ED40CBE0

Function 001CE4E3 Relevance: 7.6, APIs: 5, Instructions: 111windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001CE4EA
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 001CE504
GetWindowRect.USER32(?,?), ref: 001CE5B0
ReleaseCapture.USER32 ref: 001CE65B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CaptureH_prolog3_MessageRectReleaseSendWindow
String ID:
API String ID: 1034054131-0
Opcode ID: d9847e4ff9daec096aad625c637739e1c8d8b26392caffe269a3d19434870e9a
Instruction ID: 6a9849aefa27065574bd8d1dca3f7299e4d8d7b96a3c3d98760fed36d3c9aa11
Opcode Fuzzy Hash: d9847e4ff9daec096aad625c637739e1c8d8b26392caffe269a3d19434870e9a
Instruction Fuzzy Hash: C5412475908B049FDB21DF64C984EAABBF9FFA8304F10051EE45E92260DB75B940CF11

Function 001BCB9C Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001BCBA3
SetRectEmpty.USER32(?), ref: 001BCD00
SetRectEmpty.USER32(?), ref: 001BCD0D
SetRectEmpty.USER32(?), ref: 001BCD1A
SetRectEmpty.USER32(?), ref: 001BCD21

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect$H_prolog3
String ID:
API String ID: 3752103406-0
Opcode ID: 8a3cabb85b9b1a53be47c0326d48ac690a1850002de624778d0d896adcc01e0c
Instruction ID: bc68db022b683b2264db25ad2bce8bf25330f963a880078583745a891e1b5fd6
Opcode Fuzzy Hash: 8a3cabb85b9b1a53be47c0326d48ac690a1850002de624778d0d896adcc01e0c
Instruction Fuzzy Hash: 5D51C6B0941B40DAD320DF26C585BDAFBF8BFA5700F50890FD5AA972A1DBB46244CF52

Function 001EE1B1 Relevance: 7.6, APIs: 5, Instructions: 102windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001014,?,00000000), ref: 001EE287
SendMessageW.USER32(?,00000114,?,00000000), ref: 001EE297
SetScrollPos.USER32(?,00000002,00000000,00000001), ref: 001EE2B5
GetParent.USER32(?), ref: 001EE2C5
SendMessageW.USER32(?,?,00000000,00000000), ref: 001EE2DD

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$ParentScroll
String ID:
API String ID: 375824706-0
Opcode ID: 06b023f0080905db99de123f199cab91355e0018148c5893642d8ef15a4709a2
Instruction ID: 9d49be37819420d9e867fa85bfd5f537fb59c6bdaf15260a957c1d241dc00315
Opcode Fuzzy Hash: 06b023f0080905db99de123f199cab91355e0018148c5893642d8ef15a4709a2
Instruction Fuzzy Hash: 3E31D071200A96EFDB259F26CC85F6E7BF9FB88710F10452EF65A8B1A1D7709890CB14

Function 0019206B Relevance: 7.6, APIs: 5, Instructions: 99COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(00000000,?,?), ref: 00192087
WindowFromPoint.USER32(?,?), ref: 001920B2
ScreenToClient.USER32(?,00000000), ref: 001920E3
GetParent.USER32(?), ref: 00192151
UpdateWindow.USER32(?), ref: 001921A9

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$CallClientFromHookNextParentPointScreenUpdate
String ID:
API String ID: 160110263-0
Opcode ID: 30f3ea4d725842231d674b95c1a601bc2885a40e3b8665428f9ed934011f9983
Instruction ID: 94c6b288f95933e7ef8be28c620d1773f941344b44fd432b594a89695d96df04
Opcode Fuzzy Hash: 30f3ea4d725842231d674b95c1a601bc2885a40e3b8665428f9ed934011f9983
Instruction Fuzzy Hash: 85318D3A601205EFDF1A9F64ED48E697BB9FF88350F258579F91987260DB319810CF50

Function 001AC2F3 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 001AC32C
InflateRect.USER32(?,000000FF,000000FF), ref: 001AC35B
InflateRect.USER32(?,?,?), ref: 001AC3BD
InflateRect.USER32(?,00000001,00000001), ref: 001AC3D9

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: InflateRect
String ID:
API String ID: 2073123975-0
Opcode ID: 1ca4f4229dad31871dbdc0663b9eca47105907c6f49a4aa4b2d3752aa564580d
Instruction ID: 9e19c660f495860ab2cd3cd1d74d252ec0e6d1a757d574821cb5c163c95557a9
Opcode Fuzzy Hash: 1ca4f4229dad31871dbdc0663b9eca47105907c6f49a4aa4b2d3752aa564580d
Instruction Fuzzy Hash: 6F31417250420AABCF00DFA8ED88DBA376DFB49370B254626F625D31E1DB30E910DB54

Function 001B84D4 Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B84DB
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 001B8554
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 001B8561
SendMessageW.USER32(?,0000007F,00000001,00000000), ref: 001B856C
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 001B8579

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$H_prolog3
String ID:
API String ID: 1885053084-0
Opcode ID: 20e650fbdcf0c52d058c8ebc694b4ffe392c809d7a9327896fab7d02f684a79b
Instruction ID: 8e1a97bb0ffb1da0ca8eb983921bdaf9d9fbb8eee6543b6ad8013814e8d551f0
Opcode Fuzzy Hash: 20e650fbdcf0c52d058c8ebc694b4ffe392c809d7a9327896fab7d02f684a79b
Instruction Fuzzy Hash: 5C316C30350211AFDF29AF30CC96BE93A69BF58B40F140279F90A9B2D2DF709950DB91

Function 001D0062 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 001D0087
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 001D011A
GetParent.USER32(?), ref: 001D0126
GetWindowLongW.USER32(?,000000F4), ref: 001D0140
SendMessageW.USER32(?,00000111,?), ref: 001D0150

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageParentSend$LongWindow
String ID:
API String ID: 2933145521-0
Opcode ID: b996f403e5e982a5bcbb311dbdafc1ea89d84e54b6ed595dee8bd1ecfffdfa51
Instruction ID: 5b6e78fd4920b87449480a0316f95466f594469f831a69a9fc5620df17217dea
Opcode Fuzzy Hash: b996f403e5e982a5bcbb311dbdafc1ea89d84e54b6ed595dee8bd1ecfffdfa51
Instruction Fuzzy Hash: 5D210732604214FFDF26AF70DC49BAEB7A9AB58390F24452AF545A7390EB71DD40CB50

Function 001AA15A Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001AA161
CreatePopupMenu.USER32 ref: 001AA18C
AppendMenuW.USER32(?,00000000,00000096,00000010), ref: 001AA1E3
CheckMenuItem.USER32(?,00000096,00000008), ref: 001AA1F0
IsWindow.USER32(?), ref: 001AA21B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Menu$AppendCheckCreateH_prolog3ItemPopupWindow
String ID:
API String ID: 3258348697-0
Opcode ID: b5e05f0d51d21bbad532976e0d84a03e57279d0c874a45af528d55641fc5a46a
Instruction ID: 6e8098d184c951f258e288d506be357c0c26919136badbd7a81012825b633500
Opcode Fuzzy Hash: b5e05f0d51d21bbad532976e0d84a03e57279d0c874a45af528d55641fc5a46a
Instruction Fuzzy Hash: 2F310434900205AFCF15AFB4CC49AAF7B79BF56321F20462AF426A21D1DB718D50DBA2

Function 02AFC850 Relevance: 7.6, APIs: 5, Instructions: 87stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 02AFC867
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,?,00000000,00000000), ref: 02AFC89D
GetLastError.KERNEL32(?,00000000,00000000), ref: 02AFC8AC
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 02AFC8CA
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 02AFC8F8

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: ec7207de70fba52802bb6552d0cfd6709f1bf8a893fa2893369282aefee14f74
Instruction ID: 525ca8069f76ea64956045133d0b59428ba8bf370f725ea0567553e8a2d9ba4c
Opcode Fuzzy Hash: ec7207de70fba52802bb6552d0cfd6709f1bf8a893fa2893369282aefee14f74
Instruction Fuzzy Hash: 22219275680218BBE720DBA5DC85F673B6DEB85BA4F108501FE44EF280DA70E815C6E4

Function 0017E4C7 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0017E4EA
GetWindowRect.USER32(00000000,?), ref: 0017E517
SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,00000015), ref: 0017E53C
GetWindow.USER32(?,00000005), ref: 0017E545
ScrollWindow.USER32(?,?,?,?,?), ref: 0017E560

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$RectScrollVisible
String ID:
API String ID: 2639402888-0
Opcode ID: b6692cb01c533caf513e34590f74c9fab8202226f455f25c34446240c85edbbb
Instruction ID: 2a67d71fecf28d5bb0b889973db7afbca18d10372d320fab3ece3b170d4b34c3
Opcode Fuzzy Hash: b6692cb01c533caf513e34590f74c9fab8202226f455f25c34446240c85edbbb
Instruction Fuzzy Hash: 34213E75900209EBDF21DF99DC89DAEBBF9FF88304B208459F549A6210E7709A40CB60

Function 002102B6 Relevance: 7.6, APIs: 5, Instructions: 78windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002102BD
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 002102E4
SendMessageW.USER32(?,0000007F,00000001,00000000), ref: 002102F8
GetClassLongW.USER32(?,000000DE), ref: 00210370
GetClassLongW.USER32(?,000000F2), ref: 0021037E

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ClassLongMessageSend$H_prolog3
String ID:
API String ID: 350087385-0
Opcode ID: e2badd1d9fff437457e47facc17b1e05c419ad781e9e81299590d6ddd82673b9
Instruction ID: ccd14b32235678658c1aa4c908c2e073fa539f18362d11ade726ac1e4476c088
Opcode Fuzzy Hash: e2badd1d9fff437457e47facc17b1e05c419ad781e9e81299590d6ddd82673b9
Instruction Fuzzy Hash: E821B631A102156BDB20EF64CCC1FAE73A5AFA4750F110365F961BB2E2DBB09D90CB51

Function 001D29F5 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

SelectObject.GDI32(?,00000000), ref: 001D2A1B

Part of subcall function 001833A4: DeleteObject.GDI32(00000000), ref: 001833BD

SelectObject.GDI32(?,00000000), ref: 001D2A31
DeleteObject.GDI32(00000000), ref: 001D2A9C
DeleteDC.GDI32(00000000), ref: 001D2AAB
LeaveCriticalSection.KERNEL32(00301A6C), ref: 001D2AC4

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$CriticalLeaveSection
String ID:
API String ID: 3849354926-0
Opcode ID: 0101d53f0ef77d7bdee7024f30b6daa1a9815aad14d9e76a331f685eab46f567
Instruction ID: 5d2d46f41fd3a6c4154c7ad510bc90842ae49b6bb891562ad7f3a1b761e766f9
Opcode Fuzzy Hash: 0101d53f0ef77d7bdee7024f30b6daa1a9815aad14d9e76a331f685eab46f567
Instruction Fuzzy Hash: D521DE36900204DFCF11EF68DC848997BB8FFA4350B1481A7F9299F26AC7718941CF90

Function 02B02842 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02B02850

Part of subcall function 02B01DDE: __FF_MSGBANNER.LIBCMT ref: 02B01DF7
Part of subcall function 02B01DDE: __NMSG_WRITE.LIBCMT ref: 02B01DFE
Part of subcall function 02B01DDE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06), ref: 02B01E23

_free.LIBCMT ref: 02B02863

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: b5a3808a844e109db683e1409c985c4712247c074f6784b767c1e8160d7b40b7
Instruction ID: 1056d53fd1cc448cc8f342fc1b50d25fd28f100cd26eb3f66dd89eb6ff67e6d1
Opcode Fuzzy Hash: b5a3808a844e109db683e1409c985c4712247c074f6784b767c1e8160d7b40b7
Instruction Fuzzy Hash: F6112736910311ABCB232B74A88C75A3FA6EF453A0B1145B9ED58A71C0EB34D8848B98

Function 001E4999 Relevance: 7.6, APIs: 5, Instructions: 68windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001E49CD
SHAppBarMessage.SHELL32(00000007,?), ref: 001E49EB
SHAppBarMessage.SHELL32(00000007,?), ref: 001E4A05
SHAppBarMessage.SHELL32(00000007,?), ref: 001E4A1B
SHAppBarMessage.SHELL32(00000007,?), ref: 001E4A34

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Message$_memset
String ID:
API String ID: 2485647581-0
Opcode ID: df6ec01b789106dcab8178d4d519abee517700a27e3be706e1d16373ee2f58b5
Instruction ID: a196df15353541064f498f6b96fd46428e579b14ffbecaaa50393c83a1270d13
Opcode Fuzzy Hash: df6ec01b789106dcab8178d4d519abee517700a27e3be706e1d16373ee2f58b5
Instruction Fuzzy Hash: C7216F71E4120AABEB44CFA5DCC5FEEBFA8BB04758F14002AD515E2180DB75E944CBA0

Function 0026ABAB Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0026ABB9

Part of subcall function 00267C7C: __FF_MSGBANNER.LIBCMT ref: 00267C95
Part of subcall function 00267C7C: __NMSG_WRITE.LIBCMT ref: 00267C9C
Part of subcall function 00267C7C: RtlAllocateHeap.NTDLL(00000000,00000001,?,00000000,00000000,?,00174350,8007000E,00000000,?,001788A7,0000000C,00000004,00173CDC,8007000E), ref: 00267CC1

_free.LIBCMT ref: 0026ABCC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 4df937bb83eab42a1ebbd0c5de93ed511cf58734cc873f58d53a3c12b3e41d22
Instruction ID: ce4b329f3436e7b3e025f916ab9a7c77456492892aad92bfe2a052a9895fcc31
Opcode Fuzzy Hash: 4df937bb83eab42a1ebbd0c5de93ed511cf58734cc873f58d53a3c12b3e41d22
Instruction Fuzzy Hash: 8C11E332835516ABCF212F74BD05A5E369AEB407A0F204A26F808B6590DF748CF08FA1

Function 001A0226 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GlobalGetAtomNameW.KERNEL32(?,?,00000103), ref: 001A02A0
GlobalAddAtomW.KERNEL32(?), ref: 001A02AF
GlobalGetAtomNameW.KERNEL32(?,?,00000103), ref: 001A02C5
GlobalAddAtomW.KERNEL32(?), ref: 001A02CE
SendMessageW.USER32(?,000003E4,?,?), ref: 001A02F8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AtomGlobal$Name$MessageSend
String ID:
API String ID: 1515195355-0
Opcode ID: 8f24e801f85788d49b91a60be4f9bcd69cfeae5c39adb355d6dd12cad05efb80
Instruction ID: 2d3a66cc1f78fb1f7cf47c007a765d27830fe86672bc7ac9c72d061cc6fc19f8
Opcode Fuzzy Hash: 8f24e801f85788d49b91a60be4f9bcd69cfeae5c39adb355d6dd12cad05efb80
Instruction Fuzzy Hash: 7A219F75901218AFCB20EF68DC48AEAB3F8FF58710F40855AE55ED7181D774AE84CB60

Function 001AE797 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 001AE7CE
GetParent.USER32(?), ref: 001AE7EB
GetClientRect.USER32(?,?), ref: 001AE7FA
GetParent.USER32(?), ref: 001AE803
MapWindowPoints.USER32(?,?,?,00000002), ref: 001AE818

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ParentRect$ClientFillPointsWindow
String ID:
API String ID: 3058756167-0
Opcode ID: b726744dc8133d5c5724a9d6f9e116f56821a690d27b352e975887034b0a45a3
Instruction ID: 3973cd3ef3045b7430450d6d42fb162f2c9c86307a9d2b2320baf3dc0be9256f
Opcode Fuzzy Hash: b726744dc8133d5c5724a9d6f9e116f56821a690d27b352e975887034b0a45a3
Instruction Fuzzy Hash: 5A214A75900219AFCB10EFA4DC49CAFBBB9FF49310B114569E809A7221EB71A904CFA0

Function 02AF1270 Relevance: 7.6, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF1291
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF12AA
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF12C3
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF12E3
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF12FA
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,74DF0F00,02AFA390), ref: 02AF1311

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 821b20fe4b8ec12e0ce2bc04eb154b985f80cf98dfcb1ed9b9d50a27be39d888
Instruction ID: ecdd700ec24a71923daf88495c26dfe25eaa2e9de3039bef36993564c59c5b4c
Opcode Fuzzy Hash: 821b20fe4b8ec12e0ce2bc04eb154b985f80cf98dfcb1ed9b9d50a27be39d888
Instruction Fuzzy Hash: FF11DDB1A00B059BD7709F9A9CC0A17F6ECBB44254751496DF2C9D3A50CB74E8484F94

Function 001C247D Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 001C24B1
CreateFontIndirectW.GDI32(?), ref: 001C24C6
IsWindow.USER32(?), ref: 001C24E4
InvalidateRect.USER32(?,00000000,00000001), ref: 001C2502
UpdateWindow.USER32(?), ref: 001C250B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$CreateFontIndirectInvalidateObjectRectUpdate
String ID:
API String ID: 1602852816-0
Opcode ID: 9dca8bece83191bebfe0c1e8436dd010604315e0a2c00f6feef837a8d2a93ddf
Instruction ID: bdd7585e2d376b7b915a8df330cf7e3bed38807ce4f93f5151db842e974738fe
Opcode Fuzzy Hash: 9dca8bece83191bebfe0c1e8436dd010604315e0a2c00f6feef837a8d2a93ddf
Instruction Fuzzy Hash: 5B118F35600204ABDB24AB74EC49FAEB7B9FF64310F104429F54A961A1EB71ED05CB60

Function 001B4B13 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

SetCapture.USER32(?), ref: 001B4B2B
GetCursorPos.USER32(?), ref: 001B4B6A
LoadCursorW.USER32(00000000,00007F86), ref: 001B4B94
SetCursor.USER32(00000000), ref: 001B4B9B
GetCursorPos.USER32(?), ref: 001B4BA8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Cursor$CaptureLoad
String ID:
API String ID: 1460996051-0
Opcode ID: 2af136616a619d67f7373d51af02cf808feae1cb322cfe7403a77993c6071b79
Instruction ID: 16374c0c05a223743433bdb8af1f85494c7f20657b3685de8d8e2a4612b4af45
Opcode Fuzzy Hash: 2af136616a619d67f7373d51af02cf808feae1cb322cfe7403a77993c6071b79
Instruction Fuzzy Hash: 8511A0316003049FDB24ABB8D84DFEAB7E9AF99311F00442DF69A83252CF75B800CB61

Function 001CCAE7 Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 001CCAF3
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 001CCB1F
SendMessageW.USER32(?,00000150,?,00000000), ref: 001CCB32
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 001CCB4C
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 001CCB5F

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Exception@8ThrowWindow
String ID:
API String ID: 220582486-0
Opcode ID: 873573e96389f31b3d58032359beb4058c1aa79cac186c739a1fbe5e1936c8e2
Instruction ID: 619fcbefb7d9f3271a1f3fad500ee74f5b9accba54c9e0e08200807141e15eca
Opcode Fuzzy Hash: 873573e96389f31b3d58032359beb4058c1aa79cac186c739a1fbe5e1936c8e2
Instruction Fuzzy Hash: 2F019E31B00609BBEB155BB0DC46F5ABBBDFF58784F100125F608E65A0E7B1EC109BA0

Function 001F813A Relevance: 7.6, APIs: 5, Instructions: 53threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001F8141
EnterCriticalSection.KERNEL32(00301E5C,00000000,0019246E,00000001), ref: 001F819D
__beginthread.LIBCMT ref: 001F81B7
SetThreadPriority.KERNEL32(00000000,000000FF), ref: 001F81D0
LeaveCriticalSection.KERNEL32(00301E5C), ref: 001F81E7

Part of subcall function 001D2594: __EH_prolog3.LIBCMT ref: 001D259B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CriticalH_prolog3Section$EnterLeavePriorityThread__beginthread
String ID:
API String ID: 4118814795-0
Opcode ID: a127a16b1f76eda54b529c52ae8b3372233c861229c85a7215c510d2c748176e
Instruction ID: acc73181fa27818d3c4ef48190e0b658f5a6a01a4afe80e8f4c37cea3311cb64
Opcode Fuzzy Hash: a127a16b1f76eda54b529c52ae8b3372233c861229c85a7215c510d2c748176e
Instruction Fuzzy Hash: 111191748067589FCB22AB74EC5996E3F24EB00B74F20431BFA79822E5CB305982CB51

Function 02AFB040 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,02AFB23C,CD663CB9,?,?,?,?,02B12D66,000000FF), ref: 02AFB053
EnterCriticalSection.KERNEL32(?,?,?,?,02AFB23C,CD663CB9,?,?,?,?,02B12D66,000000FF), ref: 02AFB05D
LeaveCriticalSection.KERNEL32(?,?,?,?,02AFB23C,CD663CB9,?,?,?,?,02B12D66,000000FF), ref: 02AFB070
LeaveCriticalSection.KERNEL32(?,?,?,?,02AFB23C,CD663CB9,?,?,?,?,02B12D66,000000FF), ref: 02AFB073

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c7611e76d2724864bf56124a2002a05d6e8e172b70b99a9a53b01978e211409f
Instruction ID: 0804c1642431b87a0845649dc89ebc9b315f5bb95ec35bf8946699b4787604b0
Opcode Fuzzy Hash: c7611e76d2724864bf56124a2002a05d6e8e172b70b99a9a53b01978e211409f
Instruction Fuzzy Hash: 130184766003108FD720DB65FCC4B5BBBF9FB8C355F100919E245D3600DB78E8958A60

Function 02B075A7 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02B075B3

Part of subcall function 02B045E4: __getptd_noexit.LIBCMT ref: 02B045E7
Part of subcall function 02B045E4: __amsg_exit.LIBCMT ref: 02B045F4

__getptd.LIBCMT ref: 02B075CA
__amsg_exit.LIBCMT ref: 02B075D8
__lock.LIBCMT ref: 02B075E8
__updatetlocinfoEx_nolock.LIBCMT ref: 02B075FC

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 77ae25bbea7ed33eb45c2f225679229e9fc44da025842ce6b9b040f4a1f4f6b5
Instruction ID: fde297f1c9e059a2ed6964fabe397c514b2111954b62f9a0e0359abbbba5d5e2
Opcode Fuzzy Hash: 77ae25bbea7ed33eb45c2f225679229e9fc44da025842ce6b9b040f4a1f4f6b5
Instruction Fuzzy Hash: C6F0B4329447109BDB27BB689581B8DFFA1FF00724F1042CAD516AB1D2CF646900EE56

Function 02AF43B0 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 02AF43D2
GetCommandLineW.KERNEL32 ref: 02AF43D8
GetStartupInfoW.KERNEL32(?), ref: 02AF43E7
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 02AF440F
ExitProcess.KERNEL32 ref: 02AF4417

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: a49334a608e339685679738dea7a74a76cf68e3cdbbe8fbef000fdd59985e8f1
Instruction ID: d1203e941a42a14dd35ab7f8487904b952fe1dd64b331574da564ca59e4636e5
Opcode Fuzzy Hash: a49334a608e339685679738dea7a74a76cf68e3cdbbe8fbef000fdd59985e8f1
Instruction Fuzzy Hash: D9F0B4B19C4318BFE7209BA0DC0DFA97BB8EB14B40F604694B615F70C0D6706AA4CF14

Function 02AF78EE Relevance: 7.5, APIs: 5, Instructions: 26processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,000001FE), ref: 02AF78F9
GetCommandLineW.KERNEL32(?,?,000001FE), ref: 02AF78FF
GetStartupInfoW.KERNEL32(?,?,?,000001FE), ref: 02AF790C
CreateProcessW.KERNEL32(?,00000000,?,?,?,00000020,?,?,?,?,?,?,000001FE), ref: 02AF792C
ExitProcess.KERNEL32 ref: 02AF7934

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 2ed928f77fe642b54ad46be9dbc82c73a0f328b6ddd0f0d30f1d607320f9bf4d
Instruction ID: 18aced1b4368e0ef34cae279200388965a89c0180038fb707314218c658d2e97
Opcode Fuzzy Hash: 2ed928f77fe642b54ad46be9dbc82c73a0f328b6ddd0f0d30f1d607320f9bf4d
Instruction Fuzzy Hash: D1E06DB2444280BFD3209BA2DC4CDAB7FBCFBCAB40F404E0CB26692090EA705564CB31

Function 02B0177E Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B04B99: _doexit.LIBCMT ref: 02B04BA5

___set_flsgetvalue.LIBCMT ref: 02B01790

Part of subcall function 02B04429: TlsGetValue.KERNEL32(00000000,02B04582,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000,00000000), ref: 02B04432
Part of subcall function 02B04429: DecodePointer.KERNEL32(?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000,00000000,?,02B0468F,0000000D), ref: 02B04444
Part of subcall function 02B04429: TlsSetValue.KERNEL32(00000000,?,02B04F50,00000000,00000001,00000000,?,02B0B976,00000018,02B194A8,0000000C,02B0BA06,00000000,00000000,?,02B0468F), ref: 02B04453

___fls_getvalue@4.LIBCMT ref: 02B0179B

Part of subcall function 02B04409: TlsGetValue.KERNEL32(?,?,02B017A0,00000000), ref: 02B04417

___fls_setvalue@8.LIBCMT ref: 02B017AE

Part of subcall function 02B0445D: DecodePointer.KERNEL32(?,?,?,02B017B3,00000000,?,00000000), ref: 02B0446E

GetLastError.KERNEL32(00000000,?,00000000), ref: 02B017B7
ExitThread.KERNEL32 ref: 02B017BE
GetCurrentThreadId.KERNEL32 ref: 02B017C4
__freefls@4.LIBCMT ref: 02B017E4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 445f7c56067ed9ea20f16cd0454f5630d088b1e7d76adc448dc38d290bdb99a7
Instruction ID: ba45b12739c4e00aaac436229aca01baaa9c1124eabe0cfe851d159312cbd559
Opcode Fuzzy Hash: 445f7c56067ed9ea20f16cd0454f5630d088b1e7d76adc448dc38d290bdb99a7
Instruction Fuzzy Hash: F9E04FB1C00206678F023BF1D98899E3E7EDF05385B484890EF1493084EE2899214AA1

Function 001B000B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 201windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B0012

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

ImageList_GetIconSize.COMCTL32(?,?,?,0000002C), ref: 001B00B3
GetTextColor.GDI32(?), ref: 001B010D

Strings

(, xrefs: 001B0057

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ColorException@8H_prolog3_IconImageList_SizeTextThrow
String ID: (
API String ID: 3719892036-1334834377
Opcode ID: 274df8a18cbd6c4f05874115c70719d69114b99d92334742f5c918458ef7f01a
Instruction ID: 731eb7c8be436f2408ef438c59f9874ad4167afa6997d8c01299649b7b411544
Opcode Fuzzy Hash: 274df8a18cbd6c4f05874115c70719d69114b99d92334742f5c918458ef7f01a
Instruction Fuzzy Hash: 6B713A75A006149FCF19DFA8C985AEEB7F5BF4C310B148568F906AB2A2DB31ED44CB10

Function 00194736 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019473D

Part of subcall function 001D71E1: __EH_prolog3.LIBCMT ref: 001D71E8
Part of subcall function 001D71E1: CreateCompatibleDC.GDI32(00000000), ref: 001D72B3
Part of subcall function 001D71E1: CreateCompatibleDC.GDI32(00000000), ref: 001D72BF

SetRectEmpty.USER32(?), ref: 001948F4
SetRectEmpty.USER32(?), ref: 00194990

Strings

(, xrefs: 0019489D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreateEmptyH_prolog3Rect
String ID: (
API String ID: 3780235708-1334834377
Opcode ID: a1db565486671f99394a2d1d2f45a874401fdc54a70242fe252ee4ba541a280c
Instruction ID: 4959888c77570bbe437d61fa3d790c253a33ad9a46754ffe3210bb3312b274e7
Opcode Fuzzy Hash: a1db565486671f99394a2d1d2f45a874401fdc54a70242fe252ee4ba541a280c
Instruction Fuzzy Hash: CD919EB4905B408EE364DF7A8591BD6FBE8BFA5308F504A5FD5AE83291DBB02244DF01

Function 001B4BCC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161keyboardCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 001B4C55
GetKeyState.USER32(00000011), ref: 001B4C8E
GetCursorPos.USER32(?), ref: 001B4CFD

Strings

H(), xrefs: 001B4CCC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CaptureCursorReleaseState
String ID: H()
API String ID: 3832350104-2653369260
Opcode ID: 97dc589f676f9be44a7f4d99c1ee8c31658711e02de7428b0b5201ecb9bf5013
Instruction ID: a55d3f6750e99e03b4a979bf18189bb1b81298d3d1e5efdbc5334f9412c4d969
Opcode Fuzzy Hash: 97dc589f676f9be44a7f4d99c1ee8c31658711e02de7428b0b5201ecb9bf5013
Instruction Fuzzy Hash: 39519135601201EFDB249FA4C888BFEBBE9BF58701F14846EE54A97292DB709D40CF51

Function 001AEA8D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001AEA94
FillRect.USER32(?,?), ref: 001AEBCF

Part of subcall function 002050FE: __EH_prolog3.LIBCMT ref: 00205105
Part of subcall function 002050FE: CreateCompatibleDC.GDI32(?), ref: 00205168
Part of subcall function 002050FE: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0020519A
Part of subcall function 002050FE: SelectObject.GDI32(?,00000000), ref: 002051F8

Strings

XA*, xrefs: 001AEA9F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreate$BitmapFillH_prolog3H_prolog3_ObjectRectSelect
String ID: XA*
API String ID: 593165290-2939621768
Opcode ID: 6048d0eeec070800b9c5c5b9c587e6c2c1f346552d62b54fb873ca4e93b8bbac
Instruction ID: a6fe53e0a316738a7b3f6542f3c328d1618c7055b762ca860aab670ba96b22b2
Opcode Fuzzy Hash: 6048d0eeec070800b9c5c5b9c587e6c2c1f346552d62b54fb873ca4e93b8bbac
Instruction Fuzzy Hash: 37514D35A00619DFCF05DFA0CD98DEE77B6BF16310B104125E902AB2A6DB75AA1ACF50

Function 001BC514 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001BC51B
GetWindowRect.USER32(?,?), ref: 001BC66B
IsRectEmpty.USER32(?), ref: 001BC672

Strings

,A), xrefs: 001BC636, 001BC639

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyH_prolog3_Window
String ID: ,A)
API String ID: 3231919161-1707507902
Opcode ID: 1c224288c6c3af21aa733d5fc99b62c438d04fdc0ecb05ede0db5f609d82dd62
Instruction ID: 34fad6267ab7dade0088cfbae8356a2a33e439fe4dddd4fff9510a27ffcf7b2b
Opcode Fuzzy Hash: 1c224288c6c3af21aa733d5fc99b62c438d04fdc0ecb05ede0db5f609d82dd62
Instruction Fuzzy Hash: B4517E716009049FCF09EFA4C8959EDB7F9AF58300F140199F916EB2A2DB31AE06CF95

Function 001F4BE2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 001F4CE0
GetParent.USER32(?), ref: 001F4D29
RedrawWindow.USER32(?,00000000,00000000,00000401), ref: 001F4D43

Part of subcall function 001F868D: SendMessageW.USER32(?,00000435,00000000,?), ref: 001F86B6

Part of subcall function 001F8645: SendMessageW.USER32(?,00000433,00000000,?), ref: 001F8678

Part of subcall function 001F855B: _memcpy_s.LIBCMT ref: 001F8595
Part of subcall function 001F855B: SendMessageW.USER32(?,00000432,00000000,?), ref: 001F85B4

Strings

e*, xrefs: 001F4CE9

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$Parent$RedrawWindow_memcpy_s
String ID: e*
API String ID: 2505722956-654361256
Opcode ID: a25fad6730ed35c3447f74b788b91f4146394d3ec7720a9f8d6fc62b9c7f9ac6
Instruction ID: d7795382969ce5b11fad1a9daa45e51382421b7a1669136792d34e503b24211e
Opcode Fuzzy Hash: a25fad6730ed35c3447f74b788b91f4146394d3ec7720a9f8d6fc62b9c7f9ac6
Instruction Fuzzy Hash: 1C419135600618AFCB25EF65C888FABB7F5BF58310F100659F25A9B2A0DF31A945CF90

Function 001B0395 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B039C
InflateRect.USER32(?,000000FF,000000FE), ref: 001B03C9
Polygon.GDI32(00000002,?,00000005), ref: 001B04A8

Part of subcall function 002050FE: __EH_prolog3.LIBCMT ref: 00205105
Part of subcall function 002050FE: CreateCompatibleDC.GDI32(?), ref: 00205168
Part of subcall function 002050FE: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0020519A
Part of subcall function 002050FE: SelectObject.GDI32(?,00000000), ref: 002051F8

Strings

(, xrefs: 001B04DC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreate$BitmapH_prolog3H_prolog3_InflateObjectPolygonRectSelect
String ID: (
API String ID: 2497134698-1334834377
Opcode ID: 6c279adc8252cb7785dd0c902d65a3277799e3adf7495436507d597e13d84685
Instruction ID: 3b9d4e0f54ad1d00f0363a0f0c52f2fb9643c369c7a4b3aed9f91d24d9ce1cb5
Opcode Fuzzy Hash: 6c279adc8252cb7785dd0c902d65a3277799e3adf7495436507d597e13d84685
Instruction Fuzzy Hash: D2411371900249DFCF04EFE8C9858DEBBB5BF58310F14821AE915A7291DB30AA66CF51

Function 0021C793 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109keyboardCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0021C79A
__EH_prolog3.LIBCMT ref: 0021C82C
GetKeyState.USER32(00000010), ref: 0021C83B

Strings

], xrefs: 0021C84B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$State
String ID: ]
API String ID: 561920835-3352871620
Opcode ID: f746934f70feb34284cc362090c12bf7c6a92bdb9be46c0956ba6cfe42c4037e
Instruction ID: bd0213d48beffe8e0ced934ab4db7eab2cfce49bdf0806f2ac2bfe2c442d3884
Opcode Fuzzy Hash: f746934f70feb34284cc362090c12bf7c6a92bdb9be46c0956ba6cfe42c4037e
Instruction Fuzzy Hash: C941B074960219CFCB01EFA8C8C45EEBBF4BF28300F21452EE515A7291CBB15AA1DF50

Function 001B2176 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B217D

Part of subcall function 00179D3E: MoveToEx.GDI32(?,?,?,?), ref: 00179D68
Part of subcall function 00179D3E: MoveToEx.GDI32(?,?,?,?), ref: 00179D79

Part of subcall function 001797C1: MoveToEx.GDI32(?,?,?,00000000), ref: 001797DE
Part of subcall function 001797C1: LineTo.GDI32(?,?,?), ref: 001797ED

Part of subcall function 0017A336: SelectObject.GDI32(?,00000000), ref: 0017A35C
Part of subcall function 0017A336: SelectObject.GDI32(?,?), ref: 0017A372

Strings

iii, xrefs: 001B21AC
(, xrefs: 001B226C
iii, xrefs: 001B219F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Move$ObjectSelect$H_prolog3Line
String ID: iii$iii$(
API String ID: 3726201289-171042512
Opcode ID: 5533e853e89f283133f0726ee2bb0648dbec9678df3c064381e85bfdc9363c4c
Instruction ID: 47eacdf7003bfef1acb13f26261d2d19865334e87ff7a2a20f3cae014e92eca1
Opcode Fuzzy Hash: 5533e853e89f283133f0726ee2bb0648dbec9678df3c064381e85bfdc9363c4c
Instruction Fuzzy Hash: 97318D71A0010AEFCF05EFA4C951DEE3B7AAF68750F108029F915A7291CB319A25DF62

Function 00182059 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMT ref: 001820A4
__snwprintf_s.LIBCMT ref: 001820D6

Part of subcall function 00268FB0: __getptd_noexit.LIBCMT ref: 00268FB0

Strings

Afx:%p:%x:%p:%p:%p, xrefs: 001820CC
Afx:%p:%x, xrefs: 0018209A

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: __snwprintf_s$__getptd_noexit
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 101746997-2801496823
Opcode ID: f8edaafdb995ff751a4842c1480cfa5b5a240025729dec467cf062e452a23ebd
Instruction ID: 46e62b9a37e23723d64680fe4f6110fc80fefc7106f950430f4bab12aba952b9
Opcode Fuzzy Hash: f8edaafdb995ff751a4842c1480cfa5b5a240025729dec467cf062e452a23ebd
Instruction Fuzzy Hash: 32316F75D00208AFCB02FFA5C941A9EBBF5EF59350F508166F914A7251DB709A60CFA1

Function 02AF762E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 02AF7F30: GetDesktopWindow.USER32 ref: 02AF7F67
Part of subcall function 02AF7F30: GetDC.USER32(00000000), ref: 02AF7F74
Part of subcall function 02AF7F30: CreateCompatibleDC.GDI32(00000000), ref: 02AF7F7A
Part of subcall function 02AF7F30: GetDC.USER32(00000000), ref: 02AF7F85
Part of subcall function 02AF7F30: GetDeviceCaps.GDI32(00000000,00000008), ref: 02AF7F92
Part of subcall function 02AF7F30: GetDeviceCaps.GDI32(00000000,00000076), ref: 02AF7F9A
Part of subcall function 02AF7F30: ReleaseDC.USER32(00000000,00000000), ref: 02AF7FAB
Part of subcall function 02AF7F30: GetSystemMetrics.USER32(0000004C), ref: 02AF8050
Part of subcall function 02AF7F30: GetSystemMetrics.USER32(0000004D), ref: 02AF8065
Part of subcall function 02AF7F30: CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 02AF807E
Part of subcall function 02AF7F30: SelectObject.GDI32(?,00000000), ref: 02AF808C
Part of subcall function 02AF7F30: SetStretchBltMode.GDI32(?,00000003), ref: 02AF8098
Part of subcall function 02AF7F30: GetSystemMetrics.USER32(0000004F), ref: 02AF80A5
Part of subcall function 02AF7F30: GetSystemMetrics.USER32(0000004E), ref: 02AF80B8

_memmove.LIBCMT ref: 02AF76D9

Part of subcall function 02B016AA: _malloc.LIBCMT ref: 02B016C4

_memset.LIBCMT ref: 02AF7672
swprintf.LIBCMT ref: 02AF7695

Strings

%s %s, xrefs: 02AF7684

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: MetricsSystem$CapsCompatibleCreateDevice$BitmapDesktopModeObjectReleaseSelectStretchWindow_malloc_memmove_memsetswprintf
String ID: %s %s
API String ID: 1388310237-581060391
Opcode ID: af3999e8a00b935dab69fc197ab4c60b66924c1e53a4c5bd161dda9cac314e18
Instruction ID: d25b1957d029e9ff8a342cf14ce6265361db5e7ba3473a712d3920e2690b992e
Opcode Fuzzy Hash: af3999e8a00b935dab69fc197ab4c60b66924c1e53a4c5bd161dda9cac314e18
Instruction Fuzzy Hash: 6621E6716143009FD215EF58CCC4E2BF7EAAFC9300F04459DF54A9B282EA70E905CBA2

Function 001E48AE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001E48B5

Part of subcall function 001FABAD: __EH_prolog3.LIBCMT ref: 001FABB4

Part of subcall function 0018289B: GetDlgCtrlID.USER32(?), ref: 001828A4

Strings

%sBasePane-%d%x, xrefs: 001E491D
%sBasePane-%d, xrefs: 001E4906
IsVisible, xrefs: 001E495C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$Ctrl
String ID: %sBasePane-%d$%sBasePane-%d%x$IsVisible
API String ID: 3879667756-4027084908
Opcode ID: b3c82c33a1b2a44e1e1b7cc31c177fa674ed881ef0753f6e7c56955be5a95787
Instruction ID: 92f1a128313bd2e5977eb68ffdd720349d22432a4c71c780ffacef97bbb7d455
Opcode Fuzzy Hash: b3c82c33a1b2a44e1e1b7cc31c177fa674ed881ef0753f6e7c56955be5a95787
Instruction Fuzzy Hash: BD21E471900249AFCF11EFB4C8459BE7BB4EF14324F044658F52A67382CB308A50DB92

Function 00186941 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00186966
GetSysColor.USER32(00000014), ref: 001869B0
CreateDIBitmap.GDI32(?,00000028,00000004,?,00000028,00000000), ref: 00186A03

Strings

(, xrefs: 00186994

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: BitmapColorCreate_memset
String ID: (
API String ID: 3930187609-3887548279
Opcode ID: ce5820ddf32a1467e9ed085363eaeb6b70a176b462bb3ee64c02395fa64cddf3
Instruction ID: 2e5ad8e2d81da2f947bb9bbbe49d357915b7ce8d099d7743ac123ad41e980ddd
Opcode Fuzzy Hash: ce5820ddf32a1467e9ed085363eaeb6b70a176b462bb3ee64c02395fa64cddf3
Instruction Fuzzy Hash: A921D331A11258DBDB04CBB8DC5ABEDBBF8AB55700F00446EE646E7281DA355A48CB60

Function 02AF2CA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 02AF2CBB
swprintf.LIBCMT ref: 02AF2D10
lstrcatW.KERNEL32(-00000C5C,>f:yhV:,000009A8,?,02AF28B2,00000000), ref: 02AF2D2F

Strings

>f:yhV:, xrefs: 02AF2D29

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: swprintf$lstrcat
String ID: >f:yhV:
API String ID: 3236582425-705829887
Opcode ID: 3fa179e0873c5857333e629397a9c7a85a8e237f59d63e61ee0531e9940515d8
Instruction ID: e16435ce2885836ab29743ba8358652fc94f463801be04f922f4f2668d85dbfb
Opcode Fuzzy Hash: 3fa179e0873c5857333e629397a9c7a85a8e237f59d63e61ee0531e9940515d8
Instruction Fuzzy Hash: 6711CE72640201BBF225CA88DCC1DBBF3ACEB88714B14481EFE8583244CBB46940DBA0

Function 0019E200 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019E207
GetCursorPos.USER32(?), ref: 0019E2CD

Strings

Control Panel\Desktop, xrefs: 0019E256
MenuShowDelay, xrefs: 0019E278

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CursorH_prolog3
String ID: Control Panel\Desktop$MenuShowDelay
API String ID: 634316419-702829638
Opcode ID: af54abb41188bef556018ba75927812e473c1c97589cdd619dff693ee26d0a78
Instruction ID: 9bdd8aaac478966d4127052e220fadca6091ee96bd117d7e3873f77e1c5f9886
Opcode Fuzzy Hash: af54abb41188bef556018ba75927812e473c1c97589cdd619dff693ee26d0a78
Instruction Fuzzy Hash: 38219F70A102059FDF18EFB4D84ABAD77F4AF24325F104628F6259B2D1DBB19A40CB91

Function 001C25EF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001C25F6
SetRectEmpty.USER32(?), ref: 001C262C

Part of subcall function 0017432D: _malloc.LIBCMT ref: 0017434B

SendMessageW.USER32(?,00001036,00000000,00000020), ref: 001C2696

Strings

SysListView32, xrefs: 001C2670

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EmptyH_prolog3_MessageRectSend_malloc
String ID: SysListView32
API String ID: 385562461-78025650
Opcode ID: 37f3954e04a812714d795279e8cb8934ceea82ebb934a55e0ab5d678900fe0f7
Instruction ID: 80f4714f742a9bc1aa2c009753b389bcf82ba6683bf2bcae9ed87d3832827ad2
Opcode Fuzzy Hash: 37f3954e04a812714d795279e8cb8934ceea82ebb934a55e0ab5d678900fe0f7
Instruction Fuzzy Hash: AE1196B1905315AFDB24DFA48CC5EAEB6B4BB54310F50022DF266A72C1CB709940DB20

Function 001AE6E2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 001AE707
InflateRect.USER32(?,000000FF,000000FF), ref: 001AE73E
DrawEdge.USER32(?,?,00000000,0000000F), ref: 001AE75E

Strings

iii, xrefs: 001AE724

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$DrawEdgeFillInflate
String ID: iii
API String ID: 785442924-940974255
Opcode ID: f3c9961482d713715a66b11b24430868f45b5507b04e75709ffa7006a308d194
Instruction ID: 324dda3fcc1496ab4e1fb0e2a4d85d00388e8f86fc364f982466ad8a91feb124
Opcode Fuzzy Hash: f3c9961482d713715a66b11b24430868f45b5507b04e75709ffa7006a308d194
Instruction Fuzzy Hash: DB11D675504109AFCF00DFA8ED89DAFBBBDEB49364B104626B915E61A1E7309A09CB60

Function 001DC17A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 001DC196
GetParent.USER32(?), ref: 001DC1B3
IsWindow.USER32(?), ref: 001DC1EF

Strings

e*, xrefs: 001DC1BD, 001DC1C2, 001DC1CF

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Parent$Window
String ID: e*
API String ID: 2655711241-654361256
Opcode ID: 7df31fb729a73d9a736701e571b0f030a9b84c1955bfef1b6bce8967a017a247
Instruction ID: b996409d8b8c2ed5ff0753c05b71beb9b04e85a8b4d8c2d43e49f61e9d626231
Opcode Fuzzy Hash: 7df31fb729a73d9a736701e571b0f030a9b84c1955bfef1b6bce8967a017a247
Instruction Fuzzy Hash: 330171367012225B9B147BB69C48D6B67EDEF99361718047AF909D7252EF30CC00DBE0

Function 00180770 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0018872C: EnterCriticalSection.KERNEL32(00300170,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188766
Part of subcall function 0018872C: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188778
Part of subcall function 0018872C: LeaveCriticalSection.KERNEL32(00300170,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188785
Part of subcall function 0018872C: EnterCriticalSection.KERNEL32(?,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188795

Part of subcall function 0018377C: __EH_prolog3_catch.LIBCMT ref: 00183783

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

GetProcAddress.KERNEL32(00000000,HtmlHelpW), ref: 001807B9
FreeLibrary.KERNEL32(?), ref: 001807C9

Strings

hhctrl.ocx, xrefs: 0018079D
HtmlHelpW, xrefs: 001807B3

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpW$hhctrl.ocx
API String ID: 3274081130-3773518134
Opcode ID: 8605e49e6096071c7d566c414fa553a9baa89f04c785a8353e8375acbacc2df8
Instruction ID: d89fe68c9b2820059f3eff37b7283203872ae261ac8e14e5305af16578642a28
Opcode Fuzzy Hash: 8605e49e6096071c7d566c414fa553a9baa89f04c785a8353e8375acbacc2df8
Instruction Fuzzy Hash: 3001F93510170AEBCB223FA1DC0AB1B7BA4EF187A1F108425F59A915A1DB70E9509F61

Function 00176521 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00176533
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00176543

Strings

Advapi32.dll, xrefs: 0017652E
RegCreateKeyTransactedW, xrefs: 0017653D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1646373207-2994018265
Opcode ID: 79c6be8f0cd904f43a4db97f325650d1d5d7989717d6b3973fb52a3cab05f9d9
Instruction ID: 7551508a8f2ddd1bde91e2e42d30c343a3be414ae4298e1efbde6a3c06435782
Opcode Fuzzy Hash: 79c6be8f0cd904f43a4db97f325650d1d5d7989717d6b3973fb52a3cab05f9d9
Instruction Fuzzy Hash: CDF03C32501609EBCF225FE09C08FE63FBAEB08791F158425FA48910A0C776D5B0EB60

Function 001764C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 001764DA
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 001764EA

Strings

Advapi32.dll, xrefs: 001764D5
RegOpenKeyTransactedW, xrefs: 001764E4

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1646373207-3913318428
Opcode ID: 049ac5e9db155ba058ec81fff0b4c4ab8fe68056e66646843f64866471145630
Instruction ID: baeff7bcf0548773d478f5ed59dc4fd2ee2053680ce98051c548650747c9809e
Opcode Fuzzy Hash: 049ac5e9db155ba058ec81fff0b4c4ab8fe68056e66646843f64866471145630
Instruction Fuzzy Hash: 94F05436151605EBDB256FA4EC08BA63BA9EF04791F158429F549910A0C772C9A0EBB0

Function 001EA573 Relevance: 6.4, APIs: 4, Instructions: 435COMMON

Download Yara Rule

APIs

Part of subcall function 00179DC5: ClientToScreen.USER32(?,00198C1D), ref: 00179DD6
Part of subcall function 00179DC5: ClientToScreen.USER32(?,00198C25), ref: 00179DE3

Part of subcall function 001E7F2A: SetRectEmpty.USER32(?), ref: 001E7F37
Part of subcall function 001E7F2A: GetWindowRect.USER32(?,?), ref: 001E7F48

IsRectEmpty.USER32(?), ref: 001EA5D4
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 001EA665
GetWindowRect.USER32(?,?), ref: 001EA904
EqualRect.USER32(?,?), ref: 001EA91D

Part of subcall function 001E8323: GetWindowRect.USER32(?,?), ref: 001E835A
Part of subcall function 001E8323: OffsetRect.USER32(?,00000000,?), ref: 001E8384

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Window$ClientEmptyScreen$EqualOffsetRedraw
String ID:
API String ID: 1200911113-0
Opcode ID: 1a1172df820b6bc84a395b3397cf53e7a0434f6cd65a373c9988654e34e6050e
Instruction ID: 72e7bf368026f614a5db4454552ffe2be0d96c687c06b18a8a012df82c23caa4
Opcode Fuzzy Hash: 1a1172df820b6bc84a395b3397cf53e7a0434f6cd65a373c9988654e34e6050e
Instruction Fuzzy Hash: 36F16C31E00649DFCF24DFAAC988AADBBB5FF54300F59402AE805AB251DB34AD45CF52

Function 02AF9710 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 02AF9748
IsBadReadPtr.KERNEL32(?,00000014), ref: 02AF9818
SetLastError.KERNEL32(0000007F), ref: 02AF9843

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Read$ErrorLast
String ID:
API String ID: 2715074504-0
Opcode ID: 1c7b1a7f58a51fa84063ffdcfe02eccecf4805e2de857b7ce448ba46b3cde902
Instruction ID: 3c85cf1a1a70d64c85bc21e8715f01793e0f4511aff93581c48163462102f365
Opcode Fuzzy Hash: 1c7b1a7f58a51fa84063ffdcfe02eccecf4805e2de857b7ce448ba46b3cde902
Instruction Fuzzy Hash: 95416A75A00206DBDB20CF9AD880B6AF7F9EF84714F148959E90997340EB75F911CB90

Function 02AFE690 Relevance: 6.3, APIs: 5, Instructions: 80stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 02AFE6A8
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 02AFE6D0
GetLastError.KERNEL32 ref: 02AFE6DF
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 02AFE6F9
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,?,00000000), ref: 02AFE723

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: 2f2043ac3b50e9f2de3b5ad68cacbc3cef814c5564515ed902e90998e6083275
Instruction ID: b0eb65084c7c0d3f9f18352320d15c79bc52d862dd8565a26e0d084dcde0802e
Opcode Fuzzy Hash: 2f2043ac3b50e9f2de3b5ad68cacbc3cef814c5564515ed902e90998e6083275
Instruction Fuzzy Hash: B111B136640224BFD7609B95DC88F673B7EEF85BA0F008500FE48AF240DA70A91887F4

Function 02B00410 Relevance: 6.3, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?,?,?,?,?,?,?,?,02B0084E), ref: 02B0041E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,02B0084E), ref: 02B0042E
SetLastError.KERNEL32(0000139F,?,?,?,?,?,?,?,?,?,02B0084E), ref: 02B0043F
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,02B0084E), ref: 02B00446

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 4c1d1fc9c3ac2da976fa80ab44093c8e156a697a1d022c7286080f8356a82e97
Instruction ID: 23f155d8e6b7f0c345575f64ccd95bb9008dbde60803b47b1c8645959aec1153
Opcode Fuzzy Hash: 4c1d1fc9c3ac2da976fa80ab44093c8e156a697a1d022c7286080f8356a82e97
Instruction Fuzzy Hash: 6AF0E2339402108BC32027BCB808A9E7FF9EB5A772F440F1AF262E31C0C7B098A18650

Function 001BA53F Relevance: 6.3, APIs: 4, Instructions: 258keyboardCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 001BA56B
GetKeyState.USER32(00000011), ref: 001BA573
IsRectEmpty.USER32(?), ref: 001BA5D0
GetWindowRect.USER32(?,?), ref: 001BA74D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$StateWindow
String ID:
API String ID: 2684165152-0
Opcode ID: b20735e9ae2fd511608c39778222e89fa5198418c3a3a21aa8e240b361590257
Instruction ID: fe1b0e217bc152df491ddad57541b5896a0d2c48110a5dce45840014b9e9a679
Opcode Fuzzy Hash: b20735e9ae2fd511608c39778222e89fa5198418c3a3a21aa8e240b361590257
Instruction Fuzzy Hash: BA919D31A002059FCF15DFA4D885AEEBBB5FF48310F248169F905AB291DB319D41CFA1

Function 001B6245 Relevance: 6.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001B6288
CopyRect.USER32(?,?), ref: 001B6293
GetClientRect.USER32(?,?), ref: 001B62AC
SystemParametersInfoW.USER32(00000026,00000000,?,00000000), ref: 001B6442

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$ClientCopyInfoParametersSystemWindow
String ID:
API String ID: 1264264222-0
Opcode ID: 14eff148275395ea9be91cb1d0488f99ae29b69fd896bcae5cf348bcfaefdf5e
Instruction ID: 6c0c0af36ce1e33f670e9fcfb989853f102b3b643180a295d91afadfb26cf738
Opcode Fuzzy Hash: 14eff148275395ea9be91cb1d0488f99ae29b69fd896bcae5cf348bcfaefdf5e
Instruction Fuzzy Hash: 07811C71E00619EFCF14DFA8C9889EDBBB4FF58700F258169E816A7244DB74A945CFA0

Function 001DE396 Relevance: 6.2, APIs: 4, Instructions: 187windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 001DE441
CreateCompatibleBitmap.GDI32(?,?,?), ref: 001DE45B
GetObjectW.GDI32(?,00000018,?), ref: 001DE564

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

InvalidateRect.USER32(?,00000000,00000001,?,00000000,?,?,?), ref: 001DE5F7

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CompatibleCreate$BitmapException@8InvalidateObjectRectThrow
String ID:
API String ID: 4050247650-0
Opcode ID: 861e307c8e4f4223ee20e93469f18e8c27c2691fd89e23dc64a5d412b64383c4
Instruction ID: 73837d0eeff86041f31eee11fd2c788b9406bbd8173630ee578c3956d8175a1d
Opcode Fuzzy Hash: 861e307c8e4f4223ee20e93469f18e8c27c2691fd89e23dc64a5d412b64383c4
Instruction Fuzzy Hash: 77718075900158EBCB24EB60CC55EEEB7F9EF58305F10449AF90AA7281DBB06E84CF21

Function 0019CBE4 Relevance: 6.2, APIs: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0019CC0E
InflateRect.USER32(?,00000002,00000002), ref: 0019CDA6
InvalidateRect.USER32(?,?,00000001), ref: 0019CDB5
UpdateWindow.USER32(?), ref: 0019CDBE

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$InflateInvalidateParentUpdateWindow
String ID:
API String ID: 4005937429-0
Opcode ID: b4fd5b32fa8df7f463f23f95cc690ade008cb001d25ea9f7dfd98a58fd1bcdc5
Instruction ID: 7f3e6e983352a9681b702e65c441bd02666ad2df3b8c2b353f5f46c30a87d44b
Opcode Fuzzy Hash: b4fd5b32fa8df7f463f23f95cc690ade008cb001d25ea9f7dfd98a58fd1bcdc5
Instruction Fuzzy Hash: 0451D071E006049FCF25EFA9D8449AEBBF9FF98350F24406AE849A7211DB709E41CBD0

Function 001FC0C7 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 001FC19B
IsRectEmpty.USER32(?), ref: 001FC1B4
GetClientRect.USER32(?,?), ref: 001FC1CC
SetRectEmpty.USER32(?), ref: 001FC1E2

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$ClientException@8Throw
String ID:
API String ID: 1670096423-0
Opcode ID: 6a27ae69f985423e94c9d23cab385fdcad17af03f07f3e2e8dd4fc70694e3a59
Instruction ID: 532623fb94d8ddbd002754ee580a672198563a259d1ca2a0b48dc80d0eeb6c53
Opcode Fuzzy Hash: 6a27ae69f985423e94c9d23cab385fdcad17af03f07f3e2e8dd4fc70694e3a59
Instruction Fuzzy Hash: 3E613971A0020EDFCB00DFE8CA949EEBBF5BF58314F144169E515A7291DB34A941DFA0

Function 001E80DF Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 001E8154
GetWindowRect.USER32(?,?), ref: 001E81B1
IsRectEmpty.USER32(?), ref: 001E81C0
OffsetRect.USER32(?,00000000,?), ref: 001E8238

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$Empty$OffsetWindow
String ID:
API String ID: 3444667153-0
Opcode ID: 35d203d44d4518b828b0eb3ec6573df377e5324f69ea804057a1d2469d2ed89b
Instruction ID: 9a6ed235c1a0ad38ac9237c194388ed3d3d9652652e0641a354ca60e652da0c4
Opcode Fuzzy Hash: 35d203d44d4518b828b0eb3ec6573df377e5324f69ea804057a1d2469d2ed89b
Instruction Fuzzy Hash: 6D51D771D00A9ADFCF14DFAAD9849EEB7B4BF08700F15456AE519B7240CB71AD41CBA0

Function 001A41B0 Relevance: 6.2, APIs: 4, Instructions: 155timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001A41D3
GetFileTime.KERNEL32(?,?,?,?), ref: 001A4211
GetFileSizeEx.KERNEL32(?,?), ref: 001A4229

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: File$SizeTime_memset
String ID:
API String ID: 151880914-0
Opcode ID: e136edac72ff0d550366e3e482d25843b7b217f4ddb3cb55b6b8e52b761fbf18
Instruction ID: 9bc7ee0b5b27a398f8c116aa9ad1c6be609cd25e82f8aabcd574b62a0778c812
Opcode Fuzzy Hash: e136edac72ff0d550366e3e482d25843b7b217f4ddb3cb55b6b8e52b761fbf18
Instruction Fuzzy Hash: 08516C79910705AFCB24DFA8D884DAAB7F8FF593107108A2EF466D7690E770E944CB60

Function 002466C6 Relevance: 6.2, APIs: 4, Instructions: 155windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002466CD
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 00246834
SendMessageW.USER32(?,00000150,?,00000000), ref: 00246880
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 002468B2

Part of subcall function 001793A6: __EH_prolog3_GS.LIBCMT ref: 001793B0

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend$H_prolog3H_prolog3_
String ID:
API String ID: 1270747201-0
Opcode ID: 9b057a6ac290e4af528f4fc1b5fbe0c0cdcd08a8fb20b523c4083c615ad17488
Instruction ID: af65382426a3519fd87e66811b6474cdbaf117863cbe7380dfe27cc2db3bea12
Opcode Fuzzy Hash: 9b057a6ac290e4af528f4fc1b5fbe0c0cdcd08a8fb20b523c4083c615ad17488
Instruction Fuzzy Hash: 7E514C31200B049BDB15EF74CC95FAEB7B6AF58300F40492DF59B972A2DB34AA58CB51

Function 001DE80F Relevance: 6.2, APIs: 4, Instructions: 151windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 001DE8AB
CreateCompatibleBitmap.GDI32(?,?,?), ref: 001DE8C5

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Part of subcall function 0017A2DA: SelectObject.GDI32(?,?), ref: 0017A2E5

FillRect.USER32(?,00000000), ref: 001DE923
GetObjectW.GDI32(?,00000018,?), ref: 001DE958

Part of subcall function 0024C280: __EH_prolog3.LIBCMT ref: 0024C287
Part of subcall function 0024C280: GetObjectW.GDI32(00000005,00000018,?), ref: 0024C375

Part of subcall function 001783B9: __EH_prolog3_catch.LIBCMT ref: 001783C0
Part of subcall function 001783B9: FindResourceW.KERNEL32(?,?,00000005,00000024,001DE5BC,?,?,?), ref: 001783F6
Part of subcall function 001783B9: LoadResource.KERNEL32(?,00000000,?,?), ref: 001783FE
Part of subcall function 001783B9: LockResource.KERNEL32(?,00000024,001DE5BC,?,?,?), ref: 0017840F

Part of subcall function 001DE317: __EH_prolog3.LIBCMT ref: 001DE31E
Part of subcall function 001DE317: ~_Task_impl.LIBCPMT ref: 001DE362
Part of subcall function 001DE317: ~_Task_impl.LIBCPMT ref: 001DE371
Part of subcall function 001DE317: ~_Task_impl.LIBCPMT ref: 001DE380

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ObjectResourceTask_impl$CompatibleCreateH_prolog3$BitmapException@8FillFindH_prolog3_catchLoadLockRectSelectThrow
String ID:
API String ID: 2430407417-0
Opcode ID: 24377dec1e3bf6cb4a4a90e7da7ac9f0a573b8d35e32e1e0a85840f732ea30e6
Instruction ID: c7d80f39d9115b0eeabd8c984dd987e9043cdd295ed9b380f9de3270a3a6ddb4
Opcode Fuzzy Hash: 24377dec1e3bf6cb4a4a90e7da7ac9f0a573b8d35e32e1e0a85840f732ea30e6
Instruction Fuzzy Hash: 3A51BE75901298EBCB15EB60CC55BEEB7B8BF18305F1041DAF809A7291DBB19E84CF61

Function 0018215C Relevance: 6.1, APIs: 4, Instructions: 132windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182163
SendDlgItemMessageA.USER32(?,?,?,00000000,?), ref: 001822AF

Part of subcall function 0017432D: _malloc.LIBCMT ref: 0017434B

SendDlgItemMessageW.USER32(?,?,0000040B,00000000,?), ref: 0018223B

Part of subcall function 00189E6C: __EH_prolog3.LIBCMT ref: 00189E73

SendDlgItemMessageW.USER32(?,?,0000037C,?,?), ref: 0018226D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ItemMessageSend$H_prolog3$_malloc
String ID:
API String ID: 2480034192-0
Opcode ID: 8eb40edadbdff0719852d26df7cc3710bbaac6cc557ca545e09ec3b48461cba7
Instruction ID: 633d20de48500c07e96c617ef656976445ec20e45b4c347b15eacb5398ac74d1
Opcode Fuzzy Hash: 8eb40edadbdff0719852d26df7cc3710bbaac6cc557ca545e09ec3b48461cba7
Instruction Fuzzy Hash: 2641B171900105ABDF26ABA4CC44BBE76B6FF94320FA04219FA65B62D4DB744F42DB50

Function 02B00580 Relevance: 6.1, APIs: 4, Instructions: 122networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,CD663CB9,?,?,?,?,?,02B12FB8,000000FF), ref: 02B005CE
WSASetLastError.WS2_32(0000000D), ref: 02B005E6
LeaveCriticalSection.KERNEL32(?), ref: 02B005ED

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: d5ea1267338397285577186ccfa70064dc6477a6a40763a967bd431a4e9b669b
Instruction ID: 3ec744259f493443a3106c740ed6af579f694856e6262f211a81434846b22252
Opcode Fuzzy Hash: d5ea1267338397285577186ccfa70064dc6477a6a40763a967bd431a4e9b669b
Instruction Fuzzy Hash: 844105726446449FD715DF95D980F6BBBB9FB88724F004A69E906C36C1DB31E800CB60

Function 00176A91 Relevance: 6.1, APIs: 4, Instructions: 121registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?,00000000,745E08A5,?,?,?,?,0027EDBC,000000FF), ref: 00176B47
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?,?,?,?,?,?,0027EDBC,000000FF), ref: 00176B83
RegCloseKey.ADVAPI32(?,?,?,?,?,0027EDBC,000000FF), ref: 00176B9E
GetPrivateProfileStringW.KERNEL32(?,?,?,?,00001000,?), ref: 00176C07

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: QueryValue$ClosePrivateProfileString
String ID:
API String ID: 1042844925-0
Opcode ID: 1aa10d95f7309d992c818029f5870732e235655c9848c774d61bee06a2e9e71e
Instruction ID: 2613add93ef3c3aaa1c531628ba0a11aec15e4d9ffc45e14ea5492fe11760417
Opcode Fuzzy Hash: 1aa10d95f7309d992c818029f5870732e235655c9848c774d61bee06a2e9e71e
Instruction Fuzzy Hash: 98414971D00328EBCB269F14DC4899EB7B9EB58310F10859AF51DA3292D7309E98DFA1

Function 0019636C Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0019642C
SetRectEmpty.USER32(?), ref: 00196439
SetRectEmpty.USER32(?), ref: 001964E7
SetRectEmpty.USER32 ref: 00196544

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 38e54fcceedced7a9a27d14ef4b9f915603cc1ea69dabf9c6372befabbe7261a
Instruction ID: ffa356861683855dee73c8195c1a405cf9db142a65a61c29849f0c0b7a74a949
Opcode Fuzzy Hash: 38e54fcceedced7a9a27d14ef4b9f915603cc1ea69dabf9c6372befabbe7261a
Instruction Fuzzy Hash: D451ADB1801B858FC760CF7AD5846EAFAE8FF94350F104A2FD0AED2661DBB064419F50

Function 001A8185 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 001A8251
ClientToScreen.USER32(?,?), ref: 001A8261
IsWindow.USER32(?), ref: 001A8283
ClientToScreen.USER32(?,?), ref: 001A82B8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ClientScreenWindow
String ID:
API String ID: 1643562046-0
Opcode ID: 476dc28a1d22fd5769c9527128da1f67b5430811b79467395da54fea82a3ddcb
Instruction ID: 25a9f4740c51842b630315618a72469d34222903d87966d610fed4cdfb6c3ecb
Opcode Fuzzy Hash: 476dc28a1d22fd5769c9527128da1f67b5430811b79467395da54fea82a3ddcb
Instruction Fuzzy Hash: DC41A079500A00AFDF259F94CC84ABE7BF9EF0A340F24446AF995D2161EF31D980CB50

Function 02B0C8C9 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02B0C8FD
__isleadbyte_l.LIBCMT ref: 02B0C930
MultiByteToWideChar.KERNEL32(00000080,00000009,02B04309,?,00000000,00000000,?,?,?,?,02B04309,00000000), ref: 02B0C961
MultiByteToWideChar.KERNEL32(00000080,00000009,02B04309,00000001,00000000,00000000,?,?,?,?,02B04309,00000000), ref: 02B0C9CF

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0f6067f547c2cf77449385a7ae9828ffd71c38f453d5022c3b685e125db2ee17
Instruction ID: 12013ce439b1be16abaf843f6e9c1fb37e13da666dff847456a8810d77867bad
Opcode Fuzzy Hash: 0f6067f547c2cf77449385a7ae9828ffd71c38f453d5022c3b685e125db2ee17
Instruction Fuzzy Hash: 68318B31A00346EFDB22DFA8C8C4ABE3FA5FF01214B1546EAE5A5AB1E1D730D941DB54

Function 0027A635 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0027A669
__isleadbyte_l.LIBCMT ref: 0027A69C
MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000,?,?,?,8007000E,00000000,00000000), ref: 0027A6CD
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,00000000,00000000,?,?,?,8007000E,00000000,00000000), ref: 0027A73B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 3da01fc122d46e4d66307012ea897a79346ab60e2633ed8d5ee5bbe98ee28e32
Instruction ID: 30fd426a03883a8c8cf3fba380ab09ca547340da28bd30a79ce1eb8fd8156faf
Opcode Fuzzy Hash: 3da01fc122d46e4d66307012ea897a79346ab60e2633ed8d5ee5bbe98ee28e32
Instruction Fuzzy Hash: E831F331920256EFCF20DF64C8819BE7BB9BF41320F19C568E1698B191E370DD60DB52

Function 001EC250 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000015), ref: 001EC2AC
SetRectEmpty.USER32(?), ref: 001EC303
SetRectEmpty.USER32(?), ref: 001EC30C
SetRectEmpty.USER32(?), ref: 001EC31B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect$MetricsSystem
String ID:
API String ID: 4159773870-0
Opcode ID: fec8323dfd2fe38fa8ecda0b5086218a5b7c80d073fc15e8937ee2e64808f367
Instruction ID: 75bc28c719d14294def2f0295a10fbe0e12f24e34ab5823ccad42b75656a4c54
Opcode Fuzzy Hash: fec8323dfd2fe38fa8ecda0b5086218a5b7c80d073fc15e8937ee2e64808f367
Instruction Fuzzy Hash: A031387190065ADBCF04DFA9D888AEE77B5BB45304F1801B9ED09AF145D770A946CBA0

Function 001DC6FE Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001DC72D
GetParent.USER32(?), ref: 001DC736

Part of subcall function 00179D84: ScreenToClient.USER32(?,?), ref: 00179D95
Part of subcall function 00179D84: ScreenToClient.USER32(?,?), ref: 00179DA2

OffsetRect.USER32(?,00000000,?), ref: 001DC777
OffsetRect.USER32(?,?,00000000), ref: 001DC789

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$ClientOffsetScreen$ParentWindow
String ID:
API String ID: 182828750-0
Opcode ID: b045f64fecf07eed01105c7f20e307b20fc0c3a0a8438c5f4a96741f3098e28a
Instruction ID: 4c23fd06b38315dbe1a0987b37dc28d47fff78292426484109b9148fd369be23
Opcode Fuzzy Hash: b045f64fecf07eed01105c7f20e307b20fc0c3a0a8438c5f4a96741f3098e28a
Instruction Fuzzy Hash: 8C210CB5900109AFDB14DBA9DD88DBFBBBCEB98300B20492AF506E6251DB349944CB61

Function 02AFF060 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,CD663CB9,?,?,?,?,00000000,02B12FB8,000000FF,?,02AFF7FB,?,?,?), ref: 02AFF092
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00000000,02B12FB8,000000FF,?,02AFF7FB,?,?,?), ref: 02AFF0AB
LeaveCriticalSection.KERNEL32(?), ref: 02AFF11C
SetEvent.KERNEL32(?), ref: 02AFF137

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 9bc9de4dc0ed03fb756e16f62e901a3983178bc9b05a9aa48b01602d8abae1e8
Instruction ID: af8dd6c7636cc6203c33c470f900f4877a7d39679327e8ae483a405e603ab59f
Opcode Fuzzy Hash: 9bc9de4dc0ed03fb756e16f62e901a3983178bc9b05a9aa48b01602d8abae1e8
Instruction Fuzzy Hash: AF3161B1A04604DFC314CFA9D880AAAFBF5FF49710F90856EE95AC7740DB35A851CB80

Function 001C6303 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 001C6324
ScreenToClient.USER32(?,00000000), ref: 001C6331
SetCursor.USER32 ref: 001C635E
PtInRect.USER32(?,00000000,00000000), ref: 001C63C8

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Cursor$ClientRectScreen
String ID:
API String ID: 2390797981-0
Opcode ID: 8a481819af263109b6dfb91f0f5ce48915135688d4850bac3ca68cbba26d4a97
Instruction ID: b0a0465abe6b6db734d79221e077098cb979c2ce09676b0eb449e16e5989c079
Opcode Fuzzy Hash: 8a481819af263109b6dfb91f0f5ce48915135688d4850bac3ca68cbba26d4a97
Instruction Fuzzy Hash: F0215A36510689EFCB219FA4D948FAEBBFAFB64710F10546DE009D2010DB70EA90DF10

Function 02AF1190 Relevance: 6.1, APIs: 4, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02AF11C9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02AF1206
_memmove.LIBCMT ref: 02AF1222
VirtualFree.KERNEL32(?,00000000,00008000), ref: 02AF1235

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4_memmove
String ID:
API String ID: 1828152804-0
Opcode ID: a18f593b262a3ac0d8a3830e7f24114500484204d5ed1027345d0c048f614851
Instruction ID: b28b954964f75d106b9d54ca884d48b024bf294a66569dde9ba1729161c4ec3b
Opcode Fuzzy Hash: a18f593b262a3ac0d8a3830e7f24114500484204d5ed1027345d0c048f614851
Instruction Fuzzy Hash: F121B070E403089BDB149FE9E885B6EFBF4EF40705F0089ADE95DA3640EA34A8548B44

Function 001B45D9 Relevance: 6.1, APIs: 4, Instructions: 73keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 001B45F0
GetCursorPos.USER32(?), ref: 001B4636
SetRectEmpty.USER32(?), ref: 001B464C
IsRectEmpty.USER32(?), ref: 001B4676

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EmptyRect$CursorState
String ID:
API String ID: 2369637639-0
Opcode ID: c278f66b20f6909d39038e3c0e33cb123cf3e8f11a98f160ac06d2a28135299a
Instruction ID: ffc2280408d9ea7d7e54482b18a956fe0f0aac5ae11aa45bed6fbd1d61ec3beb
Opcode Fuzzy Hash: c278f66b20f6909d39038e3c0e33cb123cf3e8f11a98f160ac06d2a28135299a
Instruction Fuzzy Hash: 9321FCB1E00229AFDF11DFE4D8859EEBBBCFB49744F51402BE505F2101EB749A458BA1

Function 001CE8AB Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001CE8B2
GetSystemPaletteEntries.GDI32(?,00000000,00000100,00000004), ref: 001CE91A
CreatePalette.GDI32(00000000), ref: 001CE965

Part of subcall function 001CE48E: GetObjectW.GDI32(?,00000002,?), ref: 001CE49D

Part of subcall function 0017432D: _malloc.LIBCMT ref: 0017434B

GetPaletteEntries.GDI32(00000000,00000000,00000000,00000004), ref: 001CE94C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Palette$Entries$CreateH_prolog3ObjectSystem_malloc
String ID:
API String ID: 437169817-0
Opcode ID: 6e9e4f26f1d0e03031520017255829ffd193667d8d77e84014f4b51296fb67ad
Instruction ID: 3dd5b511b6d0ecb759268a9c3df2414f7b01dc89edc0b678dc444a4766230f74
Opcode Fuzzy Hash: 6e9e4f26f1d0e03031520017255829ffd193667d8d77e84014f4b51296fb67ad
Instruction Fuzzy Hash: E721AF36605200ABDB14AFA0D849F9E77F4AF69700F14802DF65ECB192DB349900CB61

Function 001F8BF1 Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001F8C42
_memcpy_s.LIBCMT ref: 001F8C58
SendMessageW.USER32(?,00000438,00000000,?), ref: 001F8C74
_memcmp.LIBCMT ref: 001F8C89

Part of subcall function 0017905E: __CxxThrowException@8.LIBCMT ref: 00179074

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Exception@8MessageSendThrow_memcmp_memcpy_s_memset
String ID:
API String ID: 3731674294-0
Opcode ID: 8155d6ac3a26ae6b62763df0b8a1d9120506d218a8248acde71b64c87d5246e6
Instruction ID: f5fe4d9a7b3884f9b44de094183041de356f7045479f867ae52b3b6a7cfc7115
Opcode Fuzzy Hash: 8155d6ac3a26ae6b62763df0b8a1d9120506d218a8248acde71b64c87d5246e6
Instruction Fuzzy Hash: 33116372A10209ABDB10EFA4CC46FAF737CBB58310F204525B615F7181DA74A9058B61

Function 02AF10E0 Relevance: 6.1, APIs: 4, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02AF110F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02AF113F
_memmove.LIBCMT ref: 02AF115B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 02AF1172

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4_memmove
String ID:
API String ID: 1828152804-0
Opcode ID: 69c55e43c38d279b13813ff17e495220162d301dce567548197b1b754bc2ba0a
Instruction ID: 5cf82fec65d0db4d81b1154bcfb17374d2d75ec03bcac462088950a82997dc83
Opcode Fuzzy Hash: 69c55e43c38d279b13813ff17e495220162d301dce567548197b1b754bc2ba0a
Instruction Fuzzy Hash: B111B470E40304AFDB509FA9D885B6EBBF4FF04745F0089ADF959E3240EB74A8548B54

Function 02AFF2F0 Relevance: 6.1, APIs: 4, Instructions: 64threadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02AFF2F4
WSACloseEvent.WS2_32(?), ref: 02AFF357
shutdown.WS2_32(02AFB977,00000001), ref: 02AFF36B
closesocket.WS2_32(02AFB977), ref: 02AFF375

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CloseCurrentEventThreadclosesocketshutdown
String ID:
API String ID: 802825583-0
Opcode ID: fe86d8ac4c76085594a99d2114f9861d82c1080862221b689c2114fdef242439
Instruction ID: 96acb7053d5afbaf69925d63b7c3fda190f398e0b7ee13f8766775e65559c87e
Opcode Fuzzy Hash: fe86d8ac4c76085594a99d2114f9861d82c1080862221b689c2114fdef242439
Instruction Fuzzy Hash: 8C115E75600B008FC634DF6DE88495AF3FAAF887107148B59F5A6C7790DB79E8428B90

Function 00178894 Relevance: 6.1, APIs: 4, Instructions: 62windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017889B

Part of subcall function 0017432D: _malloc.LIBCMT ref: 0017434B

__CxxThrowException@8.LIBCMT ref: 001788E0
FormatMessageW.KERNEL32(00001100,00000000,?,00000800,8007000E,00000000,00000000,?,8007000E,002BE2C4,00000004,00173CDC,8007000E), ref: 0017890A
LocalFree.KERNEL32(8007000E,00173CDC,8007000E), ref: 00178938

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc
String ID:
API String ID: 1776251131-0
Opcode ID: dec6f2acd2597cb5023aa8d7d2e53aa9997abd86028dad7798d89a67f903adc3
Instruction ID: 337243fcfa490dd47fc2bc3c5992243107579290482ab5d89af5282bfc85167f
Opcode Fuzzy Hash: dec6f2acd2597cb5023aa8d7d2e53aa9997abd86028dad7798d89a67f903adc3
Instruction Fuzzy Hash: 1611B271910244AFDB00AF64DC05ABE37B4FF54724F21C519F9699A2D1DB309A508B91

Function 02AF9D50 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02AF9D73
_free.LIBCMT ref: 02AF9DB5
GetProcessHeap.KERNEL32(00000000,00000000,02AF9B75), ref: 02AF9DDC
HeapFree.KERNEL32(00000000), ref: 02AF9DE3

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Heap_free$FreeProcess
String ID:
API String ID: 1072109031-0
Opcode ID: 9fdfce40ba9a8d1ea434d8d831803dafd567cf303f1b69bb2f0a1512b04af5f6
Instruction ID: 2918e9ec9951b25a9b0da25908a2024031c7c9fa6dae868e9ba7b203720a6621
Opcode Fuzzy Hash: 9fdfce40ba9a8d1ea434d8d831803dafd567cf303f1b69bb2f0a1512b04af5f6
Instruction Fuzzy Hash: 95118E72A017019BE770DBA4CC84B5773E9BF84704F24891CE68A47A80DB78F452CB51

Function 00206375 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000146,00000000,00000000), ref: 00206399
SendMessageW.USER32(?,00000150,?,00000000), ref: 002063AF
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 002063C4
SendMessageW.USER32(?,0000014E,?,00000000), ref: 00206406

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 448a00695929a23044420a32c8399c5150cfc27315d118f287e4b741b79844df
Instruction ID: 061a742a2239fced87ff95e692b209704eeefff257c1880b6f2669c5355e2b93
Opcode Fuzzy Hash: 448a00695929a23044420a32c8399c5150cfc27315d118f287e4b741b79844df
Instruction Fuzzy Hash: 7A11AC71610705BFEB109B64CD45FABB7E9EB44741F20047AF60AE6291D670AD20DF60

Function 02AFE1B0 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 02AFE1CE
TranslateMessage.USER32(?), ref: 02AFE1F1
DispatchMessageW.USER32(?), ref: 02AFE1F7
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 02AFE205

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: cc2e1b203548a6dd07a168c156a713425716d57e80fa9fe07d43cb32cf5740f6
Instruction ID: 1139a06074990f1eb1da2da818c3332f53e270aa9f6b0c09fba4b965dfa3aca6
Opcode Fuzzy Hash: cc2e1b203548a6dd07a168c156a713425716d57e80fa9fe07d43cb32cf5740f6
Instruction Fuzzy Hash: 5601F733F5120867EB20D6E9AD81FEAB7ACD784724F500167FB04E7080DAA9E44187E4

Function 00176725 Relevance: 6.1, APIs: 4, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 00176762
RegCloseKey.ADVAPI32(00000000), ref: 0017676B
swprintf.LIBCMT ref: 00176788
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00176799

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: e23627cbe6ebaa4fa27739997411d85c903f55f2e1dee9f740e388de51ea606e
Instruction ID: 5a6605689f384ab6627878cd61b9e463147a370b22367403d654ced32b358f91
Opcode Fuzzy Hash: e23627cbe6ebaa4fa27739997411d85c903f55f2e1dee9f740e388de51ea606e
Instruction Fuzzy Hash: CF01C036501308BBDB20AB649C8AFAF77FCEF48758F64441AF605A7180DB74ED1487A0

Function 02AFB150 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02AFAF50: _free.LIBCMT ref: 02AFAF8C

HeapDestroy.KERNEL32(00000000,CD663CB9,?,?,?,?,02B12D33,000000FF), ref: 02AFB190
HeapCreate.KERNEL32(00000001,?,?,CD663CB9,?,?,?,?,02B12D33,000000FF), ref: 02AFB1A2
_free.LIBCMT ref: 02AFB1B2
HeapDestroy.KERNEL32(?,?,?,?,?,02B12D33,000000FF), ref: 02AFB1E0

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Heap$Destroy_free$Create
String ID:
API String ID: 3093871995-0
Opcode ID: aabf58e4246e170b1103cea9a556205407bf65ffdeaadc167b74fe3911ded20d
Instruction ID: 20f0a63bc6f6f3d46b1fa0fcf536d121eed3ac7b9bc3e1be2060849a963631dc
Opcode Fuzzy Hash: aabf58e4246e170b1103cea9a556205407bf65ffdeaadc167b74fe3911ded20d
Instruction Fuzzy Hash: 981136B5944B049FD724CF55D844B57BBF8FB08764F004A5EEC9A93740DBB8A944CBA0

Function 001A00E2 Relevance: 6.1, APIs: 4, Instructions: 52fileCOMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 001A0100
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 001A0119
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 001A014C
DragFinish.SHELL32(?), ref: 001A0174

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Drag$FileQuery$ActiveFinishWindow
String ID:
API String ID: 892977027-0
Opcode ID: 28ec56b245a4e5fc7a11b9e1a73c00c340494f254631b078749cc46add4f8335
Instruction ID: 8cc728b6ecdda60777a6343150a0e7abc91753fec1104d9e2281e1dfac899c42
Opcode Fuzzy Hash: 28ec56b245a4e5fc7a11b9e1a73c00c340494f254631b078749cc46add4f8335
Instruction Fuzzy Hash: 25112A75941218ABCB20EB64EC8DFEDB7B8EF58314F100596E119A7191CB74AA84CF60

Function 001C2AD5 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001C2B12
GetSystemMetrics.USER32(0000002D), ref: 001C2B26
GetSystemMetrics.USER32(00000002), ref: 001C2B2E
SendMessageW.USER32(?,0000101E,00000000,00000000), ref: 001C2B46

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: MetricsSystem$ClientMessageRectSend
String ID:
API String ID: 2251314529-0
Opcode ID: 17e7cbc666d3f88cc18aec121a44e64be5e2631465c7ac226606f076a7839c2f
Instruction ID: ac34614f8f0938cdc9b337cc75da74f8389e833b891144e7e90013196888ecb3
Opcode Fuzzy Hash: 17e7cbc666d3f88cc18aec121a44e64be5e2631465c7ac226606f076a7839c2f
Instruction Fuzzy Hash: 02011272A01214AFCB10DF799D89AAEBBF9EB48300F11417AE905F7191E6709D04CB60

Function 001F8410 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

WindowFromPoint.USER32(?,?), ref: 001F8429
GetParent.USER32(00000000), ref: 001F8437
ScreenToClient.USER32(00000000,?), ref: 001F8458
IsWindowEnabled.USER32(00000000), ref: 001F8471

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$ClientEnabledFromParentPointScreen
String ID:
API String ID: 1871804413-0
Opcode ID: d16a8b713d3d55b63077f765f4528f487647c890ec6d4b32cb1cd1d06929c3b4
Instruction ID: 0952dabf095cb3c32747a75a28aa36d3f2f0a55243d2988a6920d3db51399680
Opcode Fuzzy Hash: d16a8b713d3d55b63077f765f4528f487647c890ec6d4b32cb1cd1d06929c3b4
Instruction Fuzzy Hash: 84017136601515AB8712AB58AC08E6EBB69EFC9740B294124FA01D7250EF34DE00DB60

Function 001DC4DB Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 001DC4F1

Part of subcall function 001DC01A: GetWindowRect.USER32(?,?), ref: 001DC030
Part of subcall function 001DC01A: GetParent.USER32(?), ref: 001DC072
Part of subcall function 001DC01A: GetParent.USER32(?), ref: 001DC082

ScreenToClient.USER32(?,?), ref: 001DC519
SetCapture.USER32(?), ref: 001DC539
GetWindowRect.USER32(?,?), ref: 001DC574

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ParentRectWindow$CaptureClientCursorScreen
String ID:
API String ID: 3234571238-0
Opcode ID: 00cbdacbe2a90df62f50909f274944bad2769e7447ad4e047b3382c6580e1504
Instruction ID: 4afa4c57b2b7019a70a460fda9bcad8a4f613caf91300a369fe8503ac557b211
Opcode Fuzzy Hash: 00cbdacbe2a90df62f50909f274944bad2769e7447ad4e047b3382c6580e1504
Instruction Fuzzy Hash: DC114875600608EFDB21DF64D808BEABBF9FF48305F10496DE48A93261DB75AA44CB60

Function 0020A37E Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00000000), ref: 0020A39B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CountItemMenu
String ID:
API String ID: 1409047151-0
Opcode ID: aaae215da797d0f2a49222a6b99768f4b3b798ebb1ed5d18a10f178cdfaceb36
Instruction ID: d0146198428a7343bfdf1e7611ef5e30f46835452f6240726917655eae09cd15
Opcode Fuzzy Hash: aaae215da797d0f2a49222a6b99768f4b3b798ebb1ed5d18a10f178cdfaceb36
Instruction Fuzzy Hash: 7501D135930309FFDB019F74EC889AEBA6DEB84350FB004A5F401D2191E7B0CD50AB62

Function 001B43D4 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 001B440F
DestroyWindow.USER32(?), ref: 001B442B
IsWindow.USER32(?), ref: 001B444A
DestroyWindow.USER32(?), ref: 001B445A

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$Destroy
String ID:
API String ID: 3707531092-0
Opcode ID: 027a39fe8c5888eb51fa5bb1ba5a39eb8c59243635e0781f166410c92d3f723b
Instruction ID: f805c03607b83a13915a956d3dcfe5972e3212370302e887480ae008608be6d6
Opcode Fuzzy Hash: 027a39fe8c5888eb51fa5bb1ba5a39eb8c59243635e0781f166410c92d3f723b
Instruction Fuzzy Hash: 68015635101604AFEB215B74DCC9BE6F7B9FF40761F148129F55843251DB75AC60DBA0

Function 02B09878 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 02B0989E

Part of subcall function 02B096CA: __fltout2.LIBCMT ref: 02B096F5

__cftog_l.LIBCMT ref: 02B098C4
__cftoe_l.LIBCMT ref: 02B098F6

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 206fe9eceb7b9b5d4bbfacb5fdba4b8df1c18063613536be862b9bd217fddb15
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: F211607200064ABBCF175E84CC918EE3F23BF18794B488895FA1854171C736D5B1AB85

Function 0018EA50 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,00000002,00000002), ref: 0018EA8C
InvalidateRect.USER32(?,?,00000001), ref: 0018EA9D
UpdateWindow.USER32(?), ref: 0018EAA6
SetRectEmpty.USER32(?), ref: 0018EAB3

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Rect$EmptyInflateInvalidateUpdateWindow
String ID:
API String ID: 3040190709-0
Opcode ID: 13a62c1b29278fb0061d47a4111377472b161db9d07512e46089875f9e459e79
Instruction ID: 19059d622af7069a6c469bac2e65e87de1e1a4f5a5b67d68a6489c2ad2a7fdd2
Opcode Fuzzy Hash: 13a62c1b29278fb0061d47a4111377472b161db9d07512e46089875f9e459e79
Instruction Fuzzy Hash: 910192B15012059BCB00DFA8EC89ADABBBCFF45724F100265ED05EF0A6CB705A05CF60

Function 0018265C Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,000000F0), ref: 00182682
LoadResource.KERNEL32(?,00000000), ref: 0018268E
LockResource.KERNEL32(00000000), ref: 0018269B
FreeResource.KERNEL32(00000000,00000000), ref: 001826B7

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 186055b7b818017c7855f86188a5f1fad941be690849bc9bccfebdd0ab904a9f
Instruction ID: d53cef96887f9f139164700c34cbcbe2e1cfd0e69c06b8ca0dcb396fe4981301
Opcode Fuzzy Hash: 186055b7b818017c7855f86188a5f1fad941be690849bc9bccfebdd0ab904a9f
Instruction Fuzzy Hash: 04F0C236201202AF97126FE6AC8896BB6ACEF853607244038FE0597251EF70CE018BB4

Function 02AF6E40 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(02B21D84,00000000), ref: 02AF6E63
CreateCompatibleDC.GDI32(00000000), ref: 02AF6E75
SelectObject.GDI32(00000000,?), ref: 02AF6E83
SetDIBColorTable.GDI32(00000000,00000000,00000000,?,00000000,?,02AF6902,?,?,?,00000000), ref: 02AF6E9C

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ColorCompatibleCreateExchangeInterlockedObjectSelectTable
String ID:
API String ID: 2661342499-0
Opcode ID: 76e4ab7b2aef939b9eaa7279ca8c93a8aaaf61c483d55873582008f434c6c354
Instruction ID: 54089893a2b4f10aecab923a32da87685e492e80deabfd5148ffcebec59cfa08
Opcode Fuzzy Hash: 76e4ab7b2aef939b9eaa7279ca8c93a8aaaf61c483d55873582008f434c6c354
Instruction Fuzzy Hash: B301D1B3940204EBDB009FA9DD88FA6B77CEB48760F114166FE1897205E731E850CAA0

Function 001829EF Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00182A04
GetParent.USER32(?), ref: 00182A13
GetParent.USER32(?), ref: 00182A29
SetFocus.USER32(?,00000000), ref: 00182A3F

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Parent$Focus
String ID:
API String ID: 384096180-0
Opcode ID: 503e7cb1d0f1ef191daa3ec8ebc1028c03ef110eba2d93121bf85d5268e65116
Instruction ID: 71a0e177b81b079c0bbf24729f025d059ed52c8f57741332a3621b504d777b9a
Opcode Fuzzy Hash: 503e7cb1d0f1ef191daa3ec8ebc1028c03ef110eba2d93121bf85d5268e65116
Instruction Fuzzy Hash: 4EF0E7325502449BCA357BB1EC0CA5B7AFABFD8311F0549A9E48997666DB74D800CB50

Function 001785B8 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000005), ref: 001785D4
LoadResource.KERNEL32(?,00000000), ref: 001785DC
LockResource.KERNEL32(00000000), ref: 001785E9
FreeResource.KERNEL32(00000000,00000000,?,?), ref: 00178601

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 2bd3fe4858e934c62b3803199d4f70418b03ad3d81c1175bd863fc0183427e18
Instruction ID: 9f508c66e0abc7b5ac4c0f0046382fc8ad8468e9febb64ef0b3250a9da5b6106
Opcode Fuzzy Hash: 2bd3fe4858e934c62b3803199d4f70418b03ad3d81c1175bd863fc0183427e18
Instruction Fuzzy Hash: 41F05E3A202214BFCB016BE9AC8CC9FBBBDEF957A17118015FA09D3251DB748E0187B0

Function 00178524 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000001), ref: 00178544
GetActiveWindow.USER32 ref: 0017854F
SetActiveWindow.USER32(?,?,00000024,001DE5BC,?,?,?), ref: 0017855D
FreeResource.KERNEL32(?,?,00000024,001DE5BC,?,?,?), ref: 00178579

Part of subcall function 00182961: EnableWindow.USER32(?,?), ref: 00182972

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 22ba3bc5c77d5e6871ee4ddd3cf7bc843cf113417dd2069519d838b7a65af823
Instruction ID: 7fea366aa107a25b441172920774a819979157751a2166292d1807828717599a
Opcode Fuzzy Hash: 22ba3bc5c77d5e6871ee4ddd3cf7bc843cf113417dd2069519d838b7a65af823
Instruction Fuzzy Hash: 15F01234A40614CFDF22EF64D94D9ADB7F2BF58702F204469E44672265DB325E41CF21

Function 002568F7 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 0018291F: ShowWindow.USER32(00000000,?,?,00176473,00000000,00000000,00000363,00000001,00000000,00000001,00000001,?,00000000,00000363,00000001,00000000), ref: 00182930

UpdateWindow.USER32(?), ref: 00256924
UpdateWindow.USER32(?), ref: 00256930
SetRectEmpty.USER32(?), ref: 0025693C
SetRectEmpty.USER32(?), ref: 00256945

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Window$EmptyRectUpdate$Show
String ID:
API String ID: 1262231214-0
Opcode ID: 90c430ff61a0ae2533b53f97f232ccab231442ca67ecbeff2db6cb4a8a5b51d3
Instruction ID: 32e6fe77b44bfcccf573d5f339a96d449c601f1f6c1e0cd1e041cd407437c783
Opcode Fuzzy Hash: 90c430ff61a0ae2533b53f97f232ccab231442ca67ecbeff2db6cb4a8a5b51d3
Instruction Fuzzy Hash: 08F08C32210B199FE722AB25EC04B57B7E8BF80722F5A0129E594A7470CB74E8058B60

Function 001DE317 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001DE31E

Part of subcall function 00194CEB: __EH_prolog3.LIBCMT ref: 00194CF2

Part of subcall function 002223D3: __EH_prolog3.LIBCMT ref: 002223DA

Part of subcall function 0024AB90: __EH_prolog3.LIBCMT ref: 0024AB97
Part of subcall function 0024AB90: DestroyIcon.USER32(?,00000004,001DE358,00000004,001DE5D7,?,?,?), ref: 0024ABBA
Part of subcall function 0024AB90: DestroyIcon.USER32(?,?,?), ref: 0024ABC2
Part of subcall function 0024AB90: DestroyIcon.USER32(?,?,?), ref: 0024ABCA
Part of subcall function 0024AB90: DestroyIcon.USER32(?,?,?), ref: 0024ABD2
Part of subcall function 0024AB90: DestroyIcon.USER32(?,?,?), ref: 0024ABDA
Part of subcall function 0024AB90: DestroyIcon.USER32(?,?,?), ref: 0024ABE2
Part of subcall function 0024AB90: ~_Task_impl.LIBCPMT ref: 0024AC1C

~_Task_impl.LIBCPMT ref: 001DE362

Part of subcall function 00200177: __EH_prolog3.LIBCMT ref: 0020017E

~_Task_impl.LIBCPMT ref: 001DE371
~_Task_impl.LIBCPMT ref: 001DE380

Part of subcall function 001733E0: std::bad_exception::~bad_exception.LIBCMTD ref: 00173428

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: DestroyIcon$H_prolog3$Task_impl$std::bad_exception::~bad_exception
String ID:
API String ID: 757558138-0
Opcode ID: d76dc4e835e0baa25a1c4645998e335331262e8bfa116a374e3256e70635536d
Instruction ID: adf2db66914ef34ee80c1d66a2f565f0b4a072fc89d007c4820360b1e142e7e2
Opcode Fuzzy Hash: d76dc4e835e0baa25a1c4645998e335331262e8bfa116a374e3256e70635536d
Instruction Fuzzy Hash: C7F08C38415784DAE719F7B4C0557DDBAB0AF28300F40418CE4AE132C2CFB42B18CA62

Function 02AFA680 Relevance: 6.0, APIs: 4, Instructions: 27threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,02AF9DF0,00000000,00000000,00000000), ref: 02AFA697
CreateThread.KERNEL32(00000000,00000000,02AFA2E0,00000000,00000000,00000000), ref: 02AFA6AA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02AFA6AF
Sleep.KERNEL32(0000012C), ref: 02AFA6BA

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: CreateThread$ObjectSingleSleepWait
String ID:
API String ID: 1183137808-0
Opcode ID: bc2984217e5328a51e382644820a62c24c5eb6671fc2910e2ca36791e7345b1f
Instruction ID: a844ff8bb2960a9f75091c3166a392e6c755b5d727293135d01998447d8eddef
Opcode Fuzzy Hash: bc2984217e5328a51e382644820a62c24c5eb6671fc2910e2ca36791e7345b1f
Instruction Fuzzy Hash: ADE01732BC432176FA701AA56C0BF8A2F64A786FB0F310501F3257F0C08AD434928A9C

Function 02AF17F0 Relevance: 6.0, APIs: 4, Instructions: 21synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 02AF1800
Sleep.KERNEL32(000003E8), ref: 02AF1807
InterlockedExchange.KERNEL32(?,00000000), ref: 02AF1813
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02AF181F

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ObjectSingleWait$ExchangeInterlockedSleep
String ID:
API String ID: 3621840306-0
Opcode ID: 5287ed119480bfb33773b5df6cbb17f55fcbdc0ff04ad252ac62558e3f16b256
Instruction ID: 28ee745b4e6faedd3cb261cc3a89f698b744fe0adc984bb1b13e03118bfce031
Opcode Fuzzy Hash: 5287ed119480bfb33773b5df6cbb17f55fcbdc0ff04ad252ac62558e3f16b256
Instruction Fuzzy Hash: 3DE0CD3A54431067C214ABA9ED44D4777BCEBC5730B514B19F671936C0CD70F400CBA0

Function 02AFDFD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

recv sn=%lu, xrefs: 02AFE093

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID:
String ID: recv sn=%lu
API String ID: 0-1144994348
Opcode ID: 5ca4382c856d2c475a3e0decc02a28da9eed617f5a780fb7a0c375bbff4da689
Instruction ID: ee92f38c25f8fa80a684030fccf663d65ce2e6aab762ecaaf65ef5c4b20969f2
Opcode Fuzzy Hash: 5ca4382c856d2c475a3e0decc02a28da9eed617f5a780fb7a0c375bbff4da689
Instruction Fuzzy Hash: F25189716007049FD760CF59C680B96B3F6FF88314F20866AEA598B660EB75F954CB90

Function 02AF9080 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF90F6
_memmove.LIBCMT ref: 02AF914C

Part of subcall function 02AF8EB0: std::_Xinvalid_argument.LIBCPMT ref: 02AF8EC7

Strings

string too long, xrefs: 02AF90F1

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 770a09935947914ebe24be3f79074e122cf0e0d95a0ab0929b77534385d7fb05
Instruction ID: ca0482d44103e46c9a77cc9fa38fb5f90839ce8a27e4a1d6e8b790aa9b6f7659
Opcode Fuzzy Hash: 770a09935947914ebe24be3f79074e122cf0e0d95a0ab0929b77534385d7fb05
Instruction Fuzzy Hash: 6031A0723001169B4794DA9EE8C496BF3AAFFD5365304453AF709C7600DB35AC69C7A4

Function 001B08E2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001B08E9
InflateRect.USER32(?,000000FD,000000FD), ref: 001B093F

Strings

%d%%, xrefs: 001B09A2

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3_InflateRect
String ID: %d%%
API String ID: 3173815319-1518462796
Opcode ID: cd1ea4685f987a87f9834405f299a3ecae048ad50efa240e6c99e30cda782857
Instruction ID: ec5e540d8a8d6afe20f4a4deade6c07e8c0b5908e0df95fd760a82933e54314f
Opcode Fuzzy Hash: cd1ea4685f987a87f9834405f299a3ecae048ad50efa240e6c99e30cda782857
Instruction Fuzzy Hash: F7315632601218AFDB15DFA4CC859EFB7B9BF4D704B114559F405AB292D730EE00CBA0

Function 001B2435 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B243C
FillRect.USER32(?,?), ref: 001B245F

Part of subcall function 0017A40A: __EH_prolog3.LIBCMT ref: 0017A411
Part of subcall function 0017A40A: CreatePen.GDI32(?,?,?), ref: 0017A432

Part of subcall function 0017A336: SelectObject.GDI32(?,00000000), ref: 0017A35C
Part of subcall function 0017A336: SelectObject.GDI32(?,?), ref: 0017A372

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Strings

(, xrefs: 001B24DC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3ObjectSelect$CreateException@8FillRectThrow
String ID: (
API String ID: 1832654073-1334834377
Opcode ID: b3f11347e4ae5df3c1d018d7d905be360a250c62567f332c687a8af4c72efcf5
Instruction ID: 26798a3b21a1ac502ec096a7da35b1a44e7c1bb9a0b2e8f9523ae41754284e84
Opcode Fuzzy Hash: b3f11347e4ae5df3c1d018d7d905be360a250c62567f332c687a8af4c72efcf5
Instruction Fuzzy Hash: 85319D7161020AAFDF11EFA4DC86DEF7B76BF59300F008428F81567292CB718968DB61

Function 001E2A47 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 001E2A87
GetClientRect.USER32(?,?), ref: 001E2AD0

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Part of subcall function 0018065B: GetParent.USER32(?), ref: 00180665

Strings

,, xrefs: 001E2A73, 001E2A99

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: ClientCursorException@8LoadParentRectThrow
String ID: ,
API String ID: 1627280313-1222783184
Opcode ID: c69a79a91ddfb7e117608a0c83136d1ad612f1d47b9c52f631e6d95c0a8090de
Instruction ID: 5ad36c2877106b0e955c51d7fef49abf3ad9bb27273586c978e7a2b0279a796d
Opcode Fuzzy Hash: c69a79a91ddfb7e117608a0c83136d1ad612f1d47b9c52f631e6d95c0a8090de
Instruction Fuzzy Hash: F0317671A406099FDB54DFA9DD91BBEB7F9EF48310F10442AF51AE7281DB70AD408B60

Function 02AF4F80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF4FF9
_memmove.LIBCMT ref: 02AF502C

Part of subcall function 02AF50B0: std::_Xinvalid_argument.LIBCPMT ref: 02AF50C8
Part of subcall function 02AF50B0: std::_Xinvalid_argument.LIBCPMT ref: 02AF50E6
Part of subcall function 02AF50B0: _memmove.LIBCMT ref: 02AF512A

Strings

string too long, xrefs: 02AF4FF4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 61bfe4178730fb9b252746aeb7035ac1344bac51f939be0f636158c7aa30df43
Instruction ID: 840e5844796920dc63946439d25d3fa84b188d07ad90807a6d6ab0dcf18910c5
Opcode Fuzzy Hash: 61bfe4178730fb9b252746aeb7035ac1344bac51f939be0f636158c7aa30df43
Instruction Fuzzy Hash: 0E21DF71700205AF5754DFADE8C0D2AB3AAFFC8625341012BF705CB610DF35A851CBA4

Function 02AF8DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF8E3C
_memmove.LIBCMT ref: 02AF8E82

Part of subcall function 02AF6000: std::_Xinvalid_argument.LIBCPMT ref: 02AF6016

Strings

string too long, xrefs: 02AF8E37

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 86bbc252487ca36d9a1cca72ce6c3c9a71ba4ba2709ef1fdbb9c955f4b3d1e4e
Instruction ID: f6d2acee9d9ae5e9cb9b3a1d22848315d51049e4c66e7eb0c5b76f9a387e5626
Opcode Fuzzy Hash: 86bbc252487ca36d9a1cca72ce6c3c9a71ba4ba2709ef1fdbb9c955f4b3d1e4e
Instruction Fuzzy Hash: 0E21AF703006508FD7758AECC8C4A1AA7E6EF85A45B240959F2A2CB680EF7DDC408B95

Function 02AF2BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02AF2BC5
GetMonitorInfoW.USER32 ref: 02AF2BDB

Strings

h, xrefs: 02AF2BD3

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: InfoMonitor_memset
String ID: h
API String ID: 741975714-2439710439
Opcode ID: 718e1a8f98086a4f3034af367218580758af54ddd4cebf22c135fd4fb17e451d
Instruction ID: 9674567c6817ac461345bdadca718a8c69e9be70de17bae76f6de34b48c766e2
Opcode Fuzzy Hash: 718e1a8f98086a4f3034af367218580758af54ddd4cebf22c135fd4fb17e451d
Instruction Fuzzy Hash: BF312C75A047048FC308DF19D44195ABBE6FFC8310F108AAEE95587361D731E856CF92

Function 00250136 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0025013D

Part of subcall function 0024E44F: __EH_prolog3.LIBCMT ref: 0024E456

Part of subcall function 00264001: __EH_prolog3.LIBCMT ref: 00264008

Strings

e), xrefs: 0025020A
e), xrefs: 00250193

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID: e)$e)
API String ID: 431132790-1067769932
Opcode ID: 3fa6b0808bcf9d533d4526f8c76479237a5146ab4a5bb2b5b5c80cc42c8e4dcd
Instruction ID: 4b4a987694a5e7c3aefc05d91c2d39b62572c3409b795ff9fedad17c0072dc25
Opcode Fuzzy Hash: 3fa6b0808bcf9d533d4526f8c76479237a5146ab4a5bb2b5b5c80cc42c8e4dcd
Instruction Fuzzy Hash: A34138B4841B44DED766EB74C0857DABBF4AF35300F10895EE5AE97282DF702609CB26

Function 00182048 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 0018879E: LeaveCriticalSection.KERNEL32(?,?,001837B1,00000010,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96,00000004,00171031), ref: 001887B9

__CxxThrowException@8.LIBCMT ref: 00182053

Part of subcall function 0026AAA6: RaiseException.KERNEL32(?,?,?,?), ref: 0026AAE8

__snwprintf_s.LIBCMT ref: 001820A4
__snwprintf_s.LIBCMT ref: 001820D6

Part of subcall function 00268FB0: __getptd_noexit.LIBCMT ref: 00268FB0

Strings

Afx:%p:%x, xrefs: 0018209A

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: __snwprintf_s$CriticalExceptionException@8LeaveRaiseSectionThrow__getptd_noexit
String ID: Afx:%p:%x
API String ID: 730118740-3201128726
Opcode ID: 675aecaac6f45f9f8a58dc6efa79733ce8f735110e742c2d06c8c3a85b89cc0b
Instruction ID: d9e2ce91bd548ccd020b21459daac5709f093abbc8ab6194b8c812080ea79316
Opcode Fuzzy Hash: 675aecaac6f45f9f8a58dc6efa79733ce8f735110e742c2d06c8c3a85b89cc0b
Instruction Fuzzy Hash: 42214171D00208AFCB12FFA9C941A9EBBF8EF58350F508166F914A7251DBB09A50CFA1

Function 0019267D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00192684
SetRectEmpty.USER32(?), ref: 00192714

Strings

Afx:ToolBar, xrefs: 0019271A

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: EmptyH_prolog3_Rect
String ID: Afx:ToolBar
API String ID: 2941628838-177727192
Opcode ID: 4e4c13e58ce26e512fda5acd3f0e1e9a50c3eeb5ab253ebeea1b84ae486ac07b
Instruction ID: 455699ad05744452d483827ab1585fa92ad203cf27de71e9b0bd7e90060fdc19
Opcode Fuzzy Hash: 4e4c13e58ce26e512fda5acd3f0e1e9a50c3eeb5ab253ebeea1b84ae486ac07b
Instruction Fuzzy Hash: 23218171A512199FCF04DFB4C986AEE7BB8FF58350F14012AF915E7281DB349954CBA0

Function 02AF5DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF5DE4

Part of subcall function 02B127F5: std::exception::exception.LIBCMT ref: 02B1280A
Part of subcall function 02B127F5: __CxxThrowException@8.LIBCMT ref: 02B1281F
Part of subcall function 02B127F5: std::exception::exception.LIBCMT ref: 02B12830

_memmove.LIBCMT ref: 02AF5E2C

Strings

string too long, xrefs: 02AF5DDF

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: 1a94e9cc65709009e86b7e0307124bcf87cdeffdf7333774fdadf86a9b99d4f7
Instruction ID: 788e359c124b0f21a9bbbb95d4a88622c3ca55b22dc0226049dc78fbde34979b
Opcode Fuzzy Hash: 1a94e9cc65709009e86b7e0307124bcf87cdeffdf7333774fdadf86a9b99d4f7
Instruction Fuzzy Hash: F21129325047105FF764DEB8E8C0A2FB799AF11618F940A2EF183C3181EB35A4488BA0

Function 02AF8EB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF8EC7

Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B12857
Part of subcall function 02B12842: __CxxThrowException@8.LIBCMT ref: 02B1286C
Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B1287D

Part of subcall function 02AF5060: std::_Xinvalid_argument.LIBCPMT ref: 02AF506D

_memmove.LIBCMT ref: 02AF8F27

Strings

invalid string position, xrefs: 02AF8EC2

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 5b691b5e8c201fc036487ce19fa4bc38b7a35678c459e8673a30808948e12184
Instruction ID: ee515de8b702578d5240c400d0d1a476cc73e81ee2c825893fec340e475ff53b
Opcode Fuzzy Hash: 5b691b5e8c201fc036487ce19fa4bc38b7a35678c459e8673a30808948e12184
Instruction Fuzzy Hash: 1B11D3327102158FCB54EEADE8C046AB36BBF94328351466BF5058B240DB39E959CBA0

Function 001B2066 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001B206D
InflateRect.USER32(?,000000FE,000000FE), ref: 001B208E

Part of subcall function 0017A40A: __EH_prolog3.LIBCMT ref: 0017A411
Part of subcall function 0017A40A: CreatePen.GDI32(?,?,?), ref: 0017A432

Part of subcall function 0017A336: SelectObject.GDI32(?,00000000), ref: 0017A35C
Part of subcall function 0017A336: SelectObject.GDI32(?,?), ref: 0017A372

Part of subcall function 00179D3E: MoveToEx.GDI32(?,?,?,?), ref: 00179D68
Part of subcall function 00179D3E: MoveToEx.GDI32(?,?,?,?), ref: 00179D79

Part of subcall function 001797C1: MoveToEx.GDI32(?,?,?,00000000), ref: 001797DE
Part of subcall function 001797C1: LineTo.GDI32(?,?,?), ref: 001797ED

Strings

(, xrefs: 001B211D

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Move$H_prolog3ObjectSelect$CreateInflateLineRect
String ID: (
API String ID: 2702496521-1334834377
Opcode ID: afe94fe620f24962b1785ff5ff137941709377e6ccbc11f96c2318a7f9fd09bf
Instruction ID: 4c6d6d7e18bba71d1dc48fa0b87dfb4033e15e61f34a429163ecf064f38483e8
Opcode Fuzzy Hash: afe94fe620f24962b1785ff5ff137941709377e6ccbc11f96c2318a7f9fd09bf
Instruction Fuzzy Hash: FF214C7560010EABCF04EFA4CD86EFE77BAAF98314F148214F915A22D1DB349A159B61

Function 001941D3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001941DA

Part of subcall function 001FABAD: __EH_prolog3.LIBCMT ref: 001FABB4

Part of subcall function 0018289B: GetDlgCtrlID.USER32(?), ref: 001828A4

Strings

%sMFCToolBar-%d%x, xrefs: 00194242
%sMFCToolBar-%d, xrefs: 0019422B

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$Ctrl
String ID: %sMFCToolBar-%d$%sMFCToolBar-%d%x
API String ID: 3879667756-3776508225
Opcode ID: 3c9aacf950a1e0d9ee20d80d44be2a5abbb4ec53684bed27ecd7ea8c5ed0fdec
Instruction ID: 91e4c662a6005afa772b39b2ae4197f080c4aa749d18996d2c5a56bd233a88e3
Opcode Fuzzy Hash: 3c9aacf950a1e0d9ee20d80d44be2a5abbb4ec53684bed27ecd7ea8c5ed0fdec
Instruction Fuzzy Hash: 3521B071A00209ABCF15EFF4CC46DAEBB75AF65324F004618F529A7282D7709A51DBA2

Function 02AFC200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

StrChrW.SHLWAPI(?,0000003A), ref: 02AFC225
_swscanf.LIBCMT ref: 02AFC25F

Strings

%d.%d.%d.%d%c, xrefs: 02AFC259

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _swscanf
String ID: %d.%d.%d.%d%c
API String ID: 2748852333-2398565245
Opcode ID: 3e9acd87a261023fb37a736913641521fba2d68790413c23455ce029da2ebbb5
Instruction ID: 9dffaccdb1ba57843a5454de00110c43579ea15eff1b15347cb014359adad37a
Opcode Fuzzy Hash: 3e9acd87a261023fb37a736913641521fba2d68790413c23455ce029da2ebbb5
Instruction Fuzzy Hash: 85119331B0010D97DB29EBE99891AFEB7BADB49714F0000AAE90BD7580DA645A549781

Function 02AF5370 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02AF53B8
_memmove.LIBCMT ref: 02AF5409

Strings

@, xrefs: 02AF53E4

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: _memmove
String ID: @
API String ID: 4104443479-2766056989
Opcode ID: 390077d89bae56a7a455647d903ee5833ef9d782f396aa6a9507ee48ecd92083
Instruction ID: df61dc70fcf7f5d355f4e6dcf793422d02575db2cc9d8c114af5b93e6695a67d
Opcode Fuzzy Hash: 390077d89bae56a7a455647d903ee5833ef9d782f396aa6a9507ee48ecd92083
Instruction Fuzzy Hash: 0511D6B2A047049BC718CF99D8D0AAF77FBAB94204F50466DE50787241EF74EA09CB91

Function 02AF5D40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF5D52

Part of subcall function 02B127F5: std::exception::exception.LIBCMT ref: 02B1280A
Part of subcall function 02B127F5: __CxxThrowException@8.LIBCMT ref: 02B1281F
Part of subcall function 02B127F5: std::exception::exception.LIBCMT ref: 02B12830

std::_Xinvalid_argument.LIBCPMT ref: 02AF5D65

Strings

string too long, xrefs: 02AF5D4D, 02AF5D60

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 1c344d6228ee82a748b9217269e1ad890cb9e7aa3c986473b966378831d3a5db
Instruction ID: 64e27fdf9f38ea091ce0d6fdf0dfb594a33a703eb2df6b3a20b5055e3b2d6b34
Opcode Fuzzy Hash: 1c344d6228ee82a748b9217269e1ad890cb9e7aa3c986473b966378831d3a5db
Instruction Fuzzy Hash: EF11E1327057508BD3B1CF6CE848B0A77E2ABC2610FA40B9DF1A187695DF79D8418BA1

Function 02AF5FC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 02AF5FED
std::_Xinvalid_argument.LIBCPMT ref: 02AF6016

Strings

invalid string position, xrefs: 02AF6011

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 3614006799-1799206989
Opcode ID: 15064fe537857404cb1b2e3d69afad431dd690f860f25d31d4906f7259fcdacd
Instruction ID: 1d3d3f11792cd6e89a473baa6f15277e5fbbe75cb384e1068b3ce3cf5d675563
Opcode Fuzzy Hash: 15064fe537857404cb1b2e3d69afad431dd690f860f25d31d4906f7259fcdacd
Instruction Fuzzy Hash: 53F0283260021057D738AEB8D84175AF7EBAF40720F610A6DF6638B9C1CFB5E9448BD5

Function 001C446F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001C4476

Part of subcall function 0018A349: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 0018A369

Part of subcall function 001C1ADD: __EH_prolog3.LIBCMT ref: 001C1AE4

Part of subcall function 001C1B1A: __EH_prolog3.LIBCMT ref: 001C1B21

Strings

MFCShellTreeCtrl_EnableShellContextMenu, xrefs: 001C44C1
TRUE, xrefs: 001C44E7

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCShellTreeCtrl_EnableShellContextMenu$TRUE
API String ID: 2949695960-3623726486
Opcode ID: 788b47103996cd25466adf23e756bc2a48fe34944dcf5c2c0d7fac0af639ffcb
Instruction ID: faaf947a7cc6baab3652110361423edf3633d45f0f34566b2f1295c9e394f13f
Opcode Fuzzy Hash: 788b47103996cd25466adf23e756bc2a48fe34944dcf5c2c0d7fac0af639ffcb
Instruction Fuzzy Hash: BD118B3185114AAADB04FBF4C856BFEB3B4AF30300F508618F025A31D2DB749A18CB62

Function 02AF9190 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF919F

Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B12857
Part of subcall function 02B12842: __CxxThrowException@8.LIBCMT ref: 02B1286C
Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B1287D

_memmove.LIBCMT ref: 02AF91DA

Strings

invalid string position, xrefs: 02AF919A

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 2fd3e315a3921ec30781b44575e760c7f41534e2e5feaa2c4acf2df72c42259f
Instruction ID: 02d14e74757c707a198253cb6aa84ca89c33d8eddfbd1a38b93ba6d0f01531a5
Opcode Fuzzy Hash: 2fd3e315a3921ec30781b44575e760c7f41534e2e5feaa2c4acf2df72c42259f
Instruction Fuzzy Hash: 3D0192313006164BC3A5CEBDDC8495BB3B7AFC47043244A7CE186C7618EF35D84A8794

Function 02AFEDD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 02AFEE0B
WSAGetLastError.WS2_32(?,02AFFF33,?,00000000,000000FF,00000000), ref: 02AFEE16

Strings

<C-CNNID: %Iu> send 0 bytes (detect package), xrefs: 02AFEE2C

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: ErrorLastsend
String ID: <C-CNNID: %Iu> send 0 bytes (detect package)
API String ID: 1802528911-4236689219
Opcode ID: 04b1493c3aef8fe3ea3ecca4a2ce1cb02658095220bd4a49fde8f14a18205864
Instruction ID: 70e6059e097d4da04450aad25a7169098665fc715203a0968af0e64a2f2e1055
Opcode Fuzzy Hash: 04b1493c3aef8fe3ea3ecca4a2ce1cb02658095220bd4a49fde8f14a18205864
Instruction Fuzzy Hash: 440180B6A00B005FD3708FAAF984A43B7F5FBC8726B104E2EE55AC3650D774A4048F90

Function 02AF6130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF613F

Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B12857
Part of subcall function 02B12842: __CxxThrowException@8.LIBCMT ref: 02B1286C
Part of subcall function 02B12842: std::exception::exception.LIBCMT ref: 02B1287D

_memmove.LIBCMT ref: 02AF6175

Strings

invalid string position, xrefs: 02AF613A

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 80cbce33acdbf38d8e6a6be76bcedbd89a3d62a1afb5f6ba02191746d04ea1e5
Instruction ID: f782df25ece3756334d33a134fff599a8cd995edbee1937ed12ed9ad1c38c451
Opcode Fuzzy Hash: 80cbce33acdbf38d8e6a6be76bcedbd89a3d62a1afb5f6ba02191746d04ea1e5
Instruction Fuzzy Hash: 2901A7307002014BD3658AACDC9061AB3FB9BC1D04B240A1CF2A1C774ADBB5EC458798

Function 001867F5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32(?,?), ref: 0018681A
CopyRect.USER32(?,?), ref: 0018682C

Strings

(, xrefs: 00186813

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CopyInfoMonitorRect
String ID: (
API String ID: 2119610155-3887548279
Opcode ID: cf38bdc065d09df6527e6a5d24631457ede21c4d95eba31739b97fc7d95abd33
Instruction ID: c08a955f78bd22a1e59d6607b8c52d8f42a285c0e1935c3376761d1c51e2551e
Opcode Fuzzy Hash: cf38bdc065d09df6527e6a5d24631457ede21c4d95eba31739b97fc7d95abd33
Instruction Fuzzy Hash: E6119375A00609EFCB50DFA9D98999EB7F8FB08304B508859E459E7210E730FE45CF21

Function 001DC24E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 001DC25B
GetParent.USER32(?), ref: 001DC26D

Strings

e*, xrefs: 001DC28C

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: Parent
String ID: e*
API String ID: 975332729-654361256
Opcode ID: 8c5c0e62a8bbb7ec31bfe2175948d2a3e3235d3e8d77b78f9055d0bc713d2bd7
Instruction ID: 16fcd245803f0c5370f85d053e2b92020dccd7267d4dec4869359ed64723c610
Opcode Fuzzy Hash: 8c5c0e62a8bbb7ec31bfe2175948d2a3e3235d3e8d77b78f9055d0bc713d2bd7
Instruction Fuzzy Hash: 38F06732722212265F223AB59C8587B0AAE9FD5351B18083BF809D275AEF30CC1186E0

Function 02AF9210 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 02AF921D

Part of subcall function 02B127F5: std::exception::exception.LIBCMT ref: 02B1280A
Part of subcall function 02B127F5: __CxxThrowException@8.LIBCMT ref: 02B1281F
Part of subcall function 02B127F5: std::exception::exception.LIBCMT ref: 02B12830

_memmove.LIBCMT ref: 02AF9259

Strings

vector<T> too long, xrefs: 02AF9218

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: faabf505de38af6a708857670e186f0a4aee0c44f59e1b33b818eb8ad3052b84
Instruction ID: a82e2f9191332f72f90e1a5f25ac20d8f93b136b500e2855334474b229764959
Opcode Fuzzy Hash: faabf505de38af6a708857670e186f0a4aee0c44f59e1b33b818eb8ad3052b84
Instruction Fuzzy Hash: B101DB71D503016FD764DF6CF980A6A77E4E7C4B90B454AA9F505C3240EF3AEA28CE91

Function 02B08447 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02B02F7E: __getptd.LIBCMT ref: 02B02F84
Part of subcall function 02B02F7E: __getptd.LIBCMT ref: 02B02F94

__getptd.LIBCMT ref: 02B08456

Part of subcall function 02B045E4: __getptd_noexit.LIBCMT ref: 02B045E7
Part of subcall function 02B045E4: __amsg_exit.LIBCMT ref: 02B045F4

__getptd.LIBCMT ref: 02B08464

Strings

csm, xrefs: 02B08472

Memory Dump Source

Source File: 00000000.00000002.2325723005.0000000002AF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: true

Associated: 00000000.00000002.2325723005.0000000002B25000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2af0000_1.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: a12cdc99bdc2cfc7679b56194bb6e6d6ecaa50802c19d73ca7bbfc669c815bde
Instruction ID: 7016de25b8d48fb9770646a59d82214df77fa5ba876114f5520d7acf32f1ad7f
Opcode Fuzzy Hash: a12cdc99bdc2cfc7679b56194bb6e6d6ecaa50802c19d73ca7bbfc669c815bde
Instruction Fuzzy Hash: 97016D348003058ACF3AAF65D4C46ADBFB6FF00211F1844EED845966E1CB35DA85CF51

Function 0018872C Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00300170,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188766
InitializeCriticalSection.KERNEL32(?,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188778
LeaveCriticalSection.KERNEL32(00300170,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188785
EnterCriticalSection.KERNEL32(?,?,?,?,?,00183797,00000010,00000008,0017B9D6,0017B96D,00175FA4,00175A05,?,0017612F,00000004,00174F96), ref: 00188795

Part of subcall function 00179096: __CxxThrowException@8.LIBCMT ref: 001790AC

Memory Dump Source

Source File: 00000000.00000002.2324636985.0000000000171000.00000020.00000001.01000000.00000003.sdmp, Offset: 00170000, based on PE: true

Associated: 00000000.00000002.2324619627.0000000000170000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324744378.000000000028C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324770844.00000000002CE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324785086.00000000002D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324804744.00000000002FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324818892.0000000000306000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_170000_1.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$Exception@8InitializeLeaveThrow
String ID:
API String ID: 3253506028-0
Opcode ID: 46837c32b036f3b6cb3668d88a03a450b5a6e157039e543d8cf4f2faafad6762
Instruction ID: 007781573e4ff98fb7b5a9919358b0b27ad43791cc6ee5ca557c19e6376143f7
Opcode Fuzzy Hash: 46837c32b036f3b6cb3668d88a03a450b5a6e157039e543d8cf4f2faafad6762
Instruction Fuzzy Hash: C9F0F0376422099BCB153B58EC8AB2AB77AFFA1361FA40132F14442192CB308981CFA5

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1.exe_2262233b1c4a664c14445ff2c18db8ed6a66_c1a861f5_ca6121c6-1511-4226-8e9b-14ee799fea8e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER922C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9356.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9386.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
1.exe

Function 00187E35 Relevance: 105.6, APIs: 48, Strings: 12, Instructions: 557
libraryloaderstringCOMMON

Function 02AF2320 Relevance: 89.7, APIs: 38, Strings: 13, Instructions: 447
stringnetworklibraryCOMMON

Function 02AF9DF0 Relevance: 47.6, APIs: 20, Strings: 7, Instructions: 330
sleepsynchronizationtimeCOMMON

Function 001878DC Relevance: 64.8, APIs: 43, Instructions: 304
COMMONLIBRARYCODE

Function 001D6E09 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 421
windowCOMMONLIBRARYCODE

Function 02AFA2E0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223
sleepsynchronizationtimeCOMMON

Function 02AF3E70 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 165
registrystringCOMMON

Function 02AF2D40 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164
windowCOMMON

Function 028A2310 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 120
memoryCOMMON

Function 02AF2FC0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 99
sleepstringsynchronizationCOMMON

Function 02AF1410 Relevance: 21.2, APIs: 14, Instructions: 157
networkstringtimeCOMMON

Function 028A1410 Relevance: 21.2, APIs: 14, Instructions: 157
networkstringtimeCOMMON

Function 02AF4290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Function 00171660 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128
threadsleepCOMMON

Function 001A25A3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre